urlscan.io logo urlscan.io
SecurityTrails logo

www.origininvestigations.com Open in urlscan Pro
76.76.21.93  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u42447169.ct.sendgrid.net/ls/click?upn=u001.oDkzHcDMN5SkU-2BKOEzT3hKNrqEKnRC3a6qGPCIXJmxdIF-2B1Oxwb-2FzA7rUu48hbIYRS-T_2Ns...
Effective URL: https://www.origininvestigations.com/
Submission: On March 29 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 4 countries across 10 domains to perform 47 HTTP transactions. The main IP is 76.76.21.93, located in Walnut, United States and belongs to AMAZON-02, US. The main domain is www.origininvestigations.com.
TLS certificate: Issued by R3 on February 22nd 2024. Valid for: 3 months.
This is the only time www.origininvestigations.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    167.89.115.147 (Herndon, United States)

ASN11377 (SENDGRID, US)
PTR: o16789115x147.outbound-mail.sendgrid.net
u42447169.ct.sendgrid.net
12    76.76.21.93 (Walnut, United States)

ASN16509 (AMAZON-02, US)
www.origininvestigations.com
5    35.244.173.183 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 183.173.244.35.bc.googleusercontent.com
static.heyflow.app
1    13.41.6.241 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-41-6-241.eu-west-2.compute.amazonaws.com
api.fontshare.com
1    2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
3    2400:52e0:1e00::1081:1 (Germany)

ASN200325 (BUNNYCDN, SI)
cdn.fontshare.com
15    2a00:1450:4001:806::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
app.chatsupport.co
api.chatsupport.co
2    2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    35.201.93.133 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 133.93.201.35.bc.googleusercontent.com
assets.chatsupport.co
1    2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:830::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2a00:1450:4001:82a::201b (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
storage.googleapis.com
3    172.217.18.27 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f27.1e100.net
storage.googleapis.com
Apex Domain
Subdomains		 Transfer
16 chatsupport.co
app.chatsupport.co — Cisco Umbrella Rank: 348402
api.chatsupport.co — Cisco Umbrella Rank: 220481
assets.chatsupport.co — Cisco Umbrella Rank: 343929
504 KB
12 origininvestigations.com
www.origininvestigations.com
295 KB
5 heyflow.app
static.heyflow.app — Cisco Umbrella Rank: 195468
62 KB
4 googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 302
308 KB
4 fontshare.com
api.fontshare.com — Cisco Umbrella Rank: 102847
cdn.fontshare.com — Cisco Umbrella Rank: 113808
64 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 34
region1.google-analytics.com — Cisco Umbrella Rank: 2042
21 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 42
90 KB
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 91
355 B
1 gstatic.com
fonts.gstatic.com
46 KB
1 sendgrid.net
u42447169.ct.sendgrid.net
238 B
47 10
Domain Requested by
14 api.chatsupport.co app.chatsupport.co
12 www.origininvestigations.com www.origininvestigations.com
5 static.heyflow.app www.origininvestigations.com
static.heyflow.app
4 storage.googleapis.com
3 cdn.fontshare.com api.fontshare.com
2 www.google-analytics.com app.chatsupport.co
www.google-analytics.com
1 region1.google-analytics.com www.googletagmanager.com
1 www.googletagmanager.com www.google-analytics.com
1 stats.g.doubleclick.net www.google-analytics.com
1 assets.chatsupport.co
1 app.chatsupport.co www.origininvestigations.com
1 fonts.gstatic.com www.origininvestigations.com
1 api.fontshare.com www.origininvestigations.com
1 u42447169.ct.sendgrid.net 1 redirects
47 14
Subject Issuer Validity Valid
www.origininvestigations.com
R3		 2024-02-22 -
2024-05-22		 3 months crt.sh
static.heyflow.app
GTS CA 1D4		 2024-02-06 -
2024-05-06		 3 months crt.sh
api.fontshare.com
Amazon RSA 2048 M03		 2023-12-02 -
2024-12-30		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
cdn.fontshare.com
R3		 2024-02-16 -
2024-05-16		 3 months crt.sh
app.chatsupport.co
GTS CA 1D4		 2024-03-06 -
2024-06-04		 3 months crt.sh
api.chatsupport.co
GTS CA 1D4		 2024-03-01 -
2024-05-30		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
assets.answerconnect.com
GTS CA 1D4		 2024-03-27 -
2024-06-25		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2024-02-26 -
2024-05-20		 3 months crt.sh
storage.googleapis.com
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.origininvestigations.com/
Frame ID: 6388929F9FE92AC2859A847F9730A3F0
Requests: 40 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

ORIGIN / Investigation / Intelligence

Page URL History Show full URLs

  1. https://u42447169.ct.sendgrid.net/ls/click?upn=u001.oDkzHcDMN5SkU-2BKOEzT3hKNrqEKnRC3a6qGPCIXJmxdIF-2B1Oxwb-2F... HTTP 302
    http://www.origininvestigations.com/ HTTP 307
    https://www.origininvestigations.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

47
Requests

100 %
HTTPS

57 %
IPv6

10
Domains

14
Subdomains

13
IPs

4
Countries

1390 kB
Transfer

3513 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u42447169.ct.sendgrid.net/ls/click?upn=u001.oDkzHcDMN5SkU-2BKOEzT3hKNrqEKnRC3a6qGPCIXJmxdIF-2B1Oxwb-2FzA7rUu48hbIYRS-T_2Ns5hMCJB6Nd9nKoVzHX6qLgntXcpTxHUfeJYcmTX-2F0WFqcbLslfrw-2B6DeCtyRuiCc55W1IO1n5CjuWupBKFrz3cDtCKOVtw4cuCYqXW0zKZW2sfxnp-2B2qVGAe6mnPV-2BY-2BREyRAzYht86QV2LPizhCKx1badReSra0I6p427AdkIP-2BIX0IJ6vXQk9bgSEgqPukiejXJJRe4KVtsL0-2BBGp8CvfUrEDPaTpupeSYee1EPh00vSsgNukrR3osvYfcxFQmh3AEywLVG2guiRMezVo0KAUJqXkEtC5lnoP4aW9jk5BO-2F-2FMvUip-2F7zLQuZGMzQb4lrGkEn4UO73hT7fbYAXI-2F0XN6WgmSIZYJKQLo-2Fnuy5M-2BCCPinOs3L9hS94-2FLxQsPRRP6uoUBYfxuSjpNvF-2BzaOeKbF77a-2BTKqmLyF78j8-3D HTTP 302
    http://www.origininvestigations.com/ HTTP 307
    https://www.origininvestigations.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

47 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.origininvestigations.com/
Redirect Chain
  • https://u42447169.ct.sendgrid.net/ls/click?upn=u001.oDkzHcDMN5SkU-2BKOEzT3hKNrqEKnRC3a6qGPCIXJmxdIF-2B1Oxwb-2FzA7rUu48hbIYRS-T_2Ns5hMCJB6Nd9nKoVzHX6qLgntXcpTxHUfeJYcmTX-2F0WFqcbLslfrw-2B6DeCtyRuiCc...
  • http://www.origininvestigations.com/
  • https://www.origininvestigations.com/
79 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
5c4945f98960a5591e45b5953338e43e0c796f11dede3d712d06c64607664df0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
age
49762
cache-control
public, max-age=0, must-revalidate
content-disposition
inline
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 29 Mar 2024 12:55:11 GMT
etag
W/"a6975bbcc3e86297caadd638c21f8b94"
server
Vercel
strict-transport-security
max-age=63072000
x-matched-path
/
x-vercel-cache
HIT
x-vercel-id
fra1::ccqnz-1711716911592-4fa820b822c5

Redirect headers

Location
https://www.origininvestigations.com/
Non-Authoritative-Reason
HttpsUpgrades
webview.js
static.heyflow.app/widget/latest/ 		3 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.heyflow.app/widget/latest/webview.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.173.183 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
183.173.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
69271f7b00a810fc803f645be704b8594448541c1ade033b0b59bbbb5bf75c2f

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:31:50 GMT
age
1401
x-guploader-uploadid
ABPtcPqEr7MGM6Oj0upUjCl9qdiTZ6OYeTMKCO6J67pq8FSS6du6yWatY-G1IsT9I-n59vieGv4
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3511
last-modified
Thu, 14 Mar 2024 17:19:47 GMT
server
UploadServer
etag
"cc68dbab66ce26571dc38d9ee44693e3"
x-goog-generation
1700651920926339
x-goog-hash
crc32c=eqq6jw==, md5=zGjbq2bOJlcdw42e5EaT4w==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public,max-age=3600
x-goog-stored-content-length
3511
accept-ranges
bytes
content-type
application/javascript
image
www.origininvestigations.com/_next/ 		139 KB
139 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.origininvestigations.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Forigin.b08b223a.png&w=3840&q=75
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
aeed54e01b2d31cb2639e7c6cb6dc97063b99f6ac28a2fe59342bb61574164bc
Security Headers
Name Value
Content-Security-Policy script-src 'none'; frame-src 'none'; sandbox;
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
script-src 'none'; frame-src 'none'; sandbox;
date
Fri, 29 Mar 2024 12:55:11 GMT
strict-transport-security
max-age=63072000
age
59165
content-disposition
inline; filename="origin.webp"
content-length
141826
last-modified
Thu, 28 Mar 2024 20:29:06 GMT
server
Vercel
x-vercel-id
fra1::tvwp6-1711716911628-96b13fe5377d
x-matched-path
/_next/static/media/origin.b08b223a.png
x-vercel-cache
HIT
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
css
api.fontshare.com/v2/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.fontshare.com/v2/css?f[]=cabinet-grotesk@800,500,700&display=swap
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.41.6.241 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-41-6-241.eu-west-2.compute.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
f4e977b80a923bd806448678290b9356a29378f0d1cbf5b7ccd282795db005ef

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
server
nginx/1.18.0 (Ubuntu)
access-control-allow-methods
GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type
text/css
access-control-allow-origin
https://api.fontstore.com
cache-control
private, max-age=86400, stale-while-revalidate=604800
access-control-allow-credentials
true
access-control-allow-headers
content-type, authorization, cookie
content-length
1792
x-request-id
F8E9dk8sHXoiOZ8VZzlx
b483d5bd1adc4097.css
www.origininvestigations.com/_next/static/css/ 		40 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/css/b483d5bd1adc4097.css
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
06fbd1bb754ebea9ef1152d4bfef2636c00aa547449f33976c65ed6acb028885
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::ccqnz-1711716911628-d4ec820aea0b
age
49118
x-matched-path
/_next/static/css/b483d5bd1adc4097.css
etag
W/"11ad8f8a0033dfbb592c62f687ad2ca8"
x-vercel-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="b483d5bd1adc4097.css"
webpack-7b404abfd9747e1f.js
www.origininvestigations.com/_next/static/chunks/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/chunks/webpack-7b404abfd9747e1f.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
38101bc5c3bd55ed51454e0d79304d5c04b655b0d4bb228d778f54f02aab21ed
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::9m4qm-1711716911678-b12c6bfa3be9
age
49118
x-matched-path
/_next/static/chunks/webpack-7b404abfd9747e1f.js
etag
W/"054dfde4466e99f5a2cd78106cc0e851"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="webpack-7b404abfd9747e1f.js"
framework-2c79e2a64abdb08b.js
www.origininvestigations.com/_next/static/chunks/ 		138 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/chunks/framework-2c79e2a64abdb08b.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
f2ae26ff518d9519afd2a3dc277d84e098458e6b6b85fa9548cda2bed24435e7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::974n5-1711716911678-f28a46bbd4b2
age
49118
x-matched-path
/_next/static/chunks/framework-2c79e2a64abdb08b.js
etag
W/"7fc4bed6b4319c62343f0bf5db91a5bb"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="framework-2c79e2a64abdb08b.js"
main-aa0b622345823a13.js
www.origininvestigations.com/_next/static/chunks/ 		92 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/chunks/main-aa0b622345823a13.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
037862e5206bfa973a54368cfcd1fa693d652a3c092458c582bcf596ef7454d0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::j6nwg-1711716911678-ba7d0421fc78
age
49118
x-matched-path
/_next/static/chunks/main-aa0b622345823a13.js
etag
W/"134133827cfe9d08246335b08741a120"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="main-aa0b622345823a13.js"
_app-50705c2a7b779691.js
www.origininvestigations.com/_next/static/chunks/pages/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/chunks/pages/_app-50705c2a7b779691.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
9744220669825e30cf973daa43ce8a664962507518cd488b5724c6daa2bf0ac7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::qdt7g-1711716911678-b0a2f0cfb185
age
49118
x-matched-path
/_next/static/chunks/pages/_app-50705c2a7b779691.js
etag
W/"9ae6960bf72c8e9e0a0eff830f54f971"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="_app-50705c2a7b779691.js"
939-b1c3e2fd4809f5a2.js
www.origininvestigations.com/_next/static/chunks/ 		67 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/chunks/939-b1c3e2fd4809f5a2.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
2dbadbeaeef0e45d2607f4a2d2161424da1459b0a476a6295629e0a17531529a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::j9ndb-1711716911678-e662a99a4ab8
age
49118
x-matched-path
/_next/static/chunks/939-b1c3e2fd4809f5a2.js
etag
W/"96d0668a9465456b48627cd63391de01"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="939-b1c3e2fd4809f5a2.js"
index-d0bfbdf7a471f7ac.js
www.origininvestigations.com/_next/static/chunks/pages/ 		71 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/chunks/pages/index-d0bfbdf7a471f7ac.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
859aac4066b95bac4c5370ae3d54d11ab7c0af0fead75759c94698746f954b8e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::ccqnz-1711716911679-0ddcb63c8591
age
49118
x-matched-path
/_next/static/chunks/pages/index-d0bfbdf7a471f7ac.js
etag
W/"e20812cce597b836d6ab563afdac0b77"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="index-d0bfbdf7a471f7ac.js"
_buildManifest.js
www.origininvestigations.com/_next/static/eWGBTyz0yCSxi6Aw1s3yd/ 		322 B
526 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/eWGBTyz0yCSxi6Aw1s3yd/_buildManifest.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
9f97b3ebc3fc90009b42c55347671eb52a2d3c8de175ca898ae52ff8c8fca6f5
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::gx8tl-1711716911678-83938327695d
age
49118
x-matched-path
/_next/static/eWGBTyz0yCSxi6Aw1s3yd/_buildManifest.js
etag
"5e4f5d4f9b362928d60216beac64d9ed"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="_buildManifest.js"
accept-ranges
bytes
content-length
322
_ssgManifest.js
www.origininvestigations.com/_next/static/eWGBTyz0yCSxi6Aw1s3yd/ 		77 B
246 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/_next/static/eWGBTyz0yCSxi6Aw1s3yd/_ssgManifest.js
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::6f2fk-1711716911678-a00cbb9ddb24
age
49118
x-matched-path
/_next/static/eWGBTyz0yCSxi6Aw1s3yd/_ssgManifest.js
etag
"b6652df95db52feb4daf4eca35380933"
x-vercel-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
content-disposition
inline; filename="_ssgManifest.js"
accept-ranges
bytes
content-length
77
187.js
static.heyflow.app/widget/latest/ 		17 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.heyflow.app/widget/latest/187.js
Requested by
Host: static.heyflow.app
URL: https://static.heyflow.app/widget/latest/webview.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.173.183 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
183.173.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
00ba7c0592e851a257da77bf54cd0e3394c6e9275e7c3b756eb7a6217b74477b

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:06:06 GMT
age
2945
x-guploader-uploadid
ABPtcPrf8ECXIfghaeVmUr3OezQYAC4Y8sUS-CUeXBMD4cJm0a7p_8BZEuI71y7pZty8RMKA6mul8NvWHQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17461
last-modified
Thu, 14 Mar 2024 17:19:47 GMT
server
UploadServer
etag
"f3fe5e168447e6114bb379e42d7249cf"
x-goog-generation
1700651920977993
x-goog-hash
crc32c=ogIkNg==, md5=8/5eFoRH5hFLs3nkLXJJzw==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public,max-age=3600
x-goog-stored-content-length
17461
accept-ranges
bytes
content-type
application/javascript
169.js
static.heyflow.app/widget/latest/ 		18 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.heyflow.app/widget/latest/169.js
Requested by
Host: static.heyflow.app
URL: https://static.heyflow.app/widget/latest/webview.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.173.183 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
183.173.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
69043caca561604c5d8f500aba975f1c57d6249fbace246a6c000ee85689fdbe

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:39:27 GMT
age
944
x-guploader-uploadid
ABPtcPqF7-AlzcB_wM9tMzereiz0vhiodo-cm7wHHH1Uy0ZUMGy3WVKa7a2m4bAe7CaiWVRWywNvULoTiQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17997
last-modified
Thu, 14 Mar 2024 17:19:47 GMT
server
UploadServer
etag
"66d6ef0b7487bece949e3f1c7f12cf28"
x-goog-generation
1700651920977677
x-goog-hash
crc32c=UdZlKQ==, md5=ZtbvC3SHvs6Unj8cfxLPKA==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public,max-age=3600
x-goog-stored-content-length
17997
accept-ranges
bytes
content-type
application/javascript
55.js
static.heyflow.app/widget/latest/ 		12 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.heyflow.app/widget/latest/55.js
Requested by
Host: static.heyflow.app
URL: https://static.heyflow.app/widget/latest/webview.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.173.183 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
183.173.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
e2b1007d8b21f97e8aafac87a109266f1500dfddbe895fab6ddd5986a49aba6f

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:16:47 GMT
age
2304
x-guploader-uploadid
ABPtcPre68M4HkX4jy2i5I_YJAKffX0LgDLNY0IClWsc3Z17jp3wGkU1QtgJQS8N8xDKwfM0HgtRVxR1Vw
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12696
last-modified
Thu, 14 Mar 2024 17:19:47 GMT
server
UploadServer
etag
"b3d852ad25f4f61697b79c3b5c030c8d"
x-goog-generation
1700651920977826
x-goog-hash
crc32c=evoWGg==, md5=s9hSrSX09haXt5w7XAMMjQ==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public,max-age=3600
x-goog-stored-content-length
12696
accept-ranges
bytes
content-type
application/javascript
78.js
static.heyflow.app/widget/latest/ 		10 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.heyflow.app/widget/latest/78.js
Requested by
Host: static.heyflow.app
URL: https://static.heyflow.app/widget/latest/webview.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.173.183 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
183.173.244.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
c677b0ef46c4d73635c1a157321ffa2e137ba4cab6ece2dc9737748a3fd26d56

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:11:51 GMT
age
2600
x-guploader-uploadid
ABPtcPqGNJTUaDMiwKtbk4yXnokvYNZVNavYgGQ_6yc706cNL0U4bY9jJwo5RDFR1w3b1KqRum5vUC-BFw
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10146
last-modified
Thu, 14 Mar 2024 17:19:47 GMT
server
UploadServer
etag
"c25988d67edb3b69fef3717cb5aa7058"
x-goog-generation
1710436787743107
x-goog-hash
crc32c=lUGN3w==, md5=wlmI1n7bO2n+83F8tapwWA==
access-control-allow-origin
*
access-control-expose-headers
Content-Type
cache-control
public,max-age=3600
x-goog-stored-content-length
10146
accept-ranges
bytes
content-type
application/javascript
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2
fonts.gstatic.com/s/inter/v13/ 		45 KB
46 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3bcf04ca301e44f13f404c8a04aa4ae707f67a950e12ef30c238f96e784266a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
Origin
https://www.origininvestigations.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 26 Mar 2024 01:32:32 GMT
x-content-type-options
nosniff
age
300159
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
46552
x-xss-protection
0
last-modified
Thu, 14 Sep 2023 00:46:39 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 26 Mar 2025 01:32:32 GMT
4CO2ETY7NITKLUDKMYJ75RHJSPHOJ7XT.woff2
cdn.fontshare.com/wf/CKQBK2QBTCDREE7L3MXZ3PPW7LDNJCWU/OTOY7FQFSFOJVZKJWKO2EHUJLOGBDN4Q/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.fontshare.com/wf/CKQBK2QBTCDREE7L3MXZ3PPW7LDNJCWU/OTOY7FQFSFOJVZKJWKO2EHUJLOGBDN4Q/4CO2ETY7NITKLUDKMYJ75RHJSPHOJ7XT.woff2
Requested by
Host: api.fontshare.com
URL: https://api.fontshare.com/v2/css?f[]=cabinet-grotesk@800,500,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1081:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1081 /
Resource Hash
b641ecaaeda27cf0d560bf26058e9bc9997ac7bfdc58414f9df2d4d58a32c34b

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://api.fontshare.com/
Origin
https://www.origininvestigations.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
via
1.1 82514a5a8cf35fb3132b0b5ab9cb724c.cloudfront.net (CloudFront)
x-amz-version-id
9wfmwHJApCYSmM4jXiOIWltWGLpUK51_
cdn-edgestorageid
1081
x-amz-cf-pop
FRA56-P3
x-cache
Miss from cloudfront
cdn-cachedat
03/08/2024 03:20:39
cdn-pullzone
337273
content-length
20260
last-modified
Mon, 15 Mar 2021 07:38:23 GMT
server
BunnyCDN-DE1-1081
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
"d72f9056a1298a86556c9d3427e2b3ab-1"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
e359c170-f2f7-42c9-a18b-f6696abbe1ea
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=604800
cdn-requestid
b5d9bcc9bdac1f347cc4dc9837a8bffa
accept-ranges
bytes
cdn-requestcountrycode
DE
cdn-status
200
x-amz-cf-id
Bu-tDjWqTZtUDfrj6tgP2v41xGkt5VhT2-_Wx-ezlihQy5XeiRfXhg==
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullsuccess
True
6QH2ALVTTK7IRVO5MYOQQ3OZNXW5SSS3.woff2
cdn.fontshare.com/wf/ZX6AQLSFYVDPN2URWO2MQFGTYYOHIS64/TPYPKOYWFQVNJHLLRXD4KFYX4LUOUW4Z/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.fontshare.com/wf/ZX6AQLSFYVDPN2URWO2MQFGTYYOHIS64/TPYPKOYWFQVNJHLLRXD4KFYX4LUOUW4Z/6QH2ALVTTK7IRVO5MYOQQ3OZNXW5SSS3.woff2
Requested by
Host: api.fontshare.com
URL: https://api.fontshare.com/v2/css?f[]=cabinet-grotesk@800,500,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1081:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1081 /
Resource Hash
694b9d04bb9fe15a79242a653a8f6de8296d7b32c5706a9f7275523889973884

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://api.fontshare.com/
Origin
https://www.origininvestigations.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
via
1.1 740769d10d5ef217a54d33b1ec64faf4.cloudfront.net (CloudFront)
x-amz-version-id
wDOQrIkwBXd19Z.xK0G.DxT73LLn2flu
cdn-edgestorageid
1082
x-amz-cf-pop
FRA56-P3
x-cache
Miss from cloudfront
cdn-cachedat
07/07/2023 02:01:02
cdn-pullzone
337273
content-length
20204
last-modified
Mon, 15 Mar 2021 07:38:23 GMT
server
BunnyCDN-DE1-1081
cdn-proxyver
1.03
cdn-requestpullcode
200
etag
"689c8d45b9a8a7f08293dd7686c5bc38-1"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
e359c170-f2f7-42c9-a18b-f6696abbe1ea
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=604800
cdn-requestid
de9cf847d633524f8f77135c5e29eac0
accept-ranges
bytes
cdn-requestcountrycode
DE
cdn-status
200
x-amz-cf-id
7d61mP0wxFhJhBFMhHtntSrnr2n5zgJBGJlNrzo5p8MLjztdffZZsg==
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullsuccess
True
WN5274VQ3AUBDFP74GB4EC4XYJ3EKVNE.woff2
cdn.fontshare.com/wf/XMXWOHABYLQDJ42L65EFRYNVRY37HQCB/B2O4O6V3JMFM2WDCYQI3A47L5U4THDUL/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.fontshare.com/wf/XMXWOHABYLQDJ42L65EFRYNVRY37HQCB/B2O4O6V3JMFM2WDCYQI3A47L5U4THDUL/WN5274VQ3AUBDFP74GB4EC4XYJ3EKVNE.woff2
Requested by
Host: api.fontshare.com
URL: https://api.fontshare.com/v2/css?f[]=cabinet-grotesk@800,500,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1081:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1081 /
Resource Hash
52208453fddad17efb2ec2d98729e18556d6c5b64ad22171f8e8b071802314d3

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://api.fontshare.com/
Origin
https://www.origininvestigations.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
via
1.1 bafea69ec4368ee11760779ffcfbd4fc.cloudfront.net (CloudFront)
x-amz-version-id
IDlPkjY6TNG6V7qSrzC6oIl7fO4KAn_A
cdn-edgestorageid
1080
x-amz-cf-pop
FRA56-P3
x-cache
Miss from cloudfront
cdn-cachedat
07/07/2023 01:58:08
cdn-pullzone
337273
content-length
20300
last-modified
Mon, 15 Mar 2021 07:38:23 GMT
server
BunnyCDN-DE1-1081
cdn-proxyver
1.03
cdn-requestpullcode
200
etag
"1e5195e6afbdb0b7326016d9db2e5186-1"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
e359c170-f2f7-42c9-a18b-f6696abbe1ea
access-control-expose-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control
public, max-age=604800
cdn-requestid
e94108e88ebbefb97eb36445c01f2965
accept-ranges
bytes
cdn-requestcountrycode
DE
cdn-status
200
x-amz-cf-id
WF5kueaIxmtKfzdIWPXP1K35r9YckUa3MoZgyAL7LILKSZP9uBRU-Q==
access-control-allow-headers
Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullsuccess
True
LS-42bf8cb7
app.chatsupport.co/api/client/get/script/ 		2 MB
392 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Requested by
Host: www.origininvestigations.com
URL: https://www.origininvestigations.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash
6ead44564d2bf2250ce51ae38ca5ad577b6f400d8c92d001ebad84924db87225

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:12 GMT
content-encoding
gzip
server
Google Frontend
x-powered-by
Express
etag
ceb93bc98ec281b7305bdb447c066b5c
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-cloud-trace-context
276f96034424001e6b73a9293d932b8f
cache-control
no-cache
content-length
400113
favicon.ico
www.origininvestigations.com/ 		15 KB
7 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.origininvestigations.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.93 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
26014d368796a38f5b6875d699c4ab6612f2ca1c1aabf1b283cbe57cb73ad30e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:11 GMT
content-encoding
br
strict-transport-security
max-age=63072000
server
Vercel
x-vercel-id
fra1::5tlhj-1711716911912-566aba805f05
age
39417
x-matched-path
/favicon.ico
etag
W/"9e6f6d3cc841c7830e810d3d4fb862e5"
x-vercel-cache
HIT
content-type
image/vnd.microsoft.icon
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
content-disposition
inline; filename="favicon.ico"
chatconfig
api.chatsupport.co/api/client/get/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/client/get/chatconfig
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.origininvestigations.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
OPTIONS, GET, POST, DELETE, PUT, PATCH
access-control-allow-origin
https://www.origininvestigations.com
access-control-max-age
3600
content-length
0
content-type
text/html
date
Fri, 29 Mar 2024 12:55:13 GMT
server
Google Frontend
vary
Origin Accept-Encoding
x-cloud-trace-context
acd2c38e306d523fc992812ad7915962
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: app.chatsupport.co
URL: https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 29 Mar 2024 11:48:08 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
4025
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 29 Mar 2024 13:48:08 GMT
chatconfig
api.chatsupport.co/api/client/get/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/client/get/chatconfig
Requested by
Host: app.chatsupport.co
URL: https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
c1ffe32946ca1814cbd70dea028c8b3813450d5a41120ecfc79839116a609de8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json
Accept
application/json, text/plain, */*
Referer
https://www.origininvestigations.com/
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
Google Frontend
vary
Origin, Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.origininvestigations.com
x-cloud-trace-context
848788696f0ede41d73794849f2af96a
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
content-length
1202
x-xss-protection
1; mode=block
new-incoming-chat.wav
assets.chatsupport.co/chat/sounds/ 		108 KB
109 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://assets.chatsupport.co/chat/sounds/new-incoming-chat.wav
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.93.133 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
133.93.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
37adaca49be9073d97356ef088f48826fb5385a5a1ad270b39ac8a74664239b1

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer
https://www.origininvestigations.com/
Range
bytes=0-
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 01:29:38 GMT
age
41135
x-guploader-uploadid
ABPtcPqw8FmB2ZnBMKlCCyAIcpOB3uCYFPsAWkRHYUKTC-IQIm54T3QqpT3NiSNYddlCD7zIxJo
x-goog-storage-class
MULTI_REGIONAL
Content-Range
bytes 0-110637/110638
x-goog-metageneration
8
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Length
110638
last-modified
Tue, 15 May 2018 14:21:53 GMT
server
UploadServer
etag
"be634e688b52e78db59a93b7e4bb591c"
x-goog-generation
1526394113228629
x-goog-hash
crc32c=GGr50g==, md5=vmNOaItS5421mpO35LtZHA==
access-control-allow-origin
*
content-type
audio/wav
cache-control
public,max-age=3600
x-goog-stored-content-length
110638
accept-ranges
bytes
collect
www.google-analytics.com/j/ 		16 B
231 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=339387677&t=pageview&_s=1&dl=https%3A%2F%2Fwww.origininvestigations.com%2F&dp=%2F&ul=en-us&de=UTF-8&dt=ORIGIN%20%2F%20Investigation%20%2F%20Intelligence&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=IEBAAEABCAAAACgCI~&jid=2049773185&gjid=643354768&cid=808150964.1711716913&tid=UA-142317797-1&_gid=711291494.1711716913&_r=1&_slc=1&z=1227460149
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e397e6629f0c68e9b83019d117a612d20765e4198e805d569f3df4b4cf564be6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.origininvestigations.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
16
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
355 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-142317797-1&cid=808150964.1711716913&jid=2049773185&gjid=643354768&_gid=711291494.1711716913&_u=IEBAAEAACAAAACgCI~&z=385604757
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 29 Mar 2024 12:55:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.origininvestigations.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		251 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-WSNK7QFYC8&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
84518e007fe253895a812584ab88f40f3627c3a13a1233fe03135313205b8be6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:13 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
91908
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 29 Mar 2024 12:55:13 GMT
collect
region1.google-analytics.com/g/ 		0
263 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-WSNK7QFYC8&gtm=45je43r0v9131765283za200&_p=1711716913084&gcd=13l3l3l2l2&npa=0&dma_cps=sypham&dma=1&ul=en-us&sr=800x600&cid=808150964.1711716913&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.86%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.86&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.origininvestigations.com%2F&dp=%2F&dt=ORIGIN%20%2F%20Investigation%20%2F%20Intelligence&sid=1711716913&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2129
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WSNK7QFYC8&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:13 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.origininvestigations.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
getcontact
api.chatsupport.co/api/contact/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/contact/getcontact
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,device,device-dimentions,device-platform,stored-time
Access-Control-Request-Method
POST
Origin
https://www.origininvestigations.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,device,device-dimentions,device-platform,stored-time
access-control-allow-methods
OPTIONS, GET, POST, DELETE, PUT, PATCH
access-control-allow-origin
https://www.origininvestigations.com
access-control-max-age
3600
content-length
0
content-type
text/html
date
Fri, 29 Mar 2024 12:55:13 GMT
server
Google Frontend
vary
Origin Accept-Encoding
x-cloud-trace-context
3d843248f45a742ffcc6699ace25bcce
getcontact
api.chatsupport.co/api/contact/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/contact/getcontact
Requested by
Host: app.chatsupport.co
URL: https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
955644d40663d3e894dca0ed1dd6e0a849e92943dc96ea7f21af57caadf6fc25
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
device-platform
web
accept-language
de-DE,de;q=0.9
stored-time
0
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json
Accept
application/json, text/plain, */*
Referer
https://www.origininvestigations.com/
device
web
device-dimentions
{"deviceHeight":600,"deviceWidth":800,"viewPortHeight":1113,"viewPortWidth":1600}
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
Google Frontend
vary
Origin, Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.origininvestigations.com
x-cloud-trace-context
0a86d4772d4f41d544f4385e7b69db92
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
content-length
993
x-xss-protection
1; mode=block
Lato-Regular.woff
storage.googleapis.com/livesupport/chat/fonts/ 		285 KB
286 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/livesupport/chat/fonts/Lato-Regular.woff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::201b Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
UploadServer /
Resource Hash
c3bb58b8b637b23bf0faed29f6038aea0c58215f7bf1508dde14f44ab4882eab

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
Origin
https://www.origininvestigations.com
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:30:44 GMT
age
1469
x-guploader-uploadid
ABPtcPrEZ1PeWTMZumHZ4l7p9r8OtHEqsw98CWZDNCvIXVz3UGPKb_6SaRpC8LnqiI_5hayVALUN4fGrjw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
291928
last-modified
Mon, 06 Jan 2020 12:48:31 GMT
server
UploadServer
etag
"b7018decfda48b3e0257c494ea60c7b4"
x-goog-generation
1578314911182747
x-goog-hash
crc32c=sYwsQg==, md5=twGN7P2kiz4CV8SU6mDHtA==
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
max-age=31536000
x-goog-stored-content-length
291928
accept-ranges
bytes
content-type
application/font-woff
expires
Sat, 29 Mar 2025 12:30:44 GMT
unreadcount
api.chatsupport.co/api/message/visitor/get/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/message/visitor/get/unreadcount
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.origininvestigations.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
OPTIONS, GET, POST, DELETE, PUT, PATCH
access-control-allow-origin
https://www.origininvestigations.com
access-control-max-age
3600
content-length
0
content-type
text/html
date
Fri, 29 Mar 2024 12:55:14 GMT
server
Google Frontend
vary
Origin Accept-Encoding
x-cloud-trace-context
3e2e18b2ad7622052068aad6a914de0a
save
api.chatsupport.co/api/events/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/events/save
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.origininvestigations.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
OPTIONS, GET, POST, DELETE, PUT, PATCH
access-control-allow-origin
https://www.origininvestigations.com
access-control-max-age
3600
content-length
0
content-type
text/html
date
Fri, 29 Mar 2024 12:55:14 GMT
server
Google Frontend
vary
Origin Accept-Encoding
x-cloud-trace-context
00ce24a29e18899232fb0e12e26301ab
unreadcount
api.chatsupport.co/api/message/visitor/get/ 		42 B
154 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/message/visitor/get/unreadcount
Requested by
Host: app.chatsupport.co
URL: https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
407e255d74a20fb7c8b61ecf27acd9f3c9b14e0c410f3ecd436ce2b15b41b213
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json
Accept
application/json, text/plain, */*
Referer
https://www.origininvestigations.com/
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
Google Frontend
vary
Origin, Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.origininvestigations.com
x-cloud-trace-context
4722e4e0e5e244a510cc9da2dfdc1cbc
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
content-length
62
x-xss-protection
1; mode=block
save
api.chatsupport.co/api/events/ 		367 B
363 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/events/save
Requested by
Host: app.chatsupport.co
URL: https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
fdafe9fefaed63d67f83abb9fa73fc45e0cf4810dd83598816758fae5369deb4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json
Accept
application/json, text/plain, */*
Referer
https://www.origininvestigations.com/
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
Google Frontend
vary
Origin, Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.origininvestigations.com
x-cloud-trace-context
9b41da031f63da8af1edaa86e03bcdde
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
content-length
268
x-xss-protection
1; mode=block
get
api.chatsupport.co/api/message/visitor/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/message/visitor/get
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.origininvestigations.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
OPTIONS, GET, POST, DELETE, PUT, PATCH
access-control-allow-origin
https://www.origininvestigations.com
access-control-max-age
3600
content-length
0
content-type
text/html
date
Fri, 29 Mar 2024 12:55:14 GMT
server
Google Frontend
vary
Origin Accept-Encoding
x-cloud-trace-context
58a7a57879412aa66aee67d89d07aa47
get
api.chatsupport.co/api/message/visitor/ 		93 B
186 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/message/visitor/get
Requested by
Host: app.chatsupport.co
URL: https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
95eea2a4b9effe3c0759060eb91b55997751b14f75b8a9c52117a437305032f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json
Accept
application/json, text/plain, */*
Referer
https://www.origininvestigations.com/
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
Google Frontend
vary
Origin, Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.origininvestigations.com
x-cloud-trace-context
8233030e6cb965988eef45873f6aee65
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
content-length
92
x-xss-protection
1; mode=block
settings
api.chatsupport.co/api/client/get/ 		744 B
583 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/client/get/settings
Requested by
Host: app.chatsupport.co
URL: https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
133385906286025df52363077095007ace1bd67cd1969652238aba0bf82db773
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json
Accept
application/json, text/plain, */*
Referer
https://www.origininvestigations.com/
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
Google Frontend
vary
Origin, Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.origininvestigations.com
x-cloud-trace-context
1235e183d340b4e312bed1fd4f5d1b56
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
content-length
489
x-xss-protection
1; mode=block
settings
api.chatsupport.co/api/client/get/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/client/get/settings
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.origininvestigations.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
OPTIONS, GET, POST, DELETE, PUT, PATCH
access-control-allow-origin
https://www.origininvestigations.com
access-control-max-age
3600
content-length
0
content-type
text/html
date
Fri, 29 Mar 2024 12:55:15 GMT
server
Google Frontend
vary
Origin Accept-Encoding
x-cloud-trace-context
d468c0ded8ba3469129d057cb6d4ef9b
bubble-middle-3.svg
storage.googleapis.com/livesupport/chat/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/livesupport/chat/images/bubble-middle-3.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.27 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f27.1e100.net
Software
UploadServer /
Resource Hash
4fcececdc5f31b0247895ece71a7730a127359b3ac5b37bd0b908ffd15af5ce9

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:30:46 GMT
age
1469
x-guploader-uploadid
ABPtcPqVblMnQzVIeCPcY1cpFCRQ7q2rd5RPGzYV-_D-Nd6H-p7YPg5L-SFhSGzXEjBPo21iF7NsaYEGeQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1496
last-modified
Wed, 26 May 2021 08:09:14 GMT
server
UploadServer
etag
"f6dcf0c5d09f8124c49b1110a5cc1516"
x-goog-generation
1622016553994109
x-goog-hash
crc32c=+ik6sg==, md5=9tzwxdCfgSTEmxEQpcwVFg==
access-control-allow-origin
*
content-type
image/svg+xml
cache-control
public, max-age=3600
x-goog-stored-content-length
1496
accept-ranges
bytes
expires
Fri, 29 Mar 2024 13:30:46 GMT
bubble-left.svg
storage.googleapis.com/livesupport/chat/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/livesupport/chat/images/bubble-left.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.27 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f27.1e100.net
Software
UploadServer /
Resource Hash
85f9b9ed60570538bc648193fced4bc26084dd691e97d1b1181ba6046dd6ffe8

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:30:46 GMT
age
1469
x-guploader-uploadid
ABPtcPrJT1GdmMjl5bPdAYewKwPyOh0aZEAFLs65GrkuOSZXuWsrbBkqFrSL_IeahqKVjI6wJft9Rwuz6w
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10251
last-modified
Fri, 02 Apr 2021 05:24:48 GMT
server
UploadServer
etag
"8492f8f46a22ef123b2fa545acf47375"
x-goog-generation
1617341088539137
x-goog-hash
crc32c=C800Ag==, md5=hJL49Goi7xI7L6VFrPRzdQ==
access-control-allow-origin
*
content-type
image/svg+xml
cache-control
public, max-age=3600
x-goog-stored-content-length
10251
accept-ranges
bytes
expires
Fri, 29 Mar 2024 13:30:46 GMT
bubble-right.svg
storage.googleapis.com/livesupport/chat/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/livesupport/chat/images/bubble-right.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.27 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s28-in-f27.1e100.net
Software
UploadServer /
Resource Hash
32ce4a8b13e557143fe6f888d3a526f120acbd53d5cac6b13a5403ed446b7ca8

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://www.origininvestigations.com/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 29 Mar 2024 12:55:15 GMT
age
0
x-guploader-uploadid
ABPtcPoB67a2b0ZxzNhsfiNYVIceUWpzM-ryLeUkN7oeZ_D0jL1RL_sNa532VGMmmm-_oh69W_p-5KoaOQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10621
last-modified
Fri, 02 Apr 2021 05:26:38 GMT
server
UploadServer
etag
"74fac37b4959f4898353d1ba0b6b248f"
x-goog-generation
1617341198421268
x-goog-hash
crc32c=W74+tQ==, md5=dPrDe0lZ9ImDU9G6C2skjw==
access-control-allow-origin
*
content-type
image/svg+xml
cache-control
public, max-age=3600
x-goog-stored-content-length
10621
accept-ranges
bytes
expires
Fri, 29 Mar 2024 13:55:15 GMT
visitor
api.chatsupport.co/api/rtm/subscribe/ 		539 B
382 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/rtm/subscribe/visitor
Requested by
Host: app.chatsupport.co
URL: https://app.chatsupport.co/api/client/get/script/LS-42bf8cb7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
982dd6bc19368c9363115035d46c8093300d563215d28623360820ae5863a911
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json
Accept
application/json, text/plain, */*
Referer
https://www.origininvestigations.com/
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 29 Mar 2024 12:55:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
Google Frontend
vary
Origin, Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.origininvestigations.com
x-cloud-trace-context
b1ab89ce2c6d12f27719dd933a14bbcf
cache-control
private, no-cache, no-store, max-age=0
access-control-allow-credentials
true
content-length
288
x-xss-protection
1; mode=block
visitor
api.chatsupport.co/api/rtm/subscribe/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.chatsupport.co/api/rtm/subscribe/visitor
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.origininvestigations.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
OPTIONS, GET, POST, DELETE, PUT, PATCH
access-control-allow-origin
https://www.origininvestigations.com
access-control-max-age
3600
content-length
0
content-type
text/html
date
Fri, 29 Mar 2024 12:55:15 GMT
server
Google Frontend
vary
Origin Accept-Encoding
x-cloud-trace-context
7f835f9b11031131970ae7fd67e01cf7

Verdicts & Comments Add Verdict or Comment

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| _ls function| _lsAlias object| webpackChunk_heyflow_widget object| reactiveElementVersions object| litHtmlVersions object| litElementVersions object| webpackChunk_N_E function| __next_require__ object| next object| __NEXT_DATA__ function| __SSG_MANIFEST_CB object| __NEXT_P object| _N_E function| applyFocusVisiblePolyfill function| __NEXT_PRELOADREADY object| __MIDDLEWARE_MATCHERS object| __BUILD_MANIFEST object| __SSG_MANIFEST object| webpackChunklschatwidget object| __VUE_INSTANCE_SETTERS__ object| __VUE_SSR_SETTERS__ object| __core-js_shared__ function| Hammer boolean| __VUE_OPTIONS_API__ boolean| __VUE_PROD_HYDRATION_MISMATCH_DETAILS__ boolean| __VUE__ string| GoogleAnalyticsObject function| chatSupportGa object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| dataLayer object| google_tag_manager

8 Cookies

Domain/Path Name / Value
api.fontshare.com/ Name: _fontstore_key
Value: SFMyNTY.g3QAAAABbQAAAAhndWVzdF9pZG0AAAAkNzVmNmE4OGUtOWJlNC00M2FjLWJmZmMtZTBjMzFiODc1NTUw.YbQbxlT8gzCL7bojp0Z35P0FS04uEz8eD1cre3E6Ii0
.origininvestigations.com/ Name: chatsupport
Value: {"LS-42bf8cb7":{"campaignUrl":null,"campaignName":"-","campaignSource":"direct","campaignMedium":"none","referrer":"","createddate":1711716912836}}
.origininvestigations.com/ Name: _ga
Value: GA1.2.808150964.1711716913
.origininvestigations.com/ Name: _gid
Value: GA1.2.711291494.1711716913
.origininvestigations.com/ Name: _gat
Value: 1
.origininvestigations.com/ Name: _ga_WSNK7QFYC8
Value: GS1.2.1711716913.1.0.1711716913.0.0.0
.origininvestigations.com/ Name: LS-42bf8cb7_visitorId
Value: b2bbade8-51f3-4905-9ed6-7f09f443a778
.origininvestigations.com/ Name: LS-42bf8cb7_session
Value: 1711718713962

1 Console Messages

Source Level URL
Text
other warning URL: https://www.origininvestigations.com/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.chatsupport.co
api.fontshare.com
app.chatsupport.co
assets.chatsupport.co
cdn.fontshare.com
fonts.gstatic.com
region1.google-analytics.com
static.heyflow.app
stats.g.doubleclick.net
storage.googleapis.com
u42447169.ct.sendgrid.net
www.google-analytics.com
www.googletagmanager.com
www.origininvestigations.com
13.41.6.241
167.89.115.147
172.217.18.27
2001:4860:4802:34::36
2400:52e0:1e00::1081:1
2a00:1450:4001:806::2013
2a00:1450:4001:80b::200e
2a00:1450:4001:81d::2003
2a00:1450:4001:82a::201b
2a00:1450:4001:830::2008
2a00:1450:400c:c00::9b
35.201.93.133
35.244.173.183
76.76.21.93
00ba7c0592e851a257da77bf54cd0e3394c6e9275e7c3b756eb7a6217b74477b
037862e5206bfa973a54368cfcd1fa693d652a3c092458c582bcf596ef7454d0
06fbd1bb754ebea9ef1152d4bfef2636c00aa547449f33976c65ed6acb028885
133385906286025df52363077095007ace1bd67cd1969652238aba0bf82db773
26014d368796a38f5b6875d699c4ab6612f2ca1c1aabf1b283cbe57cb73ad30e
2dbadbeaeef0e45d2607f4a2d2161424da1459b0a476a6295629e0a17531529a
32ce4a8b13e557143fe6f888d3a526f120acbd53d5cac6b13a5403ed446b7ca8
37adaca49be9073d97356ef088f48826fb5385a5a1ad270b39ac8a74664239b1
38101bc5c3bd55ed51454e0d79304d5c04b655b0d4bb228d778f54f02aab21ed
3bcf04ca301e44f13f404c8a04aa4ae707f67a950e12ef30c238f96e784266a1
407e255d74a20fb7c8b61ecf27acd9f3c9b14e0c410f3ecd436ce2b15b41b213
4fcececdc5f31b0247895ece71a7730a127359b3ac5b37bd0b908ffd15af5ce9
52208453fddad17efb2ec2d98729e18556d6c5b64ad22171f8e8b071802314d3
5c4945f98960a5591e45b5953338e43e0c796f11dede3d712d06c64607664df0
69043caca561604c5d8f500aba975f1c57d6249fbace246a6c000ee85689fdbe
69271f7b00a810fc803f645be704b8594448541c1ade033b0b59bbbb5bf75c2f
694b9d04bb9fe15a79242a653a8f6de8296d7b32c5706a9f7275523889973884
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ead44564d2bf2250ce51ae38ca5ad577b6f400d8c92d001ebad84924db87225
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
84518e007fe253895a812584ab88f40f3627c3a13a1233fe03135313205b8be6
859aac4066b95bac4c5370ae3d54d11ab7c0af0fead75759c94698746f954b8e
85f9b9ed60570538bc648193fced4bc26084dd691e97d1b1181ba6046dd6ffe8
955644d40663d3e894dca0ed1dd6e0a849e92943dc96ea7f21af57caadf6fc25
95eea2a4b9effe3c0759060eb91b55997751b14f75b8a9c52117a437305032f4
9744220669825e30cf973daa43ce8a664962507518cd488b5724c6daa2bf0ac7
982dd6bc19368c9363115035d46c8093300d563215d28623360820ae5863a911
9f97b3ebc3fc90009b42c55347671eb52a2d3c8de175ca898ae52ff8c8fca6f5
aeed54e01b2d31cb2639e7c6cb6dc97063b99f6ac28a2fe59342bb61574164bc
b641ecaaeda27cf0d560bf26058e9bc9997ac7bfdc58414f9df2d4d58a32c34b
c1ffe32946ca1814cbd70dea028c8b3813450d5a41120ecfc79839116a609de8
c3bb58b8b637b23bf0faed29f6038aea0c58215f7bf1508dde14f44ab4882eab
c677b0ef46c4d73635c1a157321ffa2e137ba4cab6ece2dc9737748a3fd26d56
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e2b1007d8b21f97e8aafac87a109266f1500dfddbe895fab6ddd5986a49aba6f
e397e6629f0c68e9b83019d117a612d20765e4198e805d569f3df4b4cf564be6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f2ae26ff518d9519afd2a3dc277d84e098458e6b6b85fa9548cda2bed24435e7
f4e977b80a923bd806448678290b9356a29378f0d1cbf5b7ccd282795db005ef
fdafe9fefaed63d67f83abb9fa73fc45e0cf4810dd83598816758fae5369deb4