login.doterra.com Open in urlscan Pro
45.60.12.13 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://mydoterra.com/
Effective URL:
https://login.doterra.com/us/en-us/sign-in
Submission: On October 08 via api (October 8th 2024, 10:23:54 pm UTC) from US — Scanned from US

Summary HTTP 73 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 21 IPs in 2 countries across 15 domains to perform 73 HTTP transactions. The main IP is 45.60.12.13, located in United States and belongs to INCAPSULA, US. The main domain is login.doterra.com. The Cisco Umbrella rank of the primary domain is 512881.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on December 6th 2023. Valid for: a year.

This is the only time login.doterra.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	45.60.102.13 45.60.102.13	19551 (INCAPSULA) (INCAPSULA)
17	45.60.12.13 45.60.12.13	19551 (INCAPSULA) (INCAPSULA)
5	2607:f8b0:400... 2607:f8b0:4006:821::2008	15169 (GOOGLE) (GOOGLE)
1 1	107.23.218.60 107.23.218.60	14618 (AMAZON-AES) (AMAZON-AES)
10	13.225.63.64 13.225.63.64	16509 (AMAZON-02) (AMAZON-02)
4	18.238.80.98 18.238.80.98	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:80e::200a	15169 (GOOGLE) (GOOGLE)
6	18.238.49.126 18.238.49.126	16509 (AMAZON-02) (AMAZON-02)
2	142.250.64.67 142.250.64.67	15169 (GOOGLE) (GOOGLE)
1	18.238.49.99 18.238.49.99	16509 (AMAZON-02) (AMAZON-02)
6	2607:f8b0:400... 2607:f8b0:4006:809::200e	15169 (GOOGLE) (GOOGLE)
2	142.251.40.232 142.251.40.232	15169 (GOOGLE) (GOOGLE)
3	2600:9000:21d... 2600:9000:21da:f800:1c:9484:cec0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	35.201.112.186 35.201.112.186	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	142.251.40.194 142.251.40.194	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80a::2002	15169 (GOOGLE) (GOOGLE)
2	35.186.194.58 35.186.194.58	15169 (GOOGLE) (GOOGLE)
2	142.250.65.238 142.250.65.238	15169 (GOOGLE) (GOOGLE)
2	172.64.144.121 172.64.144.121	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.39.221 104.18.39.221	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.251.41.4 142.251.41.4	15169 (GOOGLE) (GOOGLE)
1	52.37.62.188 52.37.62.188	16509 (AMAZON-02) (AMAZON-02)
73	21

1 45.60.102.13 (United States) 1 redirects

ASN19551 (INCAPSULA, US)

mydoterra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 45.60.12.13 (United States)

ASN19551 (INCAPSULA, US)

www.mydoterra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
login.doterra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:821::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.23.218.60 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: lb-d.us1.gigya.com

fidm.us1.gigya.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 13.225.63.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-64.ewr53.r.cloudfront.net

sdk.login.doterra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.238.80.98 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-80-98.jfk52.r.cloudfront.net

cdn.appdynamics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80e::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.238.49.126 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-49-126.jfk52.r.cloudfront.net

consent.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.64.67 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.49.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-49-99.jfk52.r.cloudfront.net

consent.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:809::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.232 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:21da:f800:1c:9484:cec0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.attn.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.112.186 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.194 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s38-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80a::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.194.58 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 58.194.186.35.bc.googleusercontent.com

rs.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.65.238 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.64.144.121 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

doterra.attn.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.39.221 (None, )

ASN13335 (CLOUDFLARENET, US)

events.attentivemobile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.41.4 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s40-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.37.62.188 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-37-62-188.us-west-2.compute.amazonaws.com

pdx-col.eum-appdynamics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	doterra.com login.doterra.com — Cisco Umbrella Rank: 512881 sdk.login.doterra.com — Cisco Umbrella Rank: 592871	1 MB
8	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 34 Failed	22 KB
7	trustarc.com consent.trustarc.com — Cisco Umbrella Rank: 3434	391 KB
7	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	491 KB
5	attn.tv cdn.attn.tv — Cisco Umbrella Rank: 4258 doterra.attn.tv — Cisco Umbrella Rank: 400321	46 KB
4	fullstory.com edge.fullstory.com — Cisco Umbrella Rank: 1985 rs.fullstory.com — Cisco Umbrella Rank: 2089	84 KB
4	appdynamics.com cdn.appdynamics.com — Cisco Umbrella Rank: 4017	47 KB
2	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 td.doubleclick.net — Cisco Umbrella Rank: 192	3 KB
2	gstatic.com fonts.gstatic.com Failed	77 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	1 KB
2	mydoterra.com 1 redirects mydoterra.com www.mydoterra.com	2 KB
1	eum-appdynamics.com pdx-col.eum-appdynamics.com — Cisco Umbrella Rank: 3843	795 B
1	google.com www.google.com — Cisco Umbrella Rank: 3	64 B
1	attentivemobile.com events.attentivemobile.com — Cisco Umbrella Rank: 4220	240 B
1	gigya.com 1 redirects fidm.us1.gigya.com — Cisco Umbrella Rank: 120574	1 KB
73	15

	Domain	Requested by
16	login.doterra.com	www.mydoterra.com login.doterra.com sdk.login.doterra.com
10	sdk.login.doterra.com	login.doterra.com sdk.login.doterra.com cdn.appdynamics.com
8	www.google-analytics.com	www.googletagmanager.com cdn.appdynamics.com
7	consent.trustarc.com	cdn.appdynamics.com login.doterra.com
7	www.googletagmanager.com	www.mydoterra.com www.googletagmanager.com cdn.appdynamics.com
4	cdn.appdynamics.com	login.doterra.com cdn.appdynamics.com
3	cdn.attn.tv	cdn.appdynamics.com
2	doterra.attn.tv	cdn.appdynamics.com
2	rs.fullstory.com	cdn.appdynamics.com
2	edge.fullstory.com	cdn.appdynamics.com
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	cdn.appdynamics.com
1	pdx-col.eum-appdynamics.com	cdn.appdynamics.com
1	www.google.com
1	events.attentivemobile.com	cdn.attn.tv
1	td.doubleclick.net	cdn.appdynamics.com
1	googleads.g.doubleclick.net	cdn.appdynamics.com
1	fidm.us1.gigya.com	1 redirects
1	www.mydoterra.com
1	mydoterra.com	1 redirects
73	20

This site contains links to these domains. Also see Links.

Domain
submit-irm.trustarc.com
www.doterra.com

Subject Issuer	Validity	Valid
*.mydoterra.com Go Daddy Secure Certificate Authority - G2	`2024-04-19` - `2025-05-21`	a year	crt.sh
*.google-analytics.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.login.doterra.com Go Daddy Secure Certificate Authority - G2	`2023-12-06` - `2025-01-06`	a year	crt.sh
sdk.login.doterra.com Amazon RSA 2048 M02	`2023-12-24` - `2025-01-21`	a year	crt.sh
*.appdynamics.com DigiCert TLS RSA SHA256 2020 CA1	`2024-06-20` - `2025-07-21`	a year	crt.sh
upload.video.google.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.trustarc.com Amazon RSA 2048 M02	`2024-03-16` - `2025-04-14`	a year	crt.sh
*.gstatic.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.attn.tv Amazon RSA 2048 M02	`2024-04-30` - `2025-05-28`	a year	crt.sh
edge.fullstory.com WR3	`2024-08-24` - `2024-11-22`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.doubleclick.net WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
rs.fullstory.com WR3	`2024-08-25` - `2024-11-23`	3 months	crt.sh
attn.tv WE1	`2024-10-03` - `2025-01-02`	3 months	crt.sh
attentivemobile.com WE1	`2024-10-02` - `2025-01-01`	3 months	crt.sh
*.google.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.eum-appdynamics.com DigiCert TLS RSA SHA256 2020 CA1	`2024-06-13` - `2025-07-14`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://login.doterra.com/us/en-us/sign-in
Frame ID: 8FB8EAEE8B287C29B13B526216760CA9
Requests: 66 HTTP requests in this frame

Frame: https://sdk.login.doterra.com/gs/webSdk/Api.aspx?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&version=latest&build=16506&serviceName=apiService
Frame ID: D860D33E35E140C1E87BEA3C9E578879
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagmanager.com/ns.html?id=GTM-PHX657
Frame ID: 3D4B89AE1AE52A71629206AE684539B4
Requests: 1 HTTP requests in this frame

Frame: https://sdk.login.doterra.com/gs/webSdk/Api.aspx?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&version=latest&build=16506&serviceName=apiService
Frame ID: 804147333BF56FDA32B61A07B64B590E
Requests: 2 HTTP requests in this frame

Frame: https://consent.trustarc.com/get?name=crossdomain.html&domain=doterra-cm1.com
Frame ID: 4FA860E688E391A8EEB4237425CF62B6
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/956873153?random=1728426228333&cv=11&fst=1728426228333&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a20v9193598179z871674160za201zb71674160&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&ref=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&hn=www.googleadservices.com&frm=0&tiba=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&npa=0&pscdl=noapi&auid=1745064160.1728426228&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: FF9F0C5A9E8093783EC9DAC45709BAFE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Page | dōTERRA Essential Oils

Page URL History Show full URLs

http://mydoterra.com/ HTTP 307
https://mydoterra.com/ HTTP 302
http://www.mydoterra.com/ HTTP 307
https://www.mydoterra.com/ Page URL
https://fidm.us1.gigya.com/oidc/op/v1.0/3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyj... HTTP 302
https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVV... Page URL
https://login.doterra.com/us/en-us/sign-in Page URL

Detected technologies

AppDynamics (Analytics) Expand

Overall confidence: 100%
Detected patterns

adrum

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Imperva (Security) Expand

Overall confidence: 100%
Detected patterns

/_Incapsula_Resource

TrustArc (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.trustarc\.com

Page Statistics

73
Requests

97 %
HTTPS

23 %
IPv6

15
Domains

20
Subdomains

21
IPs

2
Countries

2638 kB
Transfer

11618 kB
Size

41
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://submit-irm.trustarc.com/services/validation/201dc465-3091-4e5d-b684-8a2fbc1fd807
Title: here

Search URL Search Domain Scan URL

URL: https://www.doterra.com/privacy-notice
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.doterra.com/
Title: Back

Search URL Search Domain Scan URL

URL: https://www.doterra.com/US/en/selectRegion/WC
Title: Become a Member

Search URL Search Domain Scan URL

URL: https://www.doterra.com/US/en/usa-online-privacy-notice
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.doterra.com/US/en/wellness-advocate-terms-and-conditions
Title: Terms of Use

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mydoterra.com/ HTTP 307
https://mydoterra.com/ HTTP 302
http://www.mydoterra.com/ HTTP 307
https://www.mydoterra.com/ Page URL
https://fidm.us1.gigya.com/oidc/op/v1.0/3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c/authorize?scope=openid%20email%20profile&response_type=code&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&redirect_uri=https%3A%2F%2Fwww%2Emydoterra%2Ecom%2Fcallback HTTP 302
https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true Page URL
https://login.doterra.com/us/en-us/sign-in Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://mydoterra.com/ HTTP 307
https://mydoterra.com/ HTTP 302
http://www.mydoterra.com/ HTTP 307
https://www.mydoterra.com/

Request Chain 2

https://fidm.us1.gigya.com/oidc/op/v1.0/3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c/authorize?scope=openid%20email%20profile&response_type=code&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&redirect_uri=https%3A%2F%2Fwww%2Emydoterra%2Ecom%2Fcallback HTTP 302
https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true

73 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
www.mydoterra.com/
Redirect Chain

http://mydoterra.com/
https://mydoterra.com/
http://www.mydoterra.com/
https://www.mydoterra.com/

989 B
2 KB

463ms
290ms

Document
text/html

45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mydoterra.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.12.13 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Apache /

Resource Hash

c67fea1feac376dcf2db6c7f6d4bfd87539d72dd07f9a389fc3a351cf434c61e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://shop.doterra.com;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://shop.doterra.com;
content-type: text/html;charset=UTF-8
date: Tue, 08 Oct 2024 22:23:42 GMT
p3p: CP='PUB OTRo'
server: Apache
x-cdn: Imperva
x-iinfo: 6-86232015-86232037 NNYN CT(34 66 0) RT(1728426222617 90) q(0 0 1 4) r(2 2) U12

Redirect headers

Location: https://www.mydoterra.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 gtm.js
www.googletagmanager.com/ 247 KB
86 KB 467ms
190ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KKCSWT4

Requested by

Host: www.mydoterra.com
URL: https://www.mydoterra.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.mydoterra.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Tue, 08 Oct 2024 22:23:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:43 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 21:12:35 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87436
x-xss-protection: 0
server: Google Tag Manager

GET
H2

200

op-proxy Show response
login.doterra.com/
Redirect Chain

https://fidm.us1.gigya.com/oidc/op/v1.0/3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c/authorize?scope=openid%20email%20profile&response_type=code&client_id=BhJDeNVWPPH1UqTCQn9y...
https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvd...

2 KB
1 KB

264ms
108ms

Document
text/html

45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
Requested by: Host: www.mydoterra.com
URL: https://www.mydoterra.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: nginx/1.27.1 /
Resource Hash: 94399e2601265869a5143ac40c14105ee47217965bb8b49f3dca19060091e273

Request headers

Referer: https://www.mydoterra.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-type: text/html
date: Tue, 08 Oct 2024 22:23:44 GMT
etag: "66d9dd96-5ca"
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
server: nginx/1.27.1
x-cdn: Imperva
x-iinfo: 7-94681986-94682003 NNYY CT(29 30 0) RT(1728426223845 76) q(0 0 0 0) r(0 0) U12

Redirect headers

cache-control: private
content-length: 0
date: Tue, 08 Oct 2024 22:23:43 GMT
location: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-callid: 3abd7693df2743b8879e8c2ff82a3911
x-error-code: 0
x-robots-tag: none
x-server: us1d-nomad-t11
x-soa: true, Gator

GET
H2 200 js
www.googletagmanager.com/gtag/ 198 KB
0 175ms
175ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XW71K6YFHT&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KKCSWT4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.mydoterra.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 08 Oct 2024 22:23:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 105796
x-xss-protection: 0
server: Google Tag Manager

GET analytics.js
www.google-analytics.com/ 0
0

GET
H2 200 gigya.js Show response
sdk.login.doterra.com/js/ 561 KB
182 KB 530ms
149ms Script
text/javascript 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.login.doterra.com/js/gigya.js?apikey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-64.ewr53.r.cloudfront.net
Software: /
Resource Hash: 69320926483ccbad45b2501781e640e883053216af234b5a553efc33a2b54b07

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

x-robots-tag: none
content-encoding: gzip
age: 2497
x-callid: f550f20d486d4f48b23ab44c3765a3f7
x-cache: Hit from cloudfront
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-error-code: 0
date: Tue, 08 Oct 2024 21:42:06 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-server: us1d-nomad-t14
x-amz-cf-id: BmjozuuNWT9wVIhT9uT1AtINglWGpWGb1yw-fyw72vCucOcEErGfJA==
edge-cache-tag: siteid_7873911,ver_latest
cache-control: public, s-maxage=3600, max-age=900
x-soa: true, Gator
via: 1.1 c67ae9899d89f9402837da3a0ead9442.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 185622
x-amz-cf-pop: EWR53-C1

GET
H2 200 adrum-21.7.0.3493.js Show response
cdn.appdynamics.com/adrum/ 103 KB
31 KB 447ms
149ms Script
text/javascript 18.238.80.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Requested by

Host: login.doterra.com
URL: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.80.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-98.jfk52.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

802fe463fb2c5049f755d600c2add791806ba93cf67009d1f621119887e411d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: public, max-age=86400
content-encoding: br
etag: W/"d34e508fcbfbe76159b5c4134ded8a09"
age: 62596
cross-origin-resource-policy: cross-origin
via: 1.1 d9a3a15f3ae58ded645b708c4a5253c0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: K3QJ_H0QiENOQqiXD64wPScYKvtfSJBLKXEuOvHwbIXvQWMNdJHvQw==
date: Tue, 08 Oct 2024 05:00:29 GMT
content-type: text/javascript
last-modified: Wed, 21 Jul 2021 17:52:36 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P5
vary: Accept-Encoding, Origin

GET
H2 200 main.933cb6a6.js Show response
login.doterra.com/static/js/ 3 MB
786 KB 72ms
71ms Script
application/javascript 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/static/js/main.933cb6a6.js
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 3a861f1306cc08ddaca7b1accf93d58b2136bddd4ed1cc636e7097f143c9e205

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 679) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9403, public
content-encoding: gzip
etag: "66d9dd96-34c083"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 01:00:27 GMT
content-length: 804013
date: Tue, 08 Oct 2024 22:23:44 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: application/javascript

GET
H2 200 main.1586543e.css
login.doterra.com/static/css/ 29 KB
5 KB 86ms
85ms Stylesheet
text/css 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/static/css/main.1586543e.css
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: d3daf5722820a70497b1e0f7ba7d5f8a25cd0b888e9e0ba67696a69259fdcab1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 226) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9018, public
content-encoding: gzip
etag: "66d9dd96-74fb"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 00:54:02 GMT
content-length: 5367
date: Tue, 08 Oct 2024 22:23:44 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: text/css

GET
H2 200 _Incapsula_Resource Show response
login.doterra.com/ 80 KB
19 KB 76ms
76ms Script
application/javascript 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1933415757
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 8ad377325b8d131178555818d9f3fb7e2e4af080002e818bfdd3924f6a36038f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true

Response headers

x-robots-tag: noindex
cache-control: no-cache, no-store
content-encoding: gzip
content-length: 19292
content-type: application/javascript

GET
H2 200 sdk.config.get Show response
sdk.login.doterra.com/ 6 KB
3 KB 409ms
142ms Fetch
text/javascript 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.login.doterra.com/sdk.config.get?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&httpStatusCodes=true&ver=1728426120000
Requested by: Host: sdk.login.doterra.com
URL: https://sdk.login.doterra.com/js/gigya.js?apikey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-64.ewr53.r.cloudfront.net
Software: /
Resource Hash: 2d007d30cb13a18448b74ed8921b7e282f2724536b365e4c786426e78b1b40dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

x-robots-tag: none, none
content-encoding: gzip
age: 7
x-callid: 899dd54a18d946b9a84e5d991b8f527d
x-cache: Hit from cloudfront
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-error-code: 0
date: Tue, 08 Oct 2024 22:23:38 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-server: us1d-nomad-t24
x-amz-cf-id: cVpYbopuZ-LGixd35dT_ieMlOd1J7mZeznQb_sGkuYMJikeSxcUPlw==
edge-cache-tag: siteid_7873911
cache-control: public, s-maxage=120, max-age=60
x-soa: true, Gator
via: 1.1 8ab0aef6448b5ee7c8ac1a76da988556.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2185
x-amz-cf-pop: EWR53-C1

GET
H2 200 _Incapsula_Resource
login.doterra.com/ 1 B
35 B 71ms
71ms Image
text/plain 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.doterra.com/_Incapsula_Resource?SWKMTFSR=1&e=0.959942285322767
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true

Response headers

x-robots-tag: noindex
cache-control: no-cache, no-store
content-length: 1
content-type: text/plain

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 447ms
161ms Stylesheet
text/css 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway:100,200,300,400,600,700,800%7Csans-serif

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

828cf45e2ed8c73f23cbd12405750cb15f6891535bb29c31942b459c051595ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 22:23:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:45 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 08 Oct 2024 22:23:45 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 gigya.oidc.js Show response
sdk.login.doterra.com/JS/ 56 KB
19 KB 173ms
173ms Script
text/javascript 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.login.doterra.com/JS/gigya.oidc.js?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-64.ewr53.r.cloudfront.net
Software: /
Resource Hash: 062435b9bd1bb28c40b555179127d69010ca2ae9531b67572014de0b891804ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

x-robots-tag: none
content-encoding: gzip
x-callid: 965e47627edf4b99a00da2eb3af9e5e1
x-cache: Miss from cloudfront
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-error-code: 0
date: Tue, 08 Oct 2024 22:23:44 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-server: us1d-nomad-t30
x-amz-cf-id: SIrVt2NHw3UFwOLD7IPnAhwSBcp5_TfCB9zxYB5g5I4Y23ccCXJ4Sw==
edge-cache-tag: siteid_7873911,ver_latest
cache-control: public, s-maxage=3600, max-age=900
x-soa: true, Gator
via: 1.1 c67ae9899d89f9402837da3a0ead9442.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 18976
x-amz-cf-pop: EWR53-C1

GET
H2 200 logo.f55ea8a75ae9d5ed033f652af4f9373d.svg
login.doterra.com/static/media/ 12 KB
5 KB 94ms
94ms Image
image/svg+xml 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.doterra.com/static/media/logo.f55ea8a75ae9d5ed033f652af4f9373d.svg
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: da298619609610ffc1ea0a37f6cb56bb48123da37a8d5fd211463eea72fb1c32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 1366) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9363, public
content-encoding: gzip
etag: "66d9dd96-302d"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 00:59:48 GMT
content-length: 5308
date: Tue, 08 Oct 2024 22:23:45 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: image/svg+xml

GET
H2 200 Api.aspx Show response
sdk.login.doterra.com/gs/webSdk/ Frame D860 128 KB
45 KB 139ms
139ms Document
text/html 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.login.doterra.com/gs/webSdk/Api.aspx?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&version=latest&build=16506&serviceName=apiService

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.63.64 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-63-64.ewr53.r.cloudfront.net

Software

Resource Hash

0ac350c46011e4d497c2f967f96a08fa855373f61b7578a6bb58103f0bd4ebf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://login.doterra.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 2479
cache-control: public, s-maxage=3600, max-age=900
content-encoding: gzip
content-length: 45284
content-type: text/html; charset=utf-8
date: Tue, 08 Oct 2024 21:42:26 GMT
edge-cache-tag: siteid_7873911,ver_latest
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 c67ae9899d89f9402837da3a0ead9442.cloudfront.net (CloudFront)
x-amz-cf-id: rJRghtP5pT5PmAlkx2rg8yqmUuz0FoocRphp23apmH0mRamrvV_Aiw==
x-amz-cf-pop: EWR53-C1
x-cache: Hit from cloudfront
x-callid: c334551d1659495a9afb714fe926f69b
x-error-code: 0
x-robots-tag: none none
x-server: us1d-nomad-t27
x-soa: true, Gator

GET
H2 200 sdk.config.get Show response
sdk.login.doterra.com/ Frame D860 6 KB
0 0ms
0ms Fetch
text/javascript 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.login.doterra.com/sdk.config.get?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&httpStatusCodes=true&ver=1728426120000
Requested by: Host: sdk.login.doterra.com
URL: https://sdk.login.doterra.com/gs/webSdk/Api.aspx?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&version=latest&build=16506&serviceName=apiService
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-64.ewr53.r.cloudfront.net
Software: /
Resource Hash: 2d007d30cb13a18448b74ed8921b7e282f2724536b365e4c786426e78b1b40dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sdk.login.doterra.com/gs/webSdk/Api.aspx?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&version=latest&build=16506&serviceName=apiService

Response headers

x-robots-tag: none, none
content-encoding: gzip
age: 7
x-callid: 899dd54a18d946b9a84e5d991b8f527d
x-cache: Hit from cloudfront
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-error-code: 0
date: Tue, 08 Oct 2024 22:23:38 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-server: us1d-nomad-t24
x-amz-cf-id: cVpYbopuZ-LGixd35dT_ieMlOd1J7mZeznQb_sGkuYMJikeSxcUPlw==
edge-cache-tag: siteid_7873911
cache-control: public, s-maxage=120, max-age=60
x-soa: true, Gator
via: 1.1 8ab0aef6448b5ee7c8ac1a76da988556.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2185
x-amz-cf-pop: EWR53-C1

GET
H2 200 accounts.webSdkBootstrap
sdk.login.doterra.com/ 199 B
1 KB 169ms
169ms XHR
text/javascript 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.login.doterra.com/accounts.webSdkBootstrap?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&pageURL=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&sdk=js_latest&sdkBuild=16506&format=json
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-64.ewr53.r.cloudfront.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

x-robots-tag: none
access-control-max-age: 86400
content-encoding: gzip
access-control-allow-methods: GET,PUT,DELETE,HEAD,OPTIONS,POST,PATCH
x-callid: 932e0d65b6be4bf0bbfb7b00c056055f
x-cache: Miss from cloudfront
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-error-code: 0
date: Tue, 08 Oct 2024 22:23:45 GMT
content-type: text/javascript; charset=utf-8
vary: Origin, Accept-Encoding
x-server: us1d-nomad-t21
x-amz-cf-id: snME_ZdKH8qNwwWlxn0MsAwGglrpe5QuqVziYCtvLVEZCsA4mfXV9w==
cache-control: private
access-control-allow-credentials: true
x-soa: true, Gator
via: 1.1 c67ae9899d89f9402837da3a0ead9442.cloudfront.net (CloudFront)
access-control-allow-origin: https://login.doterra.com
content-length: 173
x-amz-cf-pop: EWR53-C1

GET 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v34/ 0
0

GET
H2 200 adrum-ext.59191791453ae6311081a09b4cf33c2d.js
cdn.appdynamics.com/ 51 KB
17 KB 152ms
152ms Script
text/javascript 18.238.80.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.appdynamics.com/adrum-ext.59191791453ae6311081a09b4cf33c2d.js

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.80.98 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-98.jfk52.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: public, max-age=31536000, immutable
content-encoding: br
etag: W/"042a36726299b46397273c05b21dc716"
age: 28955
cross-origin-resource-policy: cross-origin
via: 1.1 d9a3a15f3ae58ded645b708c4a5253c0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: A3ZEmZ9BjG0D0zQQ_yC1Q0fS9sYcnd-UzR2gwUjnDX-Bz8ji2SsFsg==
date: Tue, 08 Oct 2024 14:21:11 GMT
content-type: text/javascript
last-modified: Wed, 21 Jul 2021 17:52:36 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P5
vary: Accept-Encoding, Origin

GET
H2 200 doterra-favicon.ico
login.doterra.com/ 1 KB
1 KB 86ms
86ms Other
image/x-icon 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/doterra-favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 1800) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9083, public
etag: "66d9dd82-63b"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 00:55:08 GMT
content-length: 1049
date: Tue, 08 Oct 2024 22:23:45 GMT
last-modified: Thu, 05 Sep 2024 16:34:10 GMT
content-type: image/x-icon

GET
H2 200 Primary Request sign-in Show response
login.doterra.com/us/en-us/ 1 KB
916 B 106ms
106ms Document
text/html 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/us/en-us/sign-in
Requested by: Host: sdk.login.doterra.com
URL: https://sdk.login.doterra.com/JS/gigya.oidc.js?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: nginx/1.27.1 /
Resource Hash: ad5e6d66d14c32408e3f8460ce5c0194c15f286ef26eee8402c0e25563405b08

Request headers

Referer: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-type: text/html
date: Tue, 08 Oct 2024 22:23:45 GMT
etag: "66d9dd96-5ca"
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
server: nginx/1.27.1
x-cdn: Imperva
x-iinfo: 7-94681986-94682003 PNYy RT(1728426223845 1903) q(0 0 0 -1) r(0 0) U12

GET
H2 200 gigya.js Show response
sdk.login.doterra.com/js/ 561 KB
182 KB 140ms
140ms Script
text/javascript 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.login.doterra.com/js/gigya.js?apikey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-64.ewr53.r.cloudfront.net
Software: /
Resource Hash: 69320926483ccbad45b2501781e640e883053216af234b5a553efc33a2b54b07

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

x-robots-tag: none
content-encoding: gzip
age: 2499
x-callid: f550f20d486d4f48b23ab44c3765a3f7
x-cache: Hit from cloudfront
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-error-code: 0
date: Tue, 08 Oct 2024 21:42:06 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-server: us1d-nomad-t14
x-amz-cf-id: thEyvezEcibvMSLnVYpO5MCO0qhrAusLErC9MkficeUwq4w7H_YnVQ==
edge-cache-tag: siteid_7873911,ver_latest
cache-control: public, s-maxage=3600, max-age=900
x-soa: true, Gator
via: 1.1 c67ae9899d89f9402837da3a0ead9442.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 185622
x-amz-cf-pop: EWR53-C1

GET
H2 200 adrum-21.7.0.3493.js Show response
cdn.appdynamics.com/adrum/ 103 KB
0 0ms
0ms Script
text/javascript 18.238.80.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.80.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-80-98.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 802fe463fb2c5049f755d600c2add791806ba93cf67009d1f621119887e411d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

cache-control: public, max-age=86400
content-encoding: br
etag: W/"d34e508fcbfbe76159b5c4134ded8a09"
age: 62596
cross-origin-resource-policy: cross-origin
via: 1.1 d9a3a15f3ae58ded645b708c4a5253c0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: K3QJ_H0QiENOQqiXD64wPScYKvtfSJBLKXEuOvHwbIXvQWMNdJHvQw==
date: Tue, 08 Oct 2024 05:00:29 GMT
content-type: text/javascript
last-modified: Wed, 21 Jul 2021 17:52:36 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P5
vary: Accept-Encoding, Origin

GET
H2 200 main.933cb6a6.js Show response
login.doterra.com/static/js/ 3 MB
0 0ms
0ms Script
application/javascript 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/static/js/main.933cb6a6.js
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 3a861f1306cc08ddaca7b1accf93d58b2136bddd4ed1cc636e7097f143c9e205

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/us/en-us/sign-in

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 679) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9403, public
content-encoding: gzip
etag: "66d9dd96-34c083"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 01:00:27 GMT
content-length: 804013
date: Tue, 08 Oct 2024 22:23:44 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: application/javascript

GET
H2 200 main.1586543e.css
login.doterra.com/static/css/ 29 KB
0 0ms
0ms Stylesheet
text/css 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/static/css/main.1586543e.css
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: d3daf5722820a70497b1e0f7ba7d5f8a25cd0b888e9e0ba67696a69259fdcab1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/us/en-us/sign-in

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 226) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9018, public
content-encoding: gzip
etag: "66d9dd96-74fb"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 00:54:02 GMT
content-length: 5367
date: Tue, 08 Oct 2024 22:23:44 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: text/css

GET
H2 200 sdk.config.get Show response
sdk.login.doterra.com/ 6 KB
0 0ms
0ms Fetch
text/javascript 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.login.doterra.com/sdk.config.get?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&httpStatusCodes=true&ver=1728426120000
Requested by: Host: sdk.login.doterra.com
URL: https://sdk.login.doterra.com/js/gigya.js?apikey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-64.ewr53.r.cloudfront.net
Software: /
Resource Hash: 2d007d30cb13a18448b74ed8921b7e282f2724536b365e4c786426e78b1b40dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

x-robots-tag: none, none
content-encoding: gzip
age: 7
x-callid: 899dd54a18d946b9a84e5d991b8f527d
x-cache: Hit from cloudfront
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-error-code: 0
date: Tue, 08 Oct 2024 22:23:38 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-server: us1d-nomad-t24
x-amz-cf-id: cVpYbopuZ-LGixd35dT_ieMlOd1J7mZeznQb_sGkuYMJikeSxcUPlw==
edge-cache-tag: siteid_7873911
cache-control: public, s-maxage=120, max-age=60
x-soa: true, Gator
via: 1.1 8ab0aef6448b5ee7c8ac1a76da988556.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2185
x-amz-cf-pop: EWR53-C1

GET
H2 200 css
fonts.googleapis.com/ 11 KB
0 0ms
0ms Stylesheet
text/css 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway:100,200,300,400,600,700,800%7Csans-serif

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

828cf45e2ed8c73f23cbd12405750cb15f6891535bb29c31942b459c051595ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 22:23:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:45 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 08 Oct 2024 22:23:45 GMT
x-frame-options: SAMEORIGIN
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 notice Show response
consent.trustarc.com/ 37 KB
12 KB 507ms
225ms Script
text/javascript 18.238.49.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/notice?domain=doterra-cm1.com&c=teconsent&noticeType=bb&js=nj&text=true&language=en-us&gtm=1

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.49.126 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-49-126.jfk52.r.cloudfront.net

Software

Resource Hash

68af8f65b938909de97f3993d0aa2175ad962fd6566f6389c2d26bfc9b6c5f13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://login.doterra.com
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3600
access-control-expose-headers: *
content-encoding: gzip
via: 1.1 a363b826ba48f4e79f7e95839a3bcf3a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-cf-id: IZawfJkTAvqtuzo2v5UFRMHjruJ1DXU9phI0ahpLvTcrEqz_82B-iw==
date: Tue, 08 Oct 2024 22:23:46 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-pop: JFK52-P3

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 382 KB
120 KB 459ms
181ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PHX657

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

253aaa50ee84499c60fc07ab465a33fdb4f65642ee8db50fc1a03d7fe3665b40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Tue, 08 Oct 2024 22:23:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 21:12:35 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 121664
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ns.html
www.googletagmanager.com/ Frame 3D4B 0
0 438ms
163ms Document
text/html 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/ns.html?id=GTM-PHX657

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://login.doterra.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-encoding: br
content-length: 92
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1128:0
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
cross-origin-resource-policy: cross-origin
date: Tue, 08 Oct 2024 22:23:46 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1128:0"}],}
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
vary: *
x-xss-protection: 0

GET
H2 200 logo.f55ea8a75ae9d5ed033f652af4f9373d.svg
login.doterra.com/static/media/ 12 KB
0 1ms
1ms Image
image/svg+xml 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.doterra.com/static/media/logo.f55ea8a75ae9d5ed033f652af4f9373d.svg
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: da298619609610ffc1ea0a37f6cb56bb48123da37a8d5fd211463eea72fb1c32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/us/en-us/sign-in

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 1366) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9363, public
content-encoding: gzip
etag: "66d9dd96-302d"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 00:59:48 GMT
content-length: 5308
date: Tue, 08 Oct 2024 22:23:45 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: image/svg+xml

GET
H2 200 logo-mobile.d115f5fd25c873778ce689b7ab074cdb.svg
login.doterra.com/static/media/ 2 KB
1 KB 85ms
84ms Image
image/svg+xml 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.doterra.com/static/media/logo-mobile.d115f5fd25c873778ce689b7ab074cdb.svg
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: ac1dbec7b37a039390412e39114b98ddff8512e132341556e3187b9a62fdafb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/us/en-us/sign-in

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 2573) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9363, public
content-encoding: gzip
etag: "66d9dd96-800"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 00:59:49 GMT
content-length: 1040
date: Tue, 08 Oct 2024 22:23:46 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: image/svg+xml

GET
H2 200 doterra-o.3363fbbd8ff1537e1fe7.png
login.doterra.com/static/media/ 7 KB
7 KB 90ms
88ms Image
image/png 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.doterra.com/static/media/doterra-o.3363fbbd8ff1537e1fe7.png
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 8efa6e17daa65b978482ddba662efa3ce3b60a1af78d9ed1f73ee99044cdcd7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/us/en-us/sign-in

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 2578) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9365, public
etag: "66d9dd96-3d16"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 00:59:51 GMT
content-length: 7433
date: Tue, 08 Oct 2024 22:23:46 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: image/png

GET
H2 200 banner-image-resized.2a731353749dc8d6a838.jpg
login.doterra.com/static/media/ 169 KB
169 KB 111ms
110ms Image
image/jpeg 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.doterra.com/static/media/banner-image-resized.2a731353749dc8d6a838.jpg
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/static/css/main.1586543e.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 8efe54162c55b3f04a13c82315eee84bbd123f3cd4d5aaa74e594b0c7f466eb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/static/css/main.1586543e.css

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 2601) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9415, public
etag: "66d9dd96-2a279"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 01:00:41 GMT
content-length: 172647
date: Tue, 08 Oct 2024 22:23:46 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: image/jpeg

GET
H2 200 checked.d2c121379018bf93dce2.svg
login.doterra.com/static/media/ 856 B
602 B 370ms
370ms Image
image/svg+xml 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.doterra.com/static/media/checked.d2c121379018bf93dce2.svg
Requested by: Host: login.doterra.com
URL: https://login.doterra.com/static/css/main.1586543e.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: f0fd1af7da3c52992df6b4bf3bc4b3cb49bfb00c430bec7f8af6df21b5609b53

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/static/css/main.1586543e.css

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 2860) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9414, public
content-encoding: gzip
etag: "66d9dd96-358"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 01:00:40 GMT
content-length: 464
date: Tue, 08 Oct 2024 22:23:46 GMT
last-modified: Thu, 05 Sep 2024 16:34:30 GMT
content-type: image/svg+xml

GET
H3 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v34/ 47 KB
47 KB 135ms
134ms Font
font/woff2 142.250.64.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:100,200,300,400,600,700,800%7Csans-serif

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.67 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f3.1e100.net

Software

sffe /

Resource Hash

47d477915fa5912616e2dc5df8c5780f9202671678cf275472bd39f3381c0098

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://login.doterra.com
Referer: https://fonts.googleapis.com/

Response headers

age: 23466
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 08 Oct 2025 15:52:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 15:52:40 GMT
last-modified: Wed, 01 May 2024 20:31:48 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48336
x-xss-protection: 0
server: sffe

GET
H3 200 1Ptug8zYS_SKggPNyCMIT5lu.woff2
fonts.gstatic.com/s/raleway/v34/ 30 KB
30 KB 181ms
179ms Font
font/woff2 142.250.64.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyCMIT5lu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:100,200,300,400,600,700,800%7Csans-serif

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.67 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f3.1e100.net

Software

sffe /

Resource Hash

2f0dc96a0b24cc9af003b43bc4f477639fced863f4f967dd2b5e451f621cd09d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://login.doterra.com
Referer: https://fonts.googleapis.com/

Response headers

age: 461014
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 03 Oct 2025 14:20:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 14:20:12 GMT
last-modified: Wed, 01 May 2024 20:31:52 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30860
x-xss-protection: 0
server: sffe

GET
H2 200 Api.aspx Show response
sdk.login.doterra.com/gs/webSdk/ Frame 8041 128 KB
45 KB 137ms
137ms Document
text/html 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.login.doterra.com/gs/webSdk/Api.aspx?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&version=latest&build=16506&serviceName=apiService

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.63.64 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-63-64.ewr53.r.cloudfront.net

Software

Resource Hash

0ac350c46011e4d497c2f967f96a08fa855373f61b7578a6bb58103f0bd4ebf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://login.doterra.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 2480
cache-control: public, s-maxage=3600, max-age=900
content-encoding: gzip
content-length: 45284
content-type: text/html; charset=utf-8
date: Tue, 08 Oct 2024 21:42:26 GMT
edge-cache-tag: siteid_7873911,ver_latest
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 c67ae9899d89f9402837da3a0ead9442.cloudfront.net (CloudFront)
x-amz-cf-id: PtzAAFRRdAfprU_OCvuB8IU4WPiI4a5QmS0cjAR96toxcUmpUAstwg==
x-amz-cf-pop: EWR53-C1
x-cache: Hit from cloudfront
x-callid: c334551d1659495a9afb714fe926f69b
x-error-code: 0
x-robots-tag: none none
x-server: us1d-nomad-t27
x-soa: true, Gator

GET
H2 200 sdk.config.get Show response
sdk.login.doterra.com/ Frame 8041 6 KB
0 0ms
0ms Fetch
text/javascript 13.225.63.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.login.doterra.com/sdk.config.get?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&httpStatusCodes=true&ver=1728426120000
Requested by: Host: sdk.login.doterra.com
URL: https://sdk.login.doterra.com/gs/webSdk/Api.aspx?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&version=latest&build=16506&serviceName=apiService
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-64.ewr53.r.cloudfront.net
Software: /
Resource Hash: 2d007d30cb13a18448b74ed8921b7e282f2724536b365e4c786426e78b1b40dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://sdk.login.doterra.com/gs/webSdk/Api.aspx?apiKey=3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c&version=latest&build=16506&serviceName=apiService

Response headers

x-robots-tag: none, none
content-encoding: gzip
age: 7
x-callid: 899dd54a18d946b9a84e5d991b8f527d
x-cache: Hit from cloudfront
p3p: CP="IDC COR PSA DEV ADM OUR IND ONL"
x-error-code: 0
date: Tue, 08 Oct 2024 22:23:38 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-server: us1d-nomad-t24
x-amz-cf-id: cVpYbopuZ-LGixd35dT_ieMlOd1J7mZeznQb_sGkuYMJikeSxcUPlw==
edge-cache-tag: siteid_7873911
cache-control: public, s-maxage=120, max-age=60
x-soa: true, Gator
via: 1.1 8ab0aef6448b5ee7c8ac1a76da988556.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2185
x-amz-cf-pop: EWR53-C1

GET
H2 200 get
consent.trustarc.com/ Frame 4FA8 0
0 399ms
134ms Document
text/html 18.238.49.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=crossdomain.html&domain=doterra-cm1.com

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.49.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-49-99.jfk52.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://login.doterra.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

age: 2997
cache-control: max-age=2592000
content-encoding: gzip
content-type: text/html
date: Tue, 08 Oct 2024 21:33:50 GMT
pragma: public
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Origin
via: 1.1 a410463cf33c032bf74ee26bf94b81b2.cloudfront.net (CloudFront)
x-amz-cf-id: I-1xMwlJzszQV7nHF4NqAyIDg5HeuakSGXICc1yGvHsvOg389XkeLA==
x-amz-cf-pop: JFK52-P3
x-cache: Hit from cloudfront

GET
H2 200 v1.7-5097 Show response
consent.trustarc.com/asset/notice.js/v/ 94 KB
28 KB 152ms
151ms Script
text/javascript 18.238.49.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/asset/notice.js/v/v1.7-5097

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.49.126 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-49-126.jfk52.r.cloudfront.net

Software

Resource Hash

c1ba2fd7bf6c7864efba7c1724ba93930cbb8484b55bbbe168624d26f603956b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://login.doterra.com
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-expose-headers: *
content-encoding: gzip
pragma: public
age: 1743
via: 1.1 a363b826ba48f4e79f7e95839a3bcf3a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-id: pHt-MASwYnS-DfXnrTC8X0CJdCOL6DN8QSgNnw-QnfVdTsjBUCZGVg==
date: Tue, 08 Oct 2024 21:54:43 GMT
content-type: text/javascript
last-modified: Wed, 25 Sep 2024 03:34:25 GMT
vary: Accept-Encoding
x-amz-cf-pop: JFK52-P3

GET
H2 200 log
consent.trustarc.com/ 43 B
429 B 478ms
211ms Image
image/gif 18.238.49.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/log?domain=doterra-cm1.com&country=us&state=ca&behavior=implied&session=eb721f61-7fed-470b-a203-651c4827e58f&userType=NEW&c=18f1&referer=https://login.doterra.com&language=en

Requested by

Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.49.126 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-49-126.jfk52.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
via: 1.1 6ca3dc9afd6f12cee41f6246e0c4aa8e.cloudfront.net (CloudFront)
expires: Mon, 26 Jul 1997 05:00:00 GMT
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: JxwdaCot2KEJODLZWImg3rT7Z9qs-_npEFByN19erWOYq70WOwEybA==
date: Tue, 08 Oct 2024 22:23:47 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P3
vary: Origin

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 308 KB
104 KB 181ms
180ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XW71K6YFHT&l=dataLayer&cx=c

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8c703c2d7d4247d3989f926a855ac965dc2ef534a49115629663b483d773e8a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 08 Oct 2024 22:23:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 105842
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 get
consent.trustarc.com/ 174 KB
175 KB 136ms
135ms Font
application/octet-stream 18.238.49.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=Raleway-Regular.ttf

Requested by

Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.49.126 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-49-126.jfk52.r.cloudfront.net

Software

Resource Hash

20e4ae409ffbe8bfd2af14d7f717398408ae8b481005beccb83d62ef4052b681

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://login.doterra.com
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-expose-headers: *
pragma: public
age: 3512
via: 1.1 a363b826ba48f4e79f7e95839a3bcf3a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 178520
x-amz-cf-id: CZ81e0v2_7bnyuMmXVIV6G-tbq70WmgWnTJ4PHK5W61Dzj3QBs0zeA==
date: Tue, 08 Oct 2024 21:25:15 GMT
content-type: application/octet-stream
x-amz-cf-pop: JFK52-P3

GET
H2 200 get
consent.trustarc.com/ 175 KB
176 KB 140ms
140ms Font
application/octet-stream 18.238.49.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=Raleway-Bold.ttf

Requested by

Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.49.126 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-49-126.jfk52.r.cloudfront.net

Software

Resource Hash

ca9de8b3be7ccd4b80774a9c7dd56a98c49c276771c5957729b5958d1d579112

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://login.doterra.com
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-expose-headers: *
pragma: public
age: 1160
via: 1.1 a363b826ba48f4e79f7e95839a3bcf3a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 179244
x-amz-cf-id: K-uJaN9-C3g_459C8Kt4R7PbmJowIePkkh9Q7PhiFvaPVAenuf1XCw==
date: Tue, 08 Oct 2024 22:04:27 GMT
content-type: application/octet-stream
x-amz-cf-pop: JFK52-P3

GET
H2 200 bannermsg
consent.trustarc.com/ 43 B
428 B 226ms
225ms Image
image/gif 18.238.49.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/bannermsg?action=views&domain=doterra-cm1.com&behavior=implied&country=us&language=en&rand=0.6260485656780579&session=eb721f61-7fed-470b-a203-651c4827e58f&userType=NEW&referer=https://login.doterra.com

Requested by

Host: login.doterra.com
URL: https://login.doterra.com/us/en-us/sign-in

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.49.126 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-49-126.jfk52.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
via: 1.1 6ca3dc9afd6f12cee41f6246e0c4aa8e.cloudfront.net (CloudFront)
expires: Mon, 26 Jul 1997 05:00:00 GMT
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: d6lZGgv_B1PTXA45Zn-TqFMDFZ1T01PKXUbq7b4nQdW3mcI_82c7FQ==
date: Tue, 08 Oct 2024 22:23:47 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P3
vary: Origin

POST
H2 204 collect Show response
www.google-analytics.com/g/ 0
553 B 426ms
149ms Fetch
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-XW71K6YFHT&gtm=45je4a20h1v886967153z871674160za200zb71674160&_p=1728426226347&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101671035~101747727&cid=2003311722.1728426227&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1728426227&sct=1&seg=0&dl=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&dr=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&dt=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&up.url_language_config=en&tfd=1614
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://login.doterra.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:47 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect Show response
www.google-analytics.com/g/ 0
57 B 426ms
152ms Fetch
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-JP5T5508JH&gtm=45je4a20h1v886967153z871674160za200zb71674160&_p=1728426226347&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101671035~101747727&cid=2003311722.1728426227&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1728426227&sct=1&seg=0&dl=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&dr=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&dt=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&en=page_view&_fv=1&_ss=1&up.url_language_config=en&tfd=1618
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://login.doterra.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:47 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect Show response
www.google-analytics.com/g/ 0
57 B 403ms
151ms Fetch
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-XW71K6YFHT&gtm=45je4a20h1v886967153za200zb71674160&_p=1728426226347&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101671035~101747727&cid=2003311722.1728426227&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1728426227&sct=1&seg=0&dl=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&dr=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&dt=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&en=scroll&epn.percent_scrolled=90&_et=16&tfd=1640
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://login.doterra.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:47 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 adrum-ext.59191791453ae6311081a09b4cf33c2d.js Show response
cdn.appdynamics.com/ 51 KB
0 0ms
0ms Script
text/javascript 18.238.80.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.appdynamics.com/adrum-ext.59191791453ae6311081a09b4cf33c2d.js
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.80.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-80-98.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e490994ad61a64454e06354b4c74756269548b48e8bd476b35762d713ccb8c86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

cache-control: public, max-age=31536000, immutable
content-encoding: br
etag: W/"042a36726299b46397273c05b21dc716"
age: 28955
cross-origin-resource-policy: cross-origin
via: 1.1 d9a3a15f3ae58ded645b708c4a5253c0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: A3ZEmZ9BjG0D0zQQ_yC1Q0fS9sYcnd-UzR2gwUjnDX-Bz8ji2SsFsg==
date: Tue, 08 Oct 2024 14:21:11 GMT
content-type: text/javascript
last-modified: Wed, 21 Jul 2021 17:52:36 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P5
vary: Accept-Encoding, Origin

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 135ms
135ms Script
text/javascript 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: gzip
age: 3731
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Tue, 08 Oct 2024 23:21:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 21:21:36 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 247 KB
87 KB 174ms
174ms Script
application/javascript 142.251.40.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-956873153&l=dataLayer&cx=c

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.232 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

a54d516f80ebb595e8d48f0aafa50d4dbb40a612d20ae48e87d7ffe34a05141a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Tue, 08 Oct 2024 22:23:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Tue, 08 Oct 2024 21:12:35 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89400
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 dtag.js Show response
cdn.attn.tv/doterra/ 7 KB
4 KB 418ms
134ms Script
text/javascript 2600:9000:21da:f800:1c:9484:cec0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.attn.tv/doterra/dtag.js
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:f800:1c:9484:cec0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 500955e5d7667b08ef55cb31f5a7ab9bb1800780eec91c05f4f0fcb326887774

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: gzip
x-amz-version-id: bMKJksVrSOkF5A5iWusqTlPgK7J.Qdtl
etag: W/"080a4c6969969a4dcb5fe63fb588aa1d"
age: 3
x-cache: Hit from cloudfront
x-amz-cf-id: fZnhlkBpLFsorCFOP8x4bNd_S2K-afhqAJpVDpxsupjuh6xkBWB3aQ==
date: Tue, 08 Oct 2024 22:23:46 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
last-modified: Thu, 29 Jun 2023 13:30:40 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=120
via: 1.1 4c18e6ed879a674305cb5156731cf396.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 fs.js Show response
edge.fullstory.com/s/ 285 KB
77 KB 216ms
71ms Script
application/javascript 35.201.112.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3a60a9e636f9f7b116aea8251887de7f924716a6586ed5053bdc790a3b841e34

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://login.doterra.com
Referer: https://login.doterra.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding: br
x-goog-hash: crc32c=9Jlisg==, md5=7TRPlcdWwOU/8HUCX/iHCg==
etag: "ed344f95c756c0e53ff075025ff8870a"
age: 1517
x-goog-stored-content-encoding: br
expires: Tue, 08 Oct 2024 22:58:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 78574
date: Tue, 08 Oct 2024 21:58:31 GMT
last-modified: Mon, 07 Oct 2024 14:23:52 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY2YRqhEdE5FBCxfA_xxhdSS0HTloeolOpSK6J3zpFWkijjwMoXjO1mO8CRkEAnxTQBClhI
cache-control: public, max-age=3600,no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1728311032547229
content-length: 78574
server: UploadServer

GET
H2 200 doterra-favicon.ico
login.doterra.com/ 1 KB
0 0ms
0ms Other
image/x-icon 45.60.12.13
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://login.doterra.com/doterra-favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.12.13 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 337ff04561fbeee6eea3abc63756a5ece81433f5bc7a2cafeaee9b4b83317cd3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/us/en-us/sign-in

Response headers

x-iinfo: 7-94681986-0 0CNN RT(1728426223845 1800) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=9083, public
etag: "66d9dd82-63b"
x-cdn: Imperva
expires: Wed, 09 Oct 2024 00:55:08 GMT
content-length: 1049
date: Tue, 08 Oct 2024 22:23:45 GMT
last-modified: Thu, 05 Sep 2024 16:34:10 GMT
content-type: image/x-icon

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
306 B 153ms
151ms XHR
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=994671312&t=pageview&_s=1&dl=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&ul=en-us&de=UTF-8&dt=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=1086148993&gjid=923105945&cid=2003311722.1728426227&uid=undefined&tid=UA-28403841-1&_gid=836243793.1728426228&_r=1&_slc=1&gtm=45He4a20n71PHX657v71674160za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101671035~101747727&z=433542186

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://login.doterra.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:48 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://login.doterra.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
86 B 152ms
151ms XHR
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=994671312&t=pageview&_s=1&dl=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&ul=en-us&de=UTF-8&dt=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=1530095132&gjid=253556758&cid=2003311722.1728426227&tid=UA-28403841-10&_gid=836243793.1728426228&_r=1&_slc=1&gtm=45He4a20n71PHX657v71674160za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533421~101671035~101747727&z=530275697

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2b875652a31af580982af9055d6c2950ec6f4a753e22fe1d315dc7e56ced6605

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://login.doterra.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:48 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://login.doterra.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 15
server: Golfe2

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 269 KB
94 KB 174ms
173ms Script
application/javascript 142.251.40.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-8T2XPNM14G&cx=c&_slc=1

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.232 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

0c645fbfbe89087b7fa3ec0172e6c97615d35d1f465c116b79cbd77dea7ae0a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Tue, 08 Oct 2024 22:23:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:48 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96636
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 web Show response
edge.fullstory.com/s/settings/98984/v1/ 45 KB
6 KB 71ms
70ms XHR
application/json 35.201.112.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/settings/98984/v1/web
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 80ee6b5775cb971dac2c55ced8f66754c902e368a4a0bcf24f3c10acd68ef46d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding: gzip
x-goog-hash: crc32c=/gJJvQ==, md5=WK83kyqIRM9xK8FGc/DmWg==
etag: "58af37932a8844cf712bc14673f0e65a"
age: 247
x-goog-stored-content-encoding: gzip
expires: Tue, 08 Oct 2024 22:34:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 5575
date: Tue, 08 Oct 2024 22:19:41 GMT
last-modified: Tue, 08 Oct 2024 22:18:30 GMT
content-type: application/json
x-guploader-uploadid: AHmUCY2GEMEKlbbIqFL5zHavAwfuHcbq_7KH1hbQK_Zbv_Q0oRKCQ5k0xM4bkhw1PYYU84ZTLmBvob1D
cache-control: public,max-age=900,no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1728425910144885
content-length: 5575
server: UploadServer

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956873153/ 5 KB
3 KB 453ms
177ms Script
text/javascript 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956873153/?random=1728426228333&cv=11&fst=1728426228333&bg=ffffff&guid=ON&async=1&gtm=45be4a20v9193598179z871674160za201zb71674160&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&ref=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&hn=www.googleadservices.com&frm=0&tiba=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&npa=0&pscdl=noapi&auid=1745064160.1728426228&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f2.1e100.net

Software

cafe /

Resource Hash

38528b0b42e23173b295b9b20b8db9866eb90a35ff7b3a6b8eb868f9fa4c1ecb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 3038
date: Tue, 08 Oct 2024 22:23:48 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 956873153
td.doubleclick.net/td/rul/ Frame FF9F 0
0 441ms
158ms Document
text/html 2607:f8b0:4006:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/956873153?random=1728426228333&cv=11&fst=1728426228333&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a20v9193598179z871674160za201zb71674160&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&ref=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&hn=www.googleadservices.com&frm=0&tiba=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&npa=0&pscdl=noapi&auid=1745064160.1728426228&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login.doterra.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 1190
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 08 Oct 2024 22:23:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 unified-tag.js Show response
cdn.attn.tv/tag/4-latest/ 126 KB
41 KB 155ms
154ms Script
application/javascript 2600:9000:21da:f800:1c:9484:cec0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.attn.tv/tag/4-latest/unified-tag.js?v=4-latest_3bd5bff693
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:f800:1c:9484:cec0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3051f4f97b09f86b16c53685ab529f99e3bd37beb3f06e518eeb095bc9c00bc3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: gzip
x-amz-version-id: imFayRAw_QEu8x1jcwKdX7RTCS..umFQ
etag: W/"ed6eadd4ce84882f92e8018edf10f042"
age: 91
x-cache: Hit from cloudfront
x-amz-cf-id: 4LJLyuu4yLmp3COp2Rd4dvXz9lS4_RrRNMy7IYFbXP5c2DbvM2tt-g==
date: Tue, 08 Oct 2024 22:22:18 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 20 Sep 2024 16:58:51 GMT
x-amz-replication-status: COMPLETED
cache-control: public, max-age=300
via: 1.1 4c18e6ed879a674305cb5156731cf396.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 page Show response
rs.fullstory.com/rec/ 1 KB
772 B 343ms
190ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/page
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4b334101f6ada216c6e89aa146f01c6212a6285fde4f7de350376a7300a04df3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://login.doterra.com/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://login.doterra.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 590
date: Tue, 08 Oct 2024 22:23:48 GMT
content-type: application/json; charset=utf-8

POST
H3 204 collect Show response
www.google-analytics.com/g/ 0
20 B 153ms
152ms Fetch
text/plain 142.250.65.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-8T2XPNM14G&gtm=45je4a20v9131064645za200&_p=1728426226347&gcd=13l3l3l3l2l1&npa=0&dma=0&tag_exp=101671035~101747727&ul=en-us&sr=1600x1200&cid=2003311722.1728426227&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&dt=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&sid=1728426228&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2687
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s73-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://login.doterra.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:48 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 / Show response
doterra.attn.tv/d/ 5 B
234 B 259ms
159ms Fetch
application/json 172.64.144.121
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://doterra.attn.tv/d/?attn_vid=6ec0588cbad749cca07d376cc7b95943
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.144.121 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 4
cf-ray: 8cf98999ff6dcb97-LAX
access-control-allow-origin: *
date: Tue, 08 Oct 2024 22:23:48 GMT
content-type: application/json
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: cloudflare

POST
H3 204 e
events.attentivemobile.com/ 0
240 B 245ms
148ms Ping
text/plain 104.18.39.221
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://events.attentivemobile.com/e?v=4.37.30_adf239c71a&pd=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&u=6ec0588cbad749cca07d376cc7b95943&c=doterra&ceid=mbM&lt=1728426228661&tag=modern&cs=2537040507&t=v&r=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&m=%7B%22source%22%3A%22a%22%7D&cb=1728426228668

Requested by

Host: cdn.attn.tv
URL: https://cdn.attn.tv/tag/4-latest/unified-tag.js?v=4-latest_3bd5bff693

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.221 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
access-control-expose-headers: Set-Cookie, X-Count, X-Token
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
x-content-type-options: nosniff
cf-ray: 8cf98999fcd13157-LAX
date: Tue, 08 Oct 2024 22:23:48 GMT
x-xss-protection: 1; mode=block
server: cloudflare
x-frame-options: DENY

GET
H2 200 mbM.js Show response
cdn.attn.tv/growth-tag-assets/client-configs/ 0
384 B 150ms
149ms Script
text/javascript 2600:9000:21da:f800:1c:9484:cec0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.attn.tv/growth-tag-assets/client-configs/mbM.js
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21da:f800:1c:9484:cec0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-encoding
x-amz-version-id: kGJjc2HxNgGNuk_7UqP1h9o.liqWLb8I
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 53094
via: 1.1 4c18e6ed879a674305cb5156731cf396.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Error from cloudfront
content-length: 0
x-amz-cf-id: Z1N7Z88HGa62EZf4yO6NluX3W_OWSo_O-9l6CCftRw1jAY8woJVQow==
date: Tue, 08 Oct 2024 07:38:55 GMT
content-type: text/javascript
last-modified: Mon, 17 Dec 2018 20:59:49 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C1
vary: Accept-Encoding

GET
H3 200 /
www.google.com/pagead/1p-user-list/956873153/ 42 B
64 B 436ms
161ms Image
image/gif 142.251.41.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956873153/?random=1728426228333&cv=11&fst=1728424800000&bg=ffffff&guid=ON&async=1&gtm=45be4a20v9193598179z871674160za201zb71674160&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&ref=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&hn=www.googleadservices.com&frm=0&tiba=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&npa=0&pscdl=noapi&auid=1745064160.1728426228&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnf0Fk61Bp-jVp-_oKRAUHQ68P-FCzFrA&random=1182241098&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.4 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 08 Oct 2024 22:23:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 unrenderedCreative Show response
doterra.attn.tv/ 0
188 B 357ms
356ms Fetch 172.64.144.121
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://doterra.attn.tv/unrenderedCreative?v=4.37.30&r=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&id=6ec0588cbad749cca07d376cc7b95943&pv=1&l=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&w=1600&h=1200&ss_ref=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&f=2
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.144.121 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://login.doterra.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
x-envoy-upstream-service-time: 11
cf-ray: 8cf9899a68bbcb97-LAX
access-control-allow-origin: *
date: Tue, 08 Oct 2024 22:23:49 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
server: cloudflare

POST
H2 200 bundle Show response
rs.fullstory.com/rec/ 29 B
82 B 221ms
217ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/bundle?OrgId=98984&UserId=5582193405669376&SessionId=5736963623494232689&PageId=4850844683894131835&Seq=1&ClientTime=1728426231272&PageStart=1728426228606&PrevBundleTime=0&LastActivity=2355&IsNewSession=true&ContentEncoding=gzip
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 53bdc893f6c5cd740b7eb997e7b9eb65d89cb631c77840f913588820d1865756

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://login.doterra.com/

Response headers

via: 1.1 google
access-control-allow-origin: https://login.doterra.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
date: Tue, 08 Oct 2024 22:23:51 GMT
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 adrum Show response
pdx-col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-ABZ-ZVB/ 0
795 B 420ms
193ms XHR
text/html 52.37.62.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://pdx-col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-ABZ-ZVB/adrum

Requested by

Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum-ext.59191791453ae6311081a09b4cf33c2d.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.37.62.188 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-37-62-188.us-west-2.compute.amazonaws.com

Software

envoy /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536010; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://login.doterra.com/

Response headers

strict-transport-security: max-age=31536010; includeSubDomains
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
pragma: no-cache
x-envoy-upstream-service-time: 0
x-content-type-options: nosniff
expires: 0
access-control-allow-origin: *
date: Tue, 08 Oct 2024 22:23:51 GMT
content-type: text/html
vary: *
server: envoy
access-control-allow-headers: origin, content-type, accept

POST
H3 204 collect Show response
www.google-analytics.com/g/ 0
20 B 151ms
151ms Fetch
text/plain 142.250.65.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-XW71K6YFHT&gtm=45je4a20h1v886967153z871674160za200zb71674160&_p=1728426226347&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101533422~101671035~101747727&cid=2003311722.1728426227&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=3&sid=1728426227&sct=1&seg=0&dl=https%3A%2F%2Flogin.doterra.com%2Fus%2Fen-us%2Fsign-in&dr=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fcontext%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g%26client_id%3DBhJDeNVWPPH1UqTCQn9y5EJo%26mode%3Dlogin%26scope%3Dopenid%2Bemail%2Bprofile%26gig_skipConsent%3Dtrue&dt=Login%20Page%20%7C%20d%C5%8DTERRA%20Essential%20Oils&en=get_user_data&ep.custom_client_id_event=2003311722.1728426227&_et=7&up.custom_client_id_user=2003311722.1728426227&up.url_language_user=en&tfd=6641
Requested by: Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-21.7.0.3493.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s73-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://login.doterra.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://login.doterra.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 08 Oct 2024 22:23:52 GMT
content-type: text/plain
server: Golfe2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Domain: fonts.gstatic.com
URL: https://fonts.gstatic.com/s/raleway/v34/1Ptug8zYS_SKggPNyC0ITw.woff2

Verdicts & Comments Add Verdict or Comment

55 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

41 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mydoterra.com/	1970-01-21 08:51:45	Name: visid_incap_660953 Value: mLvPmDXtT1mtTTeBbeArTO2wBWcAAAAAQUIPAAAAAADg8/hCcERPHvLbbbvWQNXO
.mydoterra.com/	1969-12-31 23:59:59	Name: incap_ses_1838_660953 Value: tjcfafHhBBHR67KqY+OBGe2wBWcAAAAAWk8B4oL0g08UEBLvgZgikw==
.mydoterra.com/	1970-01-21 00:36:00	Name: cfid Value: 02d86727-1349-4a1a-8ab9-7db3b39ca922
.mydoterra.com/	1970-01-21 00:36:00	Name: cftoken Value: 0
www.mydoterra.com/	1969-12-31 23:59:59	Name: SKIN Value: default
www.mydoterra.com/	1969-12-31 23:59:59	Name: LANGUAGE Value: en_dot
www.mydoterra.com/	1970-01-21 00:07:13	Name: IACTSESSION Value: 1
.mydoterra.com/	1969-12-31 23:59:59	Name: incap_ses_881_660953 Value: tXB3QHcMBSxJ0V61/PA5DO6wBWcAAAAAuDWak8QeRkZm5sg2FtFB2w==
login.doterra.com/	1969-12-31 23:59:59	Name: DOTERRAF5 Value: 2321846026.20480.0000
.doterra.com/	1970-01-21 08:51:50	Name: visid_incap_3053688 Value: fJvEkzrpTDqyjUhU8uUE8e+wBWcAAAAAQUIPAAAAAABCVycy/Aw8+vF6WWNflRdH
.doterra.com/	1969-12-31 23:59:59	Name: nlbi_3053688 Value: NSM/OWFTaXlhl6Qk4h3HOQAAAAC+4zx69cU9EhlpUd7wr1a6
.doterra.com/	1969-12-31 23:59:59	Name: incap_ses_881_3053688 Value: hB0jG3oVXTEo0161/PA5DO+wBWcAAAAAe1d5AYn3m/h49zoLgRPtaw==
.login.doterra.com/	1969-12-31 23:59:59	Name: gig_canary Value: false
.login.doterra.com/	1969-12-31 23:59:59	Name: gig_canary_ver Value: 16460-3-28807065
.doterra.com/	1970-01-21 00:09:59	Name: doterra_login_region Value: us
.doterra.com/	1970-01-21 00:09:59	Name: doterra_login_language Value: en-us
.sdk.login.doterra.com/	1970-01-21 08:52:42	Name: gmid Value: gmid.ver4.AtLtwOShCQ.1wSV04gRZ2_TQGMOr86FGK2TuxUf7rMOZavod_O9tnkqmLnbynrc8AtToK1Unmpy.aYJtktDlfykjG9VysUgfFzC7HjsbMjp3qtE0IKzwcA2H7jgiYsIELYkBAesfP76NJgrUYZtOdvJUs6J1WAxw-w.sc3
.sdk.login.doterra.com/	1970-01-21 08:52:42	Name: ucid Value: 9EWXm_2OuIfEukBcjYz-MA
.sdk.login.doterra.com/	1970-01-21 04:29:11	Name: hasGmid Value: ver4
.login.doterra.com/	1970-01-21 08:52:42	Name: gig_bootstrap_3_IeTHYO5iQqBz2VEw0sOh3dqMQj2cR1DamqynMcICUyquuiM8-63c7onnMkZyja7c Value: sdk_ver4
.doterra.com/	1969-12-31 23:59:59	Name: ADRUM Value: s=1728426226006&r=https%3A%2F%2Flogin.doterra.com%2Fop-proxy%3Fhash%3D2015885520
.login.doterra.com/	1970-01-21 00:07:08	Name: TAsessionID Value: eb721f61-7fed-470b-a203-651c4827e58f\|NEW
.login.doterra.com/	1969-12-31 23:59:59	Name: notice_behavior Value: implied,us
.doterra.com/	1970-01-21 09:43:06	Name: _ga_JP5T5508JH Value: GS1.1.1728426227.1.0.1728426227.0.0.0
.doterra.com/	1970-01-21 09:43:06	Name: _ga_XW71K6YFHT Value: GS1.1.1728426227.1.0.1728426227.0.0.0
.doterra.com/	1970-01-21 02:16:42	Name: _gcl_au Value: 1.1.1745064160.1728426228
.doterra.com/	1970-01-21 09:43:06	Name: _ga Value: GA1.2.2003311722.1728426227
.doterra.com/	1970-01-21 00:08:32	Name: _gid Value: GA1.2.836243793.1728426228
.doterra.com/	1970-01-21 00:07:06	Name: _gat_UA-28403841-1 Value: 1
.login.doterra.com/	1970-01-21 09:43:06	Name: _ga Value: GA1.3.2003311722.1728426227
.login.doterra.com/	1970-01-21 00:08:32	Name: _gid Value: GA1.3.836243793.1728426228
.login.doterra.com/	1970-01-21 00:07:06	Name: _gat_UA-28403841-10 Value: 1
.login.doterra.com/	1970-01-21 09:43:06	Name: _ga_8T2XPNM14G Value: GS1.3.1728426228.1.0.1728426228.0.0.0
login.doterra.com/	1970-01-21 09:43:06	Name: __attentive_id Value: 6ec0588cbad749cca07d376cc7b95943
login.doterra.com/	1970-01-21 09:43:06	Name: _attn_ Value: eyJ1Ijoie1wiY29cIjoxNzI4NDI2MjI4NjY0LFwidW9cIjoxNzI4NDI2MjI4NjY0LFwibWFcIjoyMTkwMCxcImluXCI6ZmFsc2UsXCJ2YWxcIjpcIjZlYzA1ODhjYmFkNzQ5Y2NhMDdkMzc2Y2M3Yjk1OTQzXCJ9In0=
login.doterra.com/	1970-01-21 09:43:06	Name: __attentive_cco Value: 1728426228665
.doterra.com/	1970-01-21 08:52:42	Name: fs_uid Value: #98984#5582193405669376:5736963623494232689:::#/1759962229
.doubleclick.net/	1970-01-21 00:07:07	Name: test_cookie Value: CheckForPermission
login.doterra.com/	1970-01-21 00:07:08	Name: __attentive_pv Value: 1
login.doterra.com/	1970-01-21 00:07:08	Name: __attentive_ss_referrer Value: https://login.doterra.com/op-proxy?context=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik1FSkdRVFUyUVVVd1FVWTVNamN6TWtWRE5rVkJPREpCUXpnMU1UWkVPVVpGTkRnNVJrUXdRUSJ9.eyJpc3MiOiJodHRwczovL2xvZ2luLmRvdGVycmEuY29tLyIsImN0eF9kYyI6InVzMSIsImlhdCI6MTcyODQyNjIyMywiZXhwIjoxNzI4NDI2ODIzLCJjbGllbnRfaWQiOiJCaEpEZU5WV1BQSDFVcVRDUW45eTVFSm8iLCJjdHhfaWQiOiJmN2VjNjI1MTdhMjM0ZmVkYmVmYmI0ZjJlMDk2YjdjYSIsInJlZGlyZWN0X3VybCI6Imh0dHBzOi8vd3d3Lm15ZG90ZXJyYS5jb20vY2FsbGJhY2sifQ.feEyi7XlGdwRnljTSedqJfFrxpAUgvyUOQMQEIAp5KvuzEN--zYPZQLqv3U0GqEjZlApko9mgKxgzZ7kebazsrdRxrcRHaKmiIgrt1wqbcObO723csTBwPfC29MyQk8Vg3jqhYq9a4bvcWHVpeSIRaVlggrwOF5yrdOJZF_bMf98RsfeJee4zYAmoERtJ4Opf3eTU9Xdk1rpXexabp4AFUq2VeGwUZQN2Vada6L1zePsW_L6jTVDnIM803hxTEX-CZCsQwDJpdV5e9s9GRtg3S_zKXAywK_qd_7Cy_rxvAdxP31VLXVxgERJT1-Wst4q8hknZa0lta5d5iza1XXi1g&client_id=BhJDeNVWPPH1UqTCQn9y5EJo&mode=login&scope=openid+email+profile&gig_skipConsent=true
login.doterra.com/	1970-01-21 00:08:32	Name: __attentive_dv Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://shop.doterra.com;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.appdynamics.com
cdn.attn.tv
consent.trustarc.com
doterra.attn.tv
edge.fullstory.com
events.attentivemobile.com
fidm.us1.gigya.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
login.doterra.com
mydoterra.com
pdx-col.eum-appdynamics.com
rs.fullstory.com
sdk.login.doterra.com
td.doubleclick.net
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.mydoterra.com
fonts.gstatic.com
www.google-analytics.com
104.18.39.221
107.23.218.60
13.225.63.64
142.250.64.67
142.250.65.238
142.251.40.194
142.251.40.232
142.251.41.4
172.64.144.121
18.238.49.126
18.238.49.99
18.238.80.98
2600:9000:21da:f800:1c:9484:cec0:93a1
2607:f8b0:4006:809::200e
2607:f8b0:4006:80a::2002
2607:f8b0:4006:80e::200a
2607:f8b0:4006:821::2008
35.186.194.58
35.201.112.186
45.60.102.13
45.60.12.13
52.37.62.188
062435b9bd1bb28c40b555179127d69010ca2ae9531b67572014de0b891804ee
0ac350c46011e4d497c2f967f96a08fa855373f61b7578a6bb58103f0bd4ebf5
0c645fbfbe89087b7fa3ec0172e6c97615d35d1f465c116b79cbd77dea7ae0a2
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
20e4ae409ffbe8bfd2af14d7f717398408ae8b481005beccb83d62ef4052b681
253aaa50ee84499c60fc07ab465a33fdb4f65642ee8db50fc1a03d7fe3665b40
2b875652a31af580982af9055d6c2950ec6f4a753e22fe1d315dc7e56ced6605
2d007d30cb13a18448b74ed8921b7e282f2724536b365e4c786426e78b1b40dd
2f0dc96a0b24cc9af003b43bc4f477639fced863f4f967dd2b5e451f621cd09d
3051f4f97b09f86b16c53685ab529f99e3bd37beb3f06e518eeb095bc9c00bc3
337ff04561fbeee6eea3abc63756a5ece81433f5bc7a2cafeaee9b4b83317cd3
38528b0b42e23173b295b9b20b8db9866eb90a35ff7b3a6b8eb868f9fa4c1ecb
3a60a9e636f9f7b116aea8251887de7f924716a6586ed5053bdc790a3b841e34
3a861f1306cc08ddaca7b1accf93d58b2136bddd4ed1cc636e7097f143c9e205
47d477915fa5912616e2dc5df8c5780f9202671678cf275472bd39f3381c0098
4b334101f6ada216c6e89aa146f01c6212a6285fde4f7de350376a7300a04df3
500955e5d7667b08ef55cb31f5a7ab9bb1800780eec91c05f4f0fcb326887774
53bdc893f6c5cd740b7eb997e7b9eb65d89cb631c77840f913588820d1865756
68af8f65b938909de97f3993d0aa2175ad962fd6566f6389c2d26bfc9b6c5f13
69320926483ccbad45b2501781e640e883053216af234b5a553efc33a2b54b07
802fe463fb2c5049f755d600c2add791806ba93cf67009d1f621119887e411d7
80ee6b5775cb971dac2c55ced8f66754c902e368a4a0bcf24f3c10acd68ef46d
828cf45e2ed8c73f23cbd12405750cb15f6891535bb29c31942b459c051595ab
8ad377325b8d131178555818d9f3fb7e2e4af080002e818bfdd3924f6a36038f
8c703c2d7d4247d3989f926a855ac965dc2ef534a49115629663b483d773e8a5
8efa6e17daa65b978482ddba662efa3ce3b60a1af78d9ed1f73ee99044cdcd7a
8efe54162c55b3f04a13c82315eee84bbd123f3cd4d5aaa74e594b0c7f466eb3
94399e2601265869a5143ac40c14105ee47217965bb8b49f3dca19060091e273
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
a54d516f80ebb595e8d48f0aafa50d4dbb40a612d20ae48e87d7ffe34a05141a
ac1dbec7b37a039390412e39114b98ddff8512e132341556e3187b9a62fdafb1
ad5e6d66d14c32408e3f8460ce5c0194c15f286ef26eee8402c0e25563405b08
c1ba2fd7bf6c7864efba7c1724ba93930cbb8484b55bbbe168624d26f603956b
c67fea1feac376dcf2db6c7f6d4bfd87539d72dd07f9a389fc3a351cf434c61e
ca9de8b3be7ccd4b80774a9c7dd56a98c49c276771c5957729b5958d1d579112
d3daf5722820a70497b1e0f7ba7d5f8a25cd0b888e9e0ba67696a69259fdcab1
da298619609610ffc1ea0a37f6cb56bb48123da37a8d5fd211463eea72fb1c32
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e490994ad61a64454e06354b4c74756269548b48e8bd476b35762d713ccb8c86
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0fd1af7da3c52992df6b4bf3bc4b3cb49bfb00c430bec7f8af6df21b5609b53
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

login.doterra.com Open in urlscan Pro 45.60.12.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

73 Requests

97 %HTTPS

23 %IPv6

15 Domains

20 Subdomains

21 IPs

2 Countries

2638 kBTransfer

11618 kBSize

41 Cookies

6 Outgoing links

Page URL History

Redirected requests

73 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

login.doterra.com Open in urlscan Pro
45.60.12.13 Public Scan

Screenshot
Live screenshot

Full Image

73
Requests

97 %
HTTPS

23 %
IPv6

15
Domains

20
Subdomains

21
IPs

2
Countries

2638 kB
Transfer

11618 kB
Size

41
Cookies

73 HTTP transactions
0 data transactions