urlscan.io logo urlscan.io
SecurityTrails logo

citizenstomach.com Open in urlscan Pro
2606:4700:3037::6815:1f8d  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://s3-us-west-2.amazonaws.com/jniyuhtrfzscdfvbg/M6.html#qs=r-adgjgafbhhhgfcbafedcbikajgkdgbbafecekabafecekabaggadgcaccackceadc...
Effective URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Submission: On May 05 via manual from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 3 countries across 13 domains to perform 40 HTTP transactions. The main IP is 2606:4700:3037::6815:1f8d, located in United States and belongs to CLOUDFLARENET, US. The main domain is citizenstomach.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 4th 2022. Valid for: a year.
This is the only time citizenstomach.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Customer Survey Spam (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 52.218.133.120 16509 (AMAZON-02)
1 1 162.210.173.133 46841 (FORKNETWO...)
1 23.95.56.6 36352 (AS-COLOCR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
17 2606:4700:303... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
5 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a03:2880:f01... 32934 (FACEBOOK)
2 13.225.64.251 16509 (AMAZON-02)
2 104.19.135.78 13335 (CLOUDFLAR...)
1 7 35.186.226.184 15169 (GOOGLE)
2 2 107.178.246.49 15169 (GOOGLE)
3 2a03:2880:f11... 32934 (FACEBOOK)
40 10
1    52.218.133.120 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2.amazonaws.com
s3-us-west-2.amazonaws.com
1    162.210.173.133 (United States)

ASN46841 (FORKNETWORKING, US)
PTR: bankaudi.net
bankaudi.net
1    23.95.56.6 (United States)

ASN36352 (AS-COLOCROSSING, US)
PTR: 23-95-56-6-host.colocrossing.com
zappirmoons.com
1    2606:4700:3033::6815:259 (United States)

ASN13335 (CLOUDFLARENET, US)
vermailtrumpet.com
17    2606:4700:3037::6815:1f8d (United States)

ASN13335 (CLOUDFLARENET, US)
citizenstomach.com
1    2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
5    2606:4700:3034::6815:22dd (United States)

ASN13335 (CLOUDFLARENET, US)
trk-tempore.com
event.trk-tempore.com
2    2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    13.225.64.251 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-64-251.ewr53.r.cloudfront.net
sc-static.net
2    104.19.135.78 (None, )

ASN13335 (CLOUDFLARENET, US)
a.mgid.com
7    35.186.226.184 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 184.226.186.35.bc.googleusercontent.com
tr.snapchat.com
2    107.178.246.49 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 49.246.178.107.bc.googleusercontent.com
pixel.tapad.com
3    2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)
www.facebook.com
Apex Domain
Subdomains		 Transfer
17 citizenstomach.com
citizenstomach.com
574 KB
7 snapchat.com
tr.snapchat.com — Cisco Umbrella Rank: 973
2 KB
5 trk-tempore.com
trk-tempore.com — Cisco Umbrella Rank: 71285
event.trk-tempore.com — Cisco Umbrella Rank: 197713
3 KB
3 facebook.com
www.facebook.com — Cisco Umbrella Rank: 100
714 B
2 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 658
556 B
2 mgid.com
a.mgid.com — Cisco Umbrella Rank: 18066
6 KB
2 sc-static.net
sc-static.net — Cisco Umbrella Rank: 1364
15 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 195
113 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 936
30 KB
1 vermailtrumpet.com
vermailtrumpet.com
789 B
1 zappirmoons.com
zappirmoons.com — Cisco Umbrella Rank: 518590
466 B
1 bankaudi.net
bankaudi.net
419 B
1 amazonaws.com
s3-us-west-2.amazonaws.com
453 B
40 13
Domain Requested by
17 citizenstomach.com zappirmoons.com
citizenstomach.com
7 tr.snapchat.com 1 redirects sc-static.net
citizenstomach.com
4 event.trk-tempore.com trk-tempore.com
3 www.facebook.com citizenstomach.com
2 pixel.tapad.com 2 redirects
2 a.mgid.com citizenstomach.com
2 sc-static.net citizenstomach.com
tr.snapchat.com
2 connect.facebook.net citizenstomach.com
connect.facebook.net
1 trk-tempore.com citizenstomach.com
1 code.jquery.com citizenstomach.com
1 vermailtrumpet.com 1 redirects
1 zappirmoons.com s3-us-west-2.amazonaws.com
1 bankaudi.net 1 redirects
1 s3-us-west-2.amazonaws.com
40 14

This site contains no links.

Subject Issuer Validity Valid
*.s3-us-west-2.amazonaws.com
Amazon		 2021-12-17 -
2022-11-29		 a year crt.sh
zappirmoons.com
R3		 2022-04-13 -
2022-07-12		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-04 -
2023-05-03		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-02-11 -
2022-05-12		 3 months crt.sh
sc-static.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-01-27 -
2023-01-27		 a year crt.sh
tr.snapchat.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-01-13 -
2023-01-13		 a year crt.sh

This page contains 5 frames:

Primary Page: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Frame ID: 8D6FCEE280CA4FBBEB118716FE704E05
Requests: 33 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=cc25c7df-1e44-4f51-8ff1-8c175d6334c1
Frame ID: EF5B0CE4278B66FB22EEF48E5D688F8F
Requests: 2 HTTP requests in this frame

Frame: https://tr.snapchat.com/p
Frame ID: FF292438EC8660B74001E1FB250B7FE7
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/p
Frame ID: AC3A2BF273466F49417650F7825E510E
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/p?rand=1651710226960&pnid=140&pcid=d9477fd9-1236-4ce7-b6ba-496076c4a81f
Frame ID: 9E29D2B0468B7A484F097FB507B950B4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

McAfee

Page URL History Show full URLs

  1. https://s3-us-west-2.amazonaws.com/jniyuhtrfzscdfvbg/M6.html Page URL
  2. http://bankaudi.net/qs=r-adgjgafbhhhgfcbafedcbikajgkdgbbafecekabafecekabaggadgcaccackceadcfhakfe... HTTP 302
    https://zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_431... Page URL
  3. https://vermailtrumpet.com/?id=91&s1=350015&s2=713111998&s3=4050&s4=1969&s5=43139_8592500_11&p=us7antiv... HTTP 302
    https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

40
Requests

100 %
HTTPS

46 %
IPv6

13
Domains

14
Subdomains

10
IPs

3
Countries

745 kB
Transfer

1130 kB
Size

16
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://s3-us-west-2.amazonaws.com/jniyuhtrfzscdfvbg/M6.html Page URL
  2. http://bankaudi.net/qs=r-adgjgafbhhhgfcbafedcbikajgkdgbbafecekabafecekabaggadgcaccackceadcfhakfekcacb HTTP 302
    https://zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_43139_0_4321079_55_2146_94391_8592500_10_1913/55 Page URL
  3. https://vermailtrumpet.com/?id=91&s1=350015&s2=713111998&s3=4050&s4=1969&s5=43139_8592500_11&p=us7antivrs9h HTTP 302
    https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://bankaudi.net/qs=r-adgjgafbhhhgfcbafedcbikajgkdgbbafecekabafecekabaggadgcaccackceadcfhakfekcacb HTTP 302
  • https://zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_43139_0_4321079_55_2146_94391_8592500_10_1913/55
Request Chain 31
  • https://tr.snapchat.com/cm/s?bt=__LIVE__&pnid=140&cb=1651714081498 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1651710226960%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1651710226960%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
  • https://tr.snapchat.com/cm/p?rand=1651710226960&pnid=140&pcid=d9477fd9-1236-4ce7-b6ba-496076c4a81f

40 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
M6.html
s3-us-west-2.amazonaws.com/jniyuhtrfzscdfvbg/ 		98 B
453 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s3-us-west-2.amazonaws.com/jniyuhtrfzscdfvbg/M6.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.218.133.120 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2.amazonaws.com
Software
AmazonS3 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Accept-Ranges
bytes
Content-Length
98
Content-Type
text/html
Date
Thu, 05 May 2022 01:28:00 GMT
ETag
"d0a9fe7ab7c3cf844ed98dcc0ff94e64"
Last-Modified
Wed, 04 May 2022 23:56:22 GMT
Server
AmazonS3
x-amz-id-2
fhF9oq6E3fTSoKuGVxuNesFVq6LgX5mKOt60y7gKsyfQZyV4Qzj3EE2F0VgOzjr3/oZJ8kaKflg=
x-amz-request-id
FQ07KKWESKM283K2
55
zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_43139_0_4321079_55_2146_94391_8592500_10_1913/
Redirect Chain
  • http://bankaudi.net/qs=r-adgjgafbhhhgfcbafedcbikajgkdgbbafecekabafecekabaggadgcaccackceadcfhakfekcacb
  • https://zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_43139_0_4321079_55_2146_94391_8592500_10_1913/55
170 B
466 B 		Document
General
Check archive.org
Download Go to
Full URL
https://zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_43139_0_4321079_55_2146_94391_8592500_10_1913/55
Requested by
Host: s3-us-west-2.amazonaws.com
URL: https://s3-us-west-2.amazonaws.com/jniyuhtrfzscdfvbg/M6.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.95.56.6 , United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
23-95-56-6-host.colocrossing.com
Software
Apache /
Resource Hash

Request headers

Referer
https://s3-us-west-2.amazonaws.com/jniyuhtrfzscdfvbg/M6.html#qs=r-adgjgafbhhhgfcbafedcbikajgkdgbbafecekabafecekabaggadgcaccackceadcfhakfekcacb
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

content-length
170
content-type
text/html; charset=UTF-8
date
Thu, 05 May 2022 01:28:00 GMT
server
Apache

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Thu, 05 May 2022 01:27:59 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By
PHP/5.4.16
location
https://zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_43139_0_4321079_55_2146_94391_8592500_10_1913/55
Primary Request /
citizenstomach.com/
Redirect Chain
  • https://vermailtrumpet.com/?id=91&s1=350015&s2=713111998&s3=4050&s4=1969&s5=43139_8592500_11&p=us7antivrs9h
  • https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Requested by
Host: zappirmoons.com
URL: https://zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_43139_0_4321079_55_2146_94391_8592500_10_1913/55
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0e56c977895c222a299714f8dd0f0e56dd6b861db6fa7e4725d0281c5bb01d4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://zappirmoons.com/0/0/0/7fe37f661362c1dc0b90521d286f6e0a/43139_8592500_11/2585_406665410_0_43139_0_4321079_55_2146_94391_8592500_10_1913/55
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7065b26d3a996dd3-MIA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 05 May 2022 01:28:00 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NqffDTHfQzPR265pPyfJx%2FB4uX554pMKg%2B3UhLdHmiOcsh8Ghiq3tWZb0hSO9LugrOBtEtd189vA33bIEgDUYUacNcV%2BO1x7aZ6avwbu%2F2soXblQDKH%2Fvhvg6hT5Oix0Tf6KRDPy4UWvpghmyVOdUvA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-turbo-charged-by
LiteSpeed
x-xss-protection
1; mode=block

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-cache-status
DYNAMIC
cf-ray
7065b26c3e9b129b-MIA
content-type
text/html; charset=UTF-8
date
Thu, 05 May 2022 01:28:00 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5DHo0%2BzLl9KTtWGrrbVAmQaz5FxIAaRnvdEZ9bZftt80zvM%2FI3lI20s85GhoJTePQg%2FZQ74jRu%2FBYBKI4ap%2FQh1VRT1jbAcptlqgNcXehUQrNXepzIfBfkEkaZUfkHZqIartZPypHHj0So5m23jTzuw%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-turbo-charged-by
LiteSpeed
x-xss-protection
1; mode=block
style.css
citizenstomach.com/master/us54/css/ 		8 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citizenstomach.com/master/us54/css/style.css?v1.10
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
862eaa13edcf4d4763065b78d4e585f3964d77e5f4ae24e655e2f4a4d8e3d535
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
19485
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 09 Dec 2021 21:12:35 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DWrJs%2FCFSjAypo4YB8F9yvu%2FYbgj880Lb5UBAKNLG5fjzDCchZJmbVqWB5uz349F6yaeAcoWMKzGxbaX1MqZkW17smJgAg0%2FyXmv1h5LzK%2BUuEk8GRyOpy%2BWwm37j8b8FBvgfCwuxROGpaKrzroDR5k%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
vary
Accept-Encoding,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
7065b26dcb816dd3-MIA
expires
Wed, 11 May 2022 20:03:15 GMT
fonts.css
citizenstomach.com/master/us54/fonts/ 		700 B
493 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citizenstomach.com/master/us54/fonts/fonts.css
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d65693a0508e7369cfe393c568264829e59aacdea9915c0fbca29396da7e29c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
19485
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 22:47:56 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vh%2BOV2d6zLEVqD5KK1bIXyCsPtvicnmkzuyh3G5NksiqvOuHfUdOTfgT%2FocEHWoWb79wVOho3Kl%2FEvM2eO1i3jGU7y84P6SNvzjnDDJ37umpEHVUBad%2ButZEXWvQn31a%2FfVXIZveJf1eYp4%2BJCEcjOo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
vary
Accept-Encoding,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
7065b26dcb836dd3-MIA
expires
Wed, 11 May 2022 20:03:15 GMT
msg.js
citizenstomach.com/inc/ 		941 B
772 B 		Script
General
Check archive.org
Download Go to
Full URL
https://citizenstomach.com/inc/msg.js
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfb6708f8e8d5277007f904e261d1e4c7dc1c9240b04bbaccf4ddf472b3cc95a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
19651
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 10 Feb 2022 13:35:10 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=manUCjU0QEarP4oV%2FgS8x3n64QoeX1OvRwOGx2cRnO9uZyQ7CFa88l%2BSAfCFshQ1XsZlQ1rDX5uGnVD5N%2BaQ96rA73GjQzavZCi0GIs6i4JVBy1mRz70BJobwAcKQ7KBcT9wtahLokwO4huIX9n56qQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
7065b26dcb866dd3-MIA
expires
Wed, 11 May 2022 20:00:29 GMT
fbcode1.js
citizenstomach.com/inc/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citizenstomach.com/inc/fbcode1.js
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43fccd349655df7497727c1c95d4fd97033f8aaf649067cbafb2b6d2751cf340
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
19651
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Wed, 07 Oct 2020 23:35:40 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=katm7YPekHqOQL5VG0bBRgnhbjc7te3gL7jpowMJivemO9Q42kNo25M37vqDa86WLQYITMlsjLkcQ8cG0X9v%2Fu0Bb1aCZrM6AKyARG39zhPPm%2F3CmVzTyHst7tUuIMXLiz7iXxmEw9I5dWRsgfdi%2FqQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
7065b26dcb876dd3-MIA
expires
Wed, 11 May 2022 20:00:29 GMT
logow.png
citizenstomach.com/master/us54/images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/logow.png
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e361f2ca65ed3595ad06c921afa3e61bf2c941b24dfe6937cdbb13321a8e20c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
15983
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5191
x-xss-protection
1; mode=block
last-modified
Mon, 22 Nov 2021 22:38:07 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L6zVYp0bO9XWl5O8VuG3qFCzL8hNL9UPchHfaBMmnHsUqvHmTrTnZZkemDQ6UF6qwunO6cMV22hKme63npl5%2F3N50FtMfY0f4gEw7Nprfcxn98KiTyZvQCB8AJJ3JuIG7w43%2Bkj4WK94oDUItuxJ1C8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2db18dfd-MIA
expires
Wed, 11 May 2022 21:01:37 GMT
strp-ic.png
citizenstomach.com/master/us54/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/strp-ic.png
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c78544e8ff1e531f921b487e67fb29d0a86d85a77aa9d3419b453146a340b7d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
15983
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1771
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 13:21:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9BoHm%2BfruywTzutYuq4hUVGoa4xcsEY%2F62ZEVunP%2FcmmGiiLBRpwKxqc48go05st82%2BLxb89p34QntvCPy1XJp5prpP%2Fe3vnsTrpF3w%2B3UenW57xubZpwv0ZjfHN9XMdF%2BbB%2FKe4h%2FkP8eXU9nqShOg%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2db38dfd-MIA
expires
Wed, 11 May 2022 21:01:37 GMT
product.png
citizenstomach.com/master/us54/images/ 		110 KB
111 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/product.png
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9b70f59936d0dcd908fc0ad01051fee3ba007f5ded94489b5fde93c1649c88c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
15983
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
112633
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 13:38:32 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SjOuPyGdzag4BwQ%2FwvovSebG6VvmbqLIn5BMvyz7PfxxXqJn%2Bre%2BEmdGXFOtJvCOc%2F7HTXt0A2%2FnOXB7bdpP6QuMJIpvNnKnC2kgwHc9vG%2Ff%2BElb1KeNN0TFSwPV6Qb3VLNK5BbWSjhPat%2BOs%2FMMnVc%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2db48dfd-MIA
expires
Wed, 11 May 2022 21:01:37 GMT
bnr-strp-ic.png
citizenstomach.com/master/us54/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/bnr-strp-ic.png
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1216acea3bd6a3146e94270b0857bd97dc67fa05ed8922a92b8ee6f03704d58
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
15983
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1903
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 13:32:04 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N4w4U2i0xO7ohcuz1pGa4cJxFnEaYHChyTo1%2BQoFFNn8bBF8psMNeYsy7nkv1aDCJRQqs8znV76JQvXWqI4Oc6%2FuFtLV5TDLUcTHR0gO55WQBWwfyoklCWKnLMVm61uZMgyQt%2FcQ5dOC7Wx4NM8VaiU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2db58dfd-MIA
expires
Wed, 11 May 2022 21:01:37 GMT
btn-ico.png
citizenstomach.com/master/us54/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/btn-ico.png
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
662edca6a1dd7f2c68d994b2b1f80b6f93df4b94f2cd14fe5174a7a94c550a68
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
15983
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1395
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 13:39:42 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G%2Bs4PHnF55BAi682log5Gi8U8ztHnXQjaTXOmX%2BSAvIanSRHAKlSXrZJvC%2B04pK3sl7TDzLI3uuAEWCwQSqiSA2tPed54tuE%2BmOWN4CKfEYPr3cheqJZxTYze57tzpHXuWb%2BnHm3JSgbU7r7fCNvIIk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2db68dfd-MIA
expires
Wed, 11 May 2022 21:01:37 GMT
x.png
citizenstomach.com/master/us54/images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/x.png
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
15982
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5389
x-xss-protection
1; mode=block
last-modified
Wed, 11 Aug 2021 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=edXbAXETH1%2BOxPKvaS9AAE3y88KdbUzpFmnfTlosXUekqVb0D2mIXBA8Lrj%2B%2BoADftLWwV%2BfMbRs2Hz89NGq1mqnRXGhxFmrQFxYmIjDKjqzLl0pnrGkm%2F21J2bWhzfRrOfEu6ADuc0Foqjhl%2FflOeU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2db78dfd-MIA
expires
Wed, 11 May 2022 21:01:38 GMT
jquery-3.5.1.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-15d84"
vary
Accept-Encoding
x-hw
1651714081.dop050.mi1.t,1651714081.cds228.mi1.hn,1651714081.cds210.mi1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30879
v9e118mez8
trk-tempore.com/scripts/push/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-tempore.com/scripts/push/v9e118mez8
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/inc/msg.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:22dd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa4b74cc94b96ff49ac4462f2a335fcaf85777e2a8857b805d08da763d8647ff
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yh6OWYy%2BJCIS%2F%2FN3j3ap%2B10HZPnMnBr57%2FTxoN31BEFQbaYeGUlwB2g9SmCGXUNes5iD7HRgNghxSbhgCkYah8LYWf45BDCFWTuWztdiwuh%2BGYJkpShLlaYesCzf4tU7qkY%2FhBeZdibEjSs9wkI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript;charset=UTF-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
cf-ray
7065b26ebf319ac9-MIA
expires
0
fbevents.js
connect.facebook.net/en_US/ 		99 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/inc/fbcode1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b819b3ac2fe5857b7026a609f9115f0d50a7d6e8085ba5987d70ed6baaa41f4e
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26311
x-xss-protection
0
pragma
public
x-fb-debug
Cn1/ovDaro09nlLP5dtB3ckRU/PydPQ2hEdsFelkNbuSv80+dm7eSRybNDbUn5qO3tK0fdqvV8BTtpP/JEkM3w==
x-fb-trip-id
1512268381
x-frame-options
DENY
date
Thu, 05 May 2022 01:28:01 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
scevent.min.js
sc-static.net/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sc-static.net/scevent.min.js
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/inc/fbcode1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.64.251 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-64-251.ewr53.r.cloudfront.net
Software
CloudFront /
Resource Hash
cc308e76a07a70ae096c8c443bbf04154969ef4f52a4c632fc69ef233b8b5fa1

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
content-encoding
gzip
server
CloudFront
x-amz-cf-pop
EWR53-C1
x-cache
LambdaGeneratedResponse from cloudfront
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
private, s-maxage=0, max-age=600
access-control-allow-headers
Content-Type
content-length
7163
via
1.1 5ec6b37107376867228d2ed46a794602.cloudfront.net (CloudFront)
x-amz-cf-id
FZFyN_u2BvEdLno_-5_iA0zFIx2nI61OJqD3UbqOV1oIN4Jy-6EXkQ==
mgsensor.js
a.mgid.com/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.mgid.com/mgsensor.js?d=1651714080960
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/inc/fbcode1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8098c6938d10947bf06e59e59b684daf1ef70c1e520bd7e6d4d85e28ee94f00

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
content-encoding
br
cf-cache-status
DYNAMIC
x-mg-request-uuid
a7c8043b-3872-4d7d-9104-565861ff70e5
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
7065b26ebda721e7-MIA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
strp-bg.jpg
citizenstomach.com/master/us54/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/strp-bg.jpg
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/master/us54/css/style.css?v1.10
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6fd375cb3ecb3e1930a53542fc4c1253d18b77d1f97d784a6d8ecf735d500c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/master/us54/css/style.css?v1.10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
15983
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2535
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 13:16:36 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UQNxzhbcdPw3SI282rCa%2FQtjWzyt%2FpcLBEOQxE3wCSuW0MaAIg12R9Af6LHmXEsj2RVJtbFWEiqb9wOw39ZddR%2FUmCCqTUePi6X7uHYMhajxNlNp2HsOE7Lq%2BcxOoQ8ktioDWbauf9JFnuCF6MbOcX4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2dbf8dfd-MIA
expires
Wed, 11 May 2022 21:01:37 GMT
bnr-bg.jpg
citizenstomach.com/master/us54/images/ 		225 KB
225 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/bnr-bg.jpg
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/master/us54/css/style.css?v1.10
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4fb645aee8606db59c84e228115420b8a7fb7d6b44bdd34963609145eaceb71
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/master/us54/css/style.css?v1.10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
14636
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
229996
x-xss-protection
1; mode=block
last-modified
Fri, 25 Sep 2020 11:23:38 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lzBbSsc4JzQArDV3iLWIY8Xctv3xLm1LKZKv9U0hdYdm4KUb4vGg4IRrs5xmDWXfUDN3G5E0UstLTG2LWSfLfl1iealJJv9s3lby5htMpehu5%2Blk8hOmoXQZWz9xIq17V9VpZwtRPkip%2FeQCZhLI6JU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2dc08dfd-MIA
expires
Wed, 11 May 2022 21:24:04 GMT
off-bg.png
citizenstomach.com/master/us54/images/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citizenstomach.com/master/us54/images/off-bg.png
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/master/us54/css/style.css?v1.10
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f58546497e0a9e6a4926b54b3ac5219a39ec48ebe6b821c1bc6f5a38e9f0c1f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/master/us54/css/style.css?v1.10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
15983
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5770
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 13:39:14 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TQeUHID5YU3vE5wjL2fv2N8hnKB75zvA1CTJfFy6YOjIafnvU3Rk5JRgcA1Nm%2FxLpHZjuS%2FNpokkovEeHGnsuJdogo321ttV9ZquVndtGcyisxAsZZkK%2BeJB130WNxXGlUiKrFCDqIAo%2Fm8%2F1IaayRw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e2dc18dfd-MIA
expires
Wed, 11 May 2022 21:01:37 GMT
SFUIDisplay-Semibold.woff2
citizenstomach.com/master/us54/fonts/ 		68 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citizenstomach.com/master/us54/fonts/SFUIDisplay-Semibold.woff2
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/master/us54/fonts/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
089f0e4eb0c3da1bb90dd02a3b851eb3108f5da6ae2e71309e0474c63e926310
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://citizenstomach.com/master/us54/fonts/fonts.css
Origin
https://citizenstomach.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
14636
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
69120
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 22:47:54 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SUJBgAF8mI64k0RXlyXf1HuBTcvYO8vHYjlN5fcYuj9qfX8VBacurwpN9FfNLiu3G%2FgY4rTAOd3k%2F70oXwCgSskF3n3QaqJznx3%2FC%2BN%2BLQmM9d3GLiT2b%2B27ApFR79xu6cRj0xHbdt8P4%2FZ8uWDza7o%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e3dc48dfd-MIA
expires
Wed, 11 May 2022 21:24:04 GMT
SFUIDisplay-Bold.woff2
citizenstomach.com/master/us54/fonts/ 		67 KB
67 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citizenstomach.com/master/us54/fonts/SFUIDisplay-Bold.woff2
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/master/us54/fonts/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
326ba4238bbe0d5c76b808d68a1716c8f3e12a7e5f11470d6bf77660c547d332
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://citizenstomach.com/master/us54/fonts/fonts.css
Origin
https://citizenstomach.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
14636
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
68104
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 22:47:56 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fDKHrwkIli3KJ2p%2FlwTjiAomLpPWSCV%2B%2FG6TSrs6g%2F%2BmTPOetyX86NfFnuitlBHVDbd4bmFT9rPtk0lOZMEKxUrA0fmgmeEZ1zL2PnpV5Nd6wFO5XP17jsHLA8xmyoQmjpJiZrmhgypo7NH3wC0Rsjs%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e3dc58dfd-MIA
expires
Wed, 11 May 2022 21:24:04 GMT
SFUIDisplay-Medium.woff2
citizenstomach.com/master/us54/fonts/ 		67 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citizenstomach.com/master/us54/fonts/SFUIDisplay-Medium.woff2
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/master/us54/fonts/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1f8d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2594664b342515f02a0579dc4af1f912f8ae9f9b274b0238e17be801d1e5ea7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://citizenstomach.com/master/us54/fonts/fonts.css
Origin
https://citizenstomach.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:00 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
14636
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
68608
x-xss-protection
1; mode=block
last-modified
Fri, 04 Sep 2020 22:47:52 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bC4epiAuxZsPs1W9Se7zMrrWQrltHXITEfFJqyauukBA79fae6CtY2cesiwtyUTkdcxl5Xe0ZafVQs0nbzfG7%2BASeWDFvCvZ%2BYouk7uG%2BQhNeHwUQe4FaQ%2F4%2BOODEFTOLEi7ADQUWrCYXppjFI19e%2Bo%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
7065b26e3dc68dfd-MIA
expires
Wed, 11 May 2022 21:24:04 GMT
1x1.gif
a.mgid.com/ 		43 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.mgid.com/1x1.gif?id=507061&type=c&tg=&r=https%3A%2F%2Fcitizenstomach.com%2F%3F5deb4c83d45c6f3fe530a82bac9f62f9&utmc=0&utmt=0&nv=1&utms=&utmcp=&utmm=&clid=&cmgid=0&cmtid=0&cmtuid=0&d=1651714081164
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.135.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
image/gif
cf-ray
7065b26fa9136d9e-MIA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
399694290689525
connect.facebook.net/signals/config/ 		305 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/399694290689525?v=2.9.58&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
21e64d024aa24a971eaa07a66b05c6c6634cb6f777fe584168136923cffb45df
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
88882
x-xss-protection
0
pragma
public
x-fb-debug
ugVmGdzivN+upO9p65N+wDid+fA53aYmlBanheFX6+SIM3b/McamMCOaSmguAX6wlH67Q8VBrrqswPFm9ZND6w==
x-frame-options
DENY
date
Thu, 05 May 2022 01:28:01 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
init
tr.snapchat.com/ 		126 B
189 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/init?pids=cc25c7df-1e44-4f51-8ff1-8c175d6334c1
Requested by
Host: sc-static.net
URL: https://sc-static.net/scevent.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
d4d2c5c9d0208261f7c2b111958538a938334cef0081ecc6660fc28a9cae2c33
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
via
1.1 google
server
nginx/1.19.6
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
126
is_enabled
tr.snapchat.com/collector/ 		63 B
330 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/collector/is_enabled?pids=cc25c7df-1e44-4f51-8ff1-8c175d6334c1&tld=com
Requested by
Host: sc-static.net
URL: https://sc-static.net/scevent.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
78ab8776c8f68316d19152a9ca8954b8abb84868d60a268d5db5fdeba3d68eb3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
via
1.1 google
server
nginx/1.19.6
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
63
i
tr.snapchat.com/cm/ Frame EF5B 		672 B
879 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/cm/i?pid=cc25c7df-1e44-4f51-8ff1-8c175d6334c1
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
6501140033c3bb20da4b5ac73c90f687ba8a2053c4ba37c4b6f5275166db7fa6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://citizenstomach.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
672
content-type
text/html
date
Thu, 05 May 2022 01:28:01 GMT
server
nginx/1.19.6
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
p
tr.snapchat.com/ Frame FF29 		0
406 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/p
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://citizenstomach.com
Referer
https://citizenstomach.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-transform
content-length
0
content-type
text/html
date
Thu, 05 May 2022 01:28:01 GMT
server
nginx/1.19.6
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
p
tr.snapchat.com/ Frame AC3A 		0
186 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/p
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://citizenstomach.com
Referer
https://citizenstomach.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-transform
content-length
0
content-type
text/html
date
Thu, 05 May 2022 01:28:01 GMT
server
nginx/1.19.6
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
scevent.min.js
sc-static.net/ Frame EF5B 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sc-static.net/scevent.min.js
Requested by
Host: tr.snapchat.com
URL: https://tr.snapchat.com/cm/i?pid=cc25c7df-1e44-4f51-8ff1-8c175d6334c1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.64.251 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-64-251.ewr53.r.cloudfront.net
Software
CloudFront /
Resource Hash
cc308e76a07a70ae096c8c443bbf04154969ef4f52a4c632fc69ef233b8b5fa1

Request headers

accept-language
en-US,en;q=0.9
Referer
https://tr.snapchat.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Wed, 04 May 2022 23:49:58 GMT
content-encoding
gzip
server
CloudFront
age
5883
etag
0d6e407936704bd380072f5891d28b0e
x-cache
Hit from cloudfront
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, s-maxage=86400, max-age=600
x-amz-cf-pop
EWR53-C1
access-control-allow-headers
Content-Type
content-length
7163
via
1.1 5ec6b37107376867228d2ed46a794602.cloudfront.net (CloudFront)
x-amz-cf-id
VKVAo0wkn0u1a-jc82deoiNM7pSgQALbNkl8zjNv3G_PX4R3EosrxQ==
p
tr.snapchat.com/cm/ Frame 9E29
Redirect Chain
  • https://tr.snapchat.com/cm/s?bt=__LIVE__&pnid=140&cb=1651714081498
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1651710226960%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1651710226960%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
  • https://tr.snapchat.com/cm/p?rand=1651710226960&pnid=140&pcid=d9477fd9-1236-4ce7-b6ba-496076c4a81f
0
15 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/cm/p?rand=1651710226960&pnid=140&pcid=d9477fd9-1236-4ce7-b6ba-496076c4a81f
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://tr.snapchat.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-transform
content-length
0
content-type
text/html
date
Thu, 05 May 2022 01:28:01 GMT
server
nginx/1.19.6
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 05 May 2022 01:28:01 GMT
location
https://tr.snapchat.com/cm/p?rand=1651710226960&pnid=140&pcid=d9477fd9-1236-4ce7-b6ba-496076c4a81f
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
strict-transport-security
max-age=31536000
via
1.1 google
/
www.facebook.com/tr/ 		44 B
410 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=399694290689525&ev=PageView&dl=https%3A%2F%2Fcitizenstomach.com%2F%3F5deb4c83d45c6f3fe530a82bac9f62f9&rl=https%3A%2F%2Fzappirmoons.com%2F&if=false&ts=1651714081521&sw=1600&sh=1200&v=2.9.58&r=stable&ec=0&o=30&fbp=fb.1.1651714081519.367647280&it=1651714081207&coo=false&rqm=GET
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Thu, 05 May 2022 01:28:01 GMT
/
www.facebook.com/tr/ 		44 B
213 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=399694290689525&ev=ViewContent&dl=https%3A%2F%2Fcitizenstomach.com%2F%3F5deb4c83d45c6f3fe530a82bac9f62f9&rl=https%3A%2F%2Fzappirmoons.com%2F&if=false&ts=1651714081523&sw=1600&sh=1200&v=2.9.58&r=stable&ec=1&o=30&fbp=fb.1.1651714081519.367647280&it=1651714081207&coo=false&rqm=GET
Requested by
Host: citizenstomach.com
URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Thu, 05 May 2022 01:28:01 GMT
v9e118mez8
event.trk-tempore.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-tempore.com/register/event_log/v9e118mez8
Requested by
Host: trk-tempore.com
URL: https://trk-tempore.com/scripts/push/v9e118mez8
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:22dd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://citizenstomach.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-type
application/json

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
expires
0
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C7%2BLEJmiFgu2UrEOzlD%2Fco%2BQMhVI13T4YYr5D9%2BcigaU5PkBND6f6Y3CcGaEVet3WHjTzVsKvwHO%2FiQhDuSbHDPMqRmFnOXhY9cppqzC4k9GSXIEIccpaatA7%2BCWgWS6iGHS9d3%2F5msjno77PKznbwq6OzQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://citizenstomach.com
access-control-expose-headers
Authorization, Link, X-Total-Count
cache-control
no-cache, no-store, max-age=0, must-revalidate
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
access-control-allow-credentials
true
cf-ray
7065b273496a0302-MIA
x-pushplatformapp-params
v9e118mez8
event.trk-tempore.com/register/event_log/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-tempore.com/register/event_log/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:22dd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://citizenstomach.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://citizenstomach.com
access-control-expose-headers
Authorization, Link, X-Total-Count
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7065b2725dd60287-MIA
content-length
0
date
Thu, 05 May 2022 01:28:01 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zowLO1TEFvEyAUadi%2BshwkVsmP2HKsF7ialFryiUy1bPavq6VkgJ7rjBpEoicf%2BLpTzwQFy4afl6l%2Bu7j0GPWo%2BDbffld4SkmGcd5IOYd3CYhVU08xG2X35CanJgHPt%2FmPuVXjY%2BVdBu0KwBKYP6hLz%2FczE%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
v9e118mez8
event.trk-tempore.com/register/event_log/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-tempore.com/register/event_log/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:22dd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://citizenstomach.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://citizenstomach.com
access-control-expose-headers
Authorization, Link, X-Total-Count
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7065b2725dda0287-MIA
content-length
0
date
Thu, 05 May 2022 01:28:01 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yz7HLpxlDWxamcw3W7T1Ndq%2B0HUO%2BX2A7XJRZjdfDNyAor5guZQrLUi7Hf4uysnBn%2FW7WNGNuXGWj5Kq%2BaYLlrJ1sBIG%2BNlllPPZEk82alJ6DHAPazzqf%2FVPMFgnIPUXaQyRl1HNxd%2FrigfcKnLVzSVZPxA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
v9e118mez8
event.trk-tempore.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-tempore.com/register/event_log/v9e118mez8
Requested by
Host: trk-tempore.com
URL: https://trk-tempore.com/scripts/push/v9e118mez8
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:22dd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://citizenstomach.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-type
application/json

Response headers

date
Thu, 05 May 2022 01:28:01 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
expires
0
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cWvZdxEbsjXWEuAmc2PxcEsSXgWsuIO5bdZbmzQnEkyHlLxUgA2QKbpXntd%2BBt1umgL7UtEbkixK6dyDlaOAnJibhqnx%2B2m0cj0u8MesWeTRpc7w8LTtHCHhVQMGwQpX4VZnGoxvIkjVlBmeHmaVYmggcEo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://citizenstomach.com
access-control-expose-headers
Authorization, Link, X-Total-Count
cache-control
no-cache, no-store, max-age=0, must-revalidate
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
access-control-allow-credentials
true
cf-ray
7065b27349670302-MIA
x-pushplatformapp-params
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=399694290689525&ev=Microdata&dl=https%3A%2F%2Fcitizenstomach.com%2F%3F5deb4c83d45c6f3fe530a82bac9f62f9&rl=https%3A%2F%2Fzappirmoons.com%2F&if=false&ts=1651714083025&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22McAfee%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.58&r=stable&ec=2&o=30&fbp=fb.1.1651714081519.367647280&it=1651714081207&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-US,en;q=0.9
Referer
https://citizenstomach.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date
Thu, 05 May 2022 01:28:03 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority
u=3,i
expires
Thu, 05 May 2022 01:28:03 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Customer Survey Spam (Consumer)

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| change object| MYCALL string| s1 string| s2 string| esource string| pshpub string| pshdomain function| fbq function| _fbq function| snaptr object| r object| MgSensorData function| $ function| jQuery function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore object| MgSensor function| MgSensorInvoke function| MgSensorInvoke0 object| _mgq function| _mgqp number| _mgqt number| _mgqi object| _mgr object| _mghl object| snaptrContext boolean| triedToSendCookieToNative object| WebJSBridge

16 Cookies

Domain/Path Name / Value
sc-static.net/scevent.min.js Name: X-AB
Value: 0d6e407936704bd380072f5891d28b0e
zappirmoons.com/ Name: uid4050
Value: 713111998-20220504212800-95f18b73d98ab1c65ae85a081cc2f927-1969
vermailtrumpet.com/ Name: PHPSESSID
Value: d17fc3b4ebe6d71cd61eb4686706814f
citizenstomach.com/ Name: PHPSESSID
Value: d03f6d7833b678244c921dcdf3e9ff0a
.mgid.com/ Name: __cf_bm
Value: rHOFFiMlOPZcygbVTjb_Ztxvshopz1UcZjGX_Ij_tss-1651714081-0-AQFjW0nqB4osBw89bPa8Z0fksvIFLgzFJ/uT9YWDZZClsc/enLRRcmulgLN3zS6dRFvE2rgRjZAwPje/gb5eWg4=
citizenstomach.com/ Name: MgidSensorNVis
Value: 1
citizenstomach.com/ Name: MgidSensorHref
Value: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
.citizenstomach.com/ Name: _scid
Value: 20b8fe1e-94a4-4613-8df9-dbb35022dcb5
.mgid.com/ Name: muidn
Value: m441TWKGNtsi
.citizenstomach.com/ Name: _fbp
Value: fb.1.1651714081519.367647280
.snapchat.com/ Name: sc_at
Value: v2|H4sIAAAAAAAAAE3GwQ3AIAwDwIkiJYTYbrcBlU7B8OXZe51SmFmwZxatg7SRngZiqemC3rGj+x2o4Ili/+ofXlEkfUAAAAA=
.tapad.com/ Name: TapAd_TS
Value: 1651714081722
.tapad.com/ Name: TapAd_DID
Value: d9477fd9-1236-4ce7-b6ba-496076c4a81f
.facebook.com/ Name: fr
Value: 0SGku4dcJyf2R2RNA..Bicygh...1.0.Bicygh.
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.citizenstomach.com/ Name: _sctr
Value: 1|1651708800000

1 Console Messages

Source Level URL
Text
other error URL: https://citizenstomach.com/?5deb4c83d45c6f3fe530a82bac9f62f9
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mgid.com
bankaudi.net
citizenstomach.com
code.jquery.com
connect.facebook.net
event.trk-tempore.com
pixel.tapad.com
s3-us-west-2.amazonaws.com
sc-static.net
tr.snapchat.com
trk-tempore.com
vermailtrumpet.com
www.facebook.com
zappirmoons.com
104.19.135.78
107.178.246.49
13.225.64.251
162.210.173.133
2001:4de0:ac18::1:a:3a
23.95.56.6
2606:4700:3033::6815:259
2606:4700:3034::6815:22dd
2606:4700:3037::6815:1f8d
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
35.186.226.184
52.218.133.120
089f0e4eb0c3da1bb90dd02a3b851eb3108f5da6ae2e71309e0474c63e926310
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
21e64d024aa24a971eaa07a66b05c6c6634cb6f777fe584168136923cffb45df
2594664b342515f02a0579dc4af1f912f8ae9f9b274b0238e17be801d1e5ea7d
326ba4238bbe0d5c76b808d68a1716c8f3e12a7e5f11470d6bf77660c547d332
43fccd349655df7497727c1c95d4fd97033f8aaf649067cbafb2b6d2751cf340
6501140033c3bb20da4b5ac73c90f687ba8a2053c4ba37c4b6f5275166db7fa6
662edca6a1dd7f2c68d994b2b1f80b6f93df4b94f2cd14fe5174a7a94c550a68
78ab8776c8f68316d19152a9ca8954b8abb84868d60a268d5db5fdeba3d68eb3
862eaa13edcf4d4763065b78d4e585f3964d77e5f4ae24e655e2f4a4d8e3d535
a0e56c977895c222a299714f8dd0f0e56dd6b861db6fa7e4725d0281c5bb01d4
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aa4b74cc94b96ff49ac4462f2a335fcaf85777e2a8857b805d08da763d8647ff
b1216acea3bd6a3146e94270b0857bd97dc67fa05ed8922a92b8ee6f03704d58
b819b3ac2fe5857b7026a609f9115f0d50a7d6e8085ba5987d70ed6baaa41f4e
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
c4fb645aee8606db59c84e228115420b8a7fb7d6b44bdd34963609145eaceb71
c6fd375cb3ecb3e1930a53542fc4c1253d18b77d1f97d784a6d8ecf735d500c2
c78544e8ff1e531f921b487e67fb29d0a86d85a77aa9d3419b453146a340b7d2
cc308e76a07a70ae096c8c443bbf04154969ef4f52a4c632fc69ef233b8b5fa1
cfb6708f8e8d5277007f904e261d1e4c7dc1c9240b04bbaccf4ddf472b3cc95a
d4d2c5c9d0208261f7c2b111958538a938334cef0081ecc6660fc28a9cae2c33
d65693a0508e7369cfe393c568264829e59aacdea9915c0fbca29396da7e29c0
d9b70f59936d0dcd908fc0ad01051fee3ba007f5ded94489b5fde93c1649c88c
e361f2ca65ed3595ad06c921afa3e61bf2c941b24dfe6937cdbb13321a8e20c5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8098c6938d10947bf06e59e59b684daf1ef70c1e520bd7e6d4d85e28ee94f00
f58546497e0a9e6a4926b54b3ac5219a39ec48ebe6b821c1bc6f5a38e9f0c1f6
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d