go.ceridian.com Open in urlscan Pro
45.60.65.3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=
Effective URL:
https://go.ceridian.com/preference-change-thank-you.html
Submission: On July 14 via manual (July 14th 2021, 6:06:02 am UTC) from NL

Summary HTTP 111 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 28 IPs in 4 countries across 27 domains to perform 111 HTTP transactions. The main IP is 45.60.65.3, located in United States and belongs to INCAPSULA, US. The main domain is go.ceridian.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on January 5th 2021. Valid for: a year.

This is the only time go.ceridian.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	45.60.65.3 45.60.65.3	19551 (INCAPSULA) (INCAPSULA)
6	104.117.217.134 104.117.217.134	16625 (AKAMAI-AS) (AKAMAI-AS)
7	104.16.94.80 104.16.94.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
6	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:26f0:6c0... 2a02:26f0:6c00:28c::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
5	13.224.99.39 13.224.99.39	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6812:1bbe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
8	54.165.186.74 54.165.186.74	14618 (AMAZON-AES) (AMAZON-AES)
4	52.84.193.138 52.84.193.138	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:119:50e1... 2620:119:50e1:101::6cae:b25	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
5	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c09::9c	15169 (GOOGLE) (GOOGLE)
2 2	13.248.242.197 13.248.242.197	16509 (AMAZON-02) (AMAZON-02)
2	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
15	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1 2	34.247.100.44 34.247.100.44	16509 (AMAZON-02) (AMAZON-02)
8	52.20.197.48 52.20.197.48	14618 (AMAZON-AES) (AMAZON-AES)
2	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	192.229.133.208 192.229.133.208	15133 (EDGECAST) (EDGECAST)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
111	28

11 45.60.65.3 (United States)

ASN19551 (INCAPSULA, US)

click.ceridian.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
go.ceridian.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
marketingops.ceridian.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.117.217.134 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-117-217-134.deploy.static.akamaitechnologies.com

templates.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.16.94.80 (United States)

ASN13335 (CLOUDFLARENET, US)

app-sj29.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:28c::25ea (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.224.99.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-99-39.zrh50.r.cloudfront.net

vidassets.terminus.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1bbe (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.165.186.74 (United States)

ASN14618 (AMAZON-AES, US)

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.84.193.138 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-193-138.cdg52.r.cloudfront.net

d26x5ounzdjojj.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:119:50e1:101::6cae:b25 (San Jose, United States) 3 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.174.10.14 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c09::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.242.197 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.247.100.44 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-247-100-44.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.20.197.48 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-197-48.compute-1.amazonaws.com

com-thebigwillow-prod1.collector.snplow.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.133.208 (United States)

ASN15133 (EDGECAST, US)

v.fastcdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	facebook.com www.facebook.com	1 KB
11	marketo.net templates.marketo.net munchkin.marketo.net	112 KB
10	ceridian.com click.ceridian.com go.ceridian.com	225 KB
8	snplow.net com-thebigwillow-prod1.collector.snplow.net	1 KB
8	stackadapt.com tags.srv.stackadapt.com	13 KB
8	facebook.net connect.facebook.net	492 KB
7	marketo.com app-sj29.marketo.com	142 KB
6	linkedin.com 4 redirects px.ads.linkedin.com www.linkedin.com px4.ads.linkedin.com	2 KB
6	bing.com bat.bing.com	19 KB
6	google-analytics.com www.google-analytics.com	40 KB
5	terminus.services vidassets.terminus.services	7 KB
4	cloudfront.net d26x5ounzdjojj.cloudfront.net	220 KB
2	twitter.com analytics.twitter.com	817 B
2	bidr.io 1 redirects match.prod.bidr.io	1 KB
2	t.co t.co	619 B
2	adsrvr.org 2 redirects match.adsrvr.org	1018 B
2	ads-twitter.com static.ads-twitter.com	4 KB
2	g2crowd.com tracking.g2crowd.com	1 KB
2	licdn.com snap.licdn.com	5 KB
2	googletagmanager.com www.googletagmanager.com	116 KB
1	gstatic.com fonts.gstatic.com	31 KB
1	googleapis.com fonts.googleapis.com	737 B
1	fastcdn.co v.fastcdn.co	1 KB
1	google.de www.google.de	107 B
1	google.com www.google.com	110 B
1	doubleclick.net stats.g.doubleclick.net	87 B
1	ceridian.ca marketingops.ceridian.ca	2 KB
111	27

	Domain	Requested by
15	www.facebook.com	go.ceridian.com
9	go.ceridian.com	click.ceridian.com go.ceridian.com marketingops.ceridian.ca
8	com-thebigwillow-prod1.collector.snplow.net	d26x5ounzdjojj.cloudfront.net
8	tags.srv.stackadapt.com	click.ceridian.com tags.srv.stackadapt.com
8	connect.facebook.net	click.ceridian.com connect.facebook.net
7	app-sj29.marketo.com	go.ceridian.com app-sj29.marketo.com
6	bat.bing.com	www.googletagmanager.com bat.bing.com go.ceridian.com
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com go.ceridian.com
6	templates.marketo.net	go.ceridian.com
5	vidassets.terminus.services	www.googletagmanager.com go.ceridian.com
5	munchkin.marketo.net	go.ceridian.com munchkin.marketo.net templates.marketo.net
4	d26x5ounzdjojj.cloudfront.net	click.ceridian.com d26x5ounzdjojj.cloudfront.net
3	px.ads.linkedin.com	3 redirects
2	analytics.twitter.com	static.ads-twitter.com
2	match.prod.bidr.io	1 redirects go.ceridian.com
2	t.co	go.ceridian.com
2	match.adsrvr.org	2 redirects
2	px4.ads.linkedin.com	go.ceridian.com
2	static.ads-twitter.com	click.ceridian.com
2	tracking.g2crowd.com	click.ceridian.com
2	snap.licdn.com	www.googletagmanager.com
2	www.googletagmanager.com	go.ceridian.com
1	fonts.gstatic.com	v.fastcdn.co
1	fonts.googleapis.com	go.ceridian.com
1	v.fastcdn.co	go.ceridian.com
1	www.google.de	go.ceridian.com
1	www.google.com	go.ceridian.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	www.linkedin.com	1 redirects
1	marketingops.ceridian.ca	go.ceridian.com
1	click.ceridian.com
111	31

This site contains links to these domains. Also see Links.

Domain
www.ceridian.com

Subject Issuer	Validity	Valid
*.ceridian.com DigiCert TLS RSA SHA256 2020 CA1	`2021-01-05` - `2022-02-05`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
app-sj29.marketo.com Cloudflare Inc ECC CA-3	`2021-06-07` - `2022-06-06`	a year	crt.sh
marketingops.ceridian.ca DigiCert SHA2 Extended Validation Server CA	`2020-05-26` - `2022-06-06`	2 years	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2021-04-12` - `2021-10-12`	6 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-04-30` - `2022-05-11`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-05-26` - `2021-08-24`	3 months	crt.sh
*.terminus.services Amazon	`2020-12-16` - `2022-01-14`	a year	crt.sh
*.g2crowd.com Sectigo ECC Domain Validation Secure Server CA	`2020-08-30` - `2021-09-28`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.srv.stackadapt.com Amazon	`2020-12-09` - `2022-01-07`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-04-15` - `2021-10-15`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.match.prod.bidr.io Amazon	`2021-02-26` - `2022-03-27`	a year	crt.sh
com-thebigwillow-prod1.collector.snplow.net Amazon	`2021-01-13` - `2022-02-10`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
v.fastcdn.co DigiCert TLS RSA SHA256 2020 CA1	`2021-05-11` - `2022-05-16`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://go.ceridian.com/preference-change-thank-you.html
Frame ID: F87382ED0ABF5DEBCC38838D6388615D
Requests: 104 HTTP requests in this frame

Frame: https://app-sj29.marketo.com/index.php/form/XDFrame
Frame ID: C2ACB8785B6EB14EC3EA73B92F6315DA
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp... Page URL
https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZK... Page URL
https://go.ceridian.com/preference-change-thank-you.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Page Statistics

111
Requests

99 %
HTTPS

50 %
IPv6

27
Domains

31
Subdomains

28
IPs

4
Countries

1435 kB
Transfer

3671 kB
Size

22
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ceridian.com/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.ceridian.com/terms
Title: Terms

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU= Page URL
https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt Page URL
https://go.ceridian.com/preference-change-thank-you.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 17

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242743556&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D56607%26time%3D1626242743556%26url%3Dhttps%253A%252F%252Fgo.ceridian.com%252Foneclick-unsubscribe.html%253Fmkt_unsubscribe%253D1%2526mkt_tok%253DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242743556&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242743556&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&liSync=true&e_ipv6=AQKX7aDmQFok9AAAAXqjnv7mnFBG9sXb7cAoVFtufZ6ZSBUcFJEyXiyTHi3dHtdystWJUd6i

Request Chain 24

https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=5459c7af-9b57-4287-bdbe-e596cdb9f7ec|49d93f30-0738-468c-8b9d-b99d63225e11 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=5459c7af-9b57-4287-bdbe-e596cdb9f7ec|49d93f30-0738-468c-8b9d-b99d63225e11 HTTP 302
https://vidassets.terminus.services/s.gif?d=5459c7af-9b57-4287-bdbe-e596cdb9f7ec|49d93f30-0738-468c-8b9d-b99d63225e11&t=1d4493ff-7ef3-4a16-a557-1618843bbfe7

Request Chain 31

https://match.prod.bidr.io/cookie-sync/tbw HTTP 303
https://match.prod.bidr.io/cookie-sync/tbw?_bee_ppp=1

Request Chain 87

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242746062&url=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242746062&url=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&e_ipv6=AQLCg2Fpo6BEeAAAAXqjnwc4U5g66gbpkHr0FBLW_0Dyn1imvCCD0AS_-OpaC6i2j-Dj-SUv

111 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=
click.ceridian.com/ 508 B
2 KB 307ms
250ms Document
text/html 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Host: click.ceridian.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private, no-cache, no-store, max-age=0
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
Set-Cookie: BIGipServersj_mailtracking_http=!x6g3G/RZxbAQMPumfApvaf9MEhiEHcOxpPYGS59Cc87bCgZt3T7YN/EGHWMOoFTuzgyHMM2fKx2FkkY=; path=/; Httponly; Secure __cf_bm=e16fc626ce588a7f80ef1a3f9340ff4759ee2e66-1626242742-1800-AcfbysObu6ieoMxDrFkD1yr25sOMMjAqxO2C7XOi3CIZOPDrMi3cSbrHiaGYJDY0z05RtSDnBXa/GJRj5neOCQg=; path=/; expires=Wed, 14-Jul-21 06:35:42 GMT; domain=.click.ceridian.com; HttpOnly; Secure; SameSite=None visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; expires=Wed, 13 Jul 2022 13:25:20 GMT; HttpOnly; path=/; Domain=.ceridian.com; Secure; SameSite=None nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; path=/; Domain=.ceridian.com; Secure; SameSite=None incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; path=/; Domain=.ceridian.com; Secure; SameSite=None
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 66e88f963d3fee5c-CDG
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-CDN: Imperva
X-Iinfo: 7-1908704-1908713 NNNN CT(1 16 0) RT(1626242742341 42) q(0 0 1 0) r(3 3) U12

GET
H/1.1 200
OK Cookie set oneclick-unsubscribe.html Show response
go.ceridian.com/ 2 KB
3 KB 423ms
406ms Document
text/html 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt

Requested by

Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

007c00dbfcdbfee461e9ccca651fe3f85007a5a83acd692b6dd39e556cc5df8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Host: go.ceridian.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://click.ceridian.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://click.ceridian.com/

Response headers

Date: Wed, 14 Jul 2021 06:05:43 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3p: CP="CAO CURa ADMa DEVa TAIa OUR IND UNI COM NAV INT"
Vary: *,Accept-Encoding
X-Content-Type-Options: nosniff
Set-Cookie: BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=;Path=/;Version=1;Secure;Httponly __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; path=/; expires=Wed, 14-Jul-21 06:35:43 GMT; domain=.go.ceridian.com; HttpOnly; Secure; SameSite=None visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; expires=Wed, 13 Jul 2022 12:36:16 GMT; HttpOnly; path=/; Domain=.ceridian.com; Secure; SameSite=None nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; path=/; Domain=.ceridian.com; Secure; SameSite=None incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==; path=/; Domain=.ceridian.com; Secure; SameSite=None
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 66e88f9868b59bdf-AMS
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-CDN: Imperva
X-Iinfo: 5-5035159-5035161 NNNN CT(7 21 0) RT(1626242742204 10) q(0 0 0 0) r(4 4) U5

GET
H/1.1 200
OK jquery.min.js Show response
templates.marketo.net/template1/js/ 91 KB
32 KB 35ms
17ms Script
application/x-javascript 104.117.217.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://templates.marketo.net/template1/js/jquery.min.js
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.117.217.134 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-217-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c3a7b608ebfa8d1dfe658bc119e6236a6aaf878a779e7c560aa11dd30881a56a

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:43 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 May 2015 00:15:45 GMT
Server: AkamaiNetStorage
ETag: "841dc30647f93349b7d8ef61deebe411:1432772145"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32822

GET
H2 200 forms2.min.js Show response
app-sj29.marketo.com/js/forms2/js/ 204 KB
68 KB 72ms
26ms Script
application/x-javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj29.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 18 Jun 2021 20:07:07 GMT
server: cloudflare
age: 4172
etag: "16a03b9-33187-5c50fde38d0c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 66e88f9b1cf2ee3b-CDG
expires: Wed, 14 Jul 2021 10:05:43 GMT

GET
H2 200 mkto-preference-center-oc-unsubscribe.js Show response
marketingops.ceridian.ca/mkto/mkto-preference-center/ 859 B
2 KB 562ms
373ms Script
application/x-javascript 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://marketingops.ceridian.ca/mkto/mkto-preference-center/mkto-preference-center-oc-unsubscribe.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

1f5ef4a6099e359413e336775a92a596b105a570a340a881f2ca9ce1224a7498

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAME-ORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-iinfo: 5-2689042-2682745 2NNN RT(1626242743323 0) q(0 0 0 1) r(3 3) U2
content-length: 603
x-xss-protection: 1; mode=block
pragma: no-cache
x-cdn: Imperva
last-modified: Fri, 19 Feb 2021 19:59:54 GMT
server: Microsoft-IIS/10.0
x-frame-options: SAME-ORIGIN
date: Wed, 14 Jul 2021 06:05:43 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public,max-age=604800,no-cache, no-store, must-revalidate, pre-check=0, post-check=0, max-age=0, s-maxage=0
etag: "8bab92caf96d71:0"
accept-ranges: bytes
expires: 0

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net// 1 KB
1 KB 27ms
26ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net//munchkin.js
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:43 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 May 2021 01:40:41 GMT
Server: AkamaiNetStorage
ETag: "5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H/1.1 200
OK stripmkttok.js Show response
go.ceridian.com/js/ 2 KB
1 KB 34ms
33ms Script
application/x-javascript 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://go.ceridian.com/js/stripmkttok.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: go.ceridian.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=; __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==
Connection: keep-alive
Referer: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:43 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
CF-Cache-Status: HIT
X-CDN: Imperva
Age: 1669
X-Iinfo: 5-5035159-5035161 ENNN RT(1626242742204 426) q(0 0 0 -1) r(0 0) U5
Connection: keep-alive
Content-Length: 678
Last-Modified: Fri, 18 Jun 2021 20:07:07 GMT
Server: cloudflare
ETag: "16403ee-602-5c50fde38d0c0"
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/x-javascript
Cache-Control: public, max-age=14400
Accept-Ranges: bytes
CF-RAY: 66e88f9ad9169bdf-AMS
Expires: Wed, 14 Jul 2021 10:05:43 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 196 KB
58 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

75582afe1c0f748de4c68c6765b14151347d08c5aa3f24b04e914cece76ac3c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:43 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59481
x-xss-protection: 0
expires: Wed, 14 Jul 2021 06:05:43 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 897
date: Wed, 14 Jul 2021 05:50:46 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Wed, 14 Jul 2021 07:50:46 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 30 KB
9 KB 29ms
29ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 73e2e5173ed0d5a77b02914fa0ef1f67bb53143da75f0348f558f95565220ca1

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:42 GMT
content-encoding: gzip
last-modified: Fri, 28 May 2021 20:25:24 GMT
x-msedge-ref: Ref A: A98B791BBBE54B26A25CA9CE5BD25FF9 Ref B: FRAEDGE1512 Ref C: 2021-07-14T06:05:43Z
etag: "0d2a696ff53d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 9008

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 11ms
11ms Script
application/x-javascript 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:43 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Jun 2021 01:25:13 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=71555
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2079

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 95 KB
24 KB 9ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0d17b8a38d3dce6f7357bbc8da105d92c21b6cf1c4b92351ce2b1861b065f2c5

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 24676
x-xss-protection: 0
pragma: public
x-fb-debug: jpey/tP5DeqbzgkV/+Y4a9HKvGf01/w55UqxSwXl0FPsP4oMA+zvZL1XDpHReSsieLHXkZO/lNBlyAh8+IWRNg==
x-fb-trip-id: 686109401
x-frame-options: DENY
date: Wed, 14 Jul 2021 06:05:43 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 t.js Show response
vidassets.terminus.services/5459c7af-9b57-4287-bdbe-e596cdb9f7ec/ 4 KB
2 KB 57ms
17ms Script
application/javascript 13.224.99.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vidassets.terminus.services/5459c7af-9b57-4287-bdbe-e596cdb9f7ec/t.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.99.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-99-39.zrh50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

0e4b8d24a97bf67e39fcebe6b138ff9db6a5a01b38b3f2d2d2ab0ee90f44a729

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 05:50:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 929
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Thu, 17 Jun 2021 21:36:07 GMT
server: nginx/1.10.3 (Ubuntu)
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript;charset=utf-8
via: 1.1 4e0fd86f7afa735e772d6f7fe5e91f5b.cloudfront.net (CloudFront)
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: ZRH50-C1
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: -1hYX4FRNnR9VeecbhiOQ2D04mtWoUX4M2K2XUuWDYRLIdO6fTkvLA==

GET
H2 200 80.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 16 B
1 KB 187ms
164ms Script
text/javascript 2606:4700::6812:1bbe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/80.js?p=https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&e=

Requested by

Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1bbe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:43 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
content-encoding: br
x-xss-protection: 1; mode=block
x-request-id: 9c19c73d-d8f6-4d1d-815b-10c84b98106e
x-runtime: 0.008373
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=604800
x-download-options: noopen
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray: 66e88f9b490405d0-FRA

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 31ms
6ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:43 GMT
via: 1.1 varnish
last-modified: Mon, 12 Jul 2021 21:25:31 GMT
age: 21520
etag: "65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1626242744.570453,VS0,VE0
x-served-by: cache-fra19123-FRA

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 13 KB
5 KB 408ms
102ms Script
text/javascript 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: ca85907595c81e151acf1dcc1fb2f6bba9aa046640d12bde12fdac17dc81c986

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 14 Jul 2021 06:05:43 GMT
Content-Encoding: gzip
Cache-Control: max-age=30
Content-Length: 4437
Connection: keep-alive
Content-Type: text/javascript

GET
H/1.1 200
OK tbw_analytics_v1.0.js Show response
d26x5ounzdjojj.cloudfront.net/tbw/ 12 KB
12 KB 70ms
22ms Script
application/javascript 52.84.193.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8
Requested by: Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.193.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-193-138.cdg52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 09fdb2959efa7f317724a5762ad6dd73d941613bfd3764ed8be04ddbc4338b4b

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Jul 2021 21:07:42 GMT
Via: 1.1 a5b64a1ac22cdce92ad57684d05480be.cloudfront.net (CloudFront)
Last-Modified: Tue, 24 Mar 2020 04:06:51 GMT
Server: AmazonS3
Age: 32282
ETag: "463d5912885bbaf6257aaac2e9d8935e"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: CDG52-P1
Accept-Ranges: bytes
Content-Length: 11917
X-Amz-Cf-Id: SXBP1MiK6tptlcS0rTlEonb_dCafatcEmyFEdRViLk_f9n1iJ_c5_Q==

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242743556&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKn...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D56607%26time%3D1626242743556%26url%3Dhttps%253A%252F%252Fgo.ceridian.com%252Fonec...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242743556&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKn...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242743556&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZK...

0
63 B

382ms
382ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242743556&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&liSync=true&e_ipv6=AQKX7aDmQFok9AAAAXqjnv7mnFBG9sXb7cAoVFtufZ6ZSBUcFJEyXiyTHi3dHtdystWJUd6i
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-edc2
content-type: application/javascript
content-length: 0
x-li-uuid: lnH03CiTkRawFQpySisAAA==

Redirect headers

date: Wed, 14 Jul 2021 06:05:44 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242743556&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&liSync=true&e_ipv6=AQKX7aDmQFok9AAAAXqjnv7mnFBG9sXb7cAoVFtufZ6ZSBUcFJEyXiyTHi3dHtdystWJUd6i
x-li-proto: http/2
x-li-pop: prod-esv5
content-length: 0
x-li-uuid: 302v0yiTkRawvp3nqyoAAA==

GET
H3-29 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
882 B 18ms
14ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:02:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 165
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Wed, 14 Jul 2021 07:02:58 GMT

GET
H3-29 200 333347490424190 Show response
connect.facebook.net/signals/config/ 260 KB
74 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/333347490424190?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9cb4ff0846a38ebd8470fd80247ed90430ffe4072164fed4f5eb101123ace2a0

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 75651
x-xss-protection: 0
pragma: public
x-fb-debug: B75xCLBN3iDaj0IwCRSzvPmved++b2ep5Rbz9hJCrJ8YEVQ2IjjsyJo1JXncYKBgkQ/T9fWe3IhlRo9A06tUSg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 14 Jul 2021 06:05:43 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 getForm Show response
app-sj29.marketo.com/index.php/form/ 4 KB
2 KB 665ms
664ms Script
application/javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj29.marketo.com/index.php/form/getForm?munchkinId=285-SCZ-328&form=1191&url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html&callback=jQuery112403711106355642173_1626242743590&_=1626242743591

Requested by

Host: app-sj29.marketo.com
URL: https://app-sj29.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ac8b9ca26c489b803659ad5eb1da8b938b45b5e0d2bbc522984ea045298114a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=63113904
cf-ray: 66e88f9b9da4ee3b-CDG
cached: false

GET
H2 204 26082856.js Show response
bat.bing.com/p/action/ 0
117 B 146ms
145ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/26082856.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 14 Jul 2021 06:05:43 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: EDFF58CA598D44FDBA89F6B58A0FC53F Ref B: FRAEDGE1512 Ref C: 2021-07-14T06:05:43Z
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
87 B 16ms
16ms XHR
text/plain 2a00:1450:400c:c09::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-4372550-2&cid=329137014.1626242744&jid=313257320&gjid=950985798&_gid=667563826.1626242744&_u=aGBAgEAjAAAAAE~&z=405086052

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 14 Jul 2021 06:05:43 GMT
content-type: text/plain
access-control-allow-origin: https://go.ceridian.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j91&a=677185080&t=pageview&_s=1&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&dr=https%3A%2F%2Fclick.ceridian.com%2F&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgEAj~&jid=313257320&gjid=950985798&cid=329137014.1626242744&tid=UA-4372550-2&_gid=667563826.1626242744&gtm=2wg7c05J9G99C&cd2=Non-Customer&cd5=8&cd6=Wednesday&z=675954818

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jul 2021 02:07:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 14273
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

s.gif
vidassets.terminus.services/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=5459c7af-9b57-4287-bdbe-e596cdb9f7ec|49d93f30-0738-468c-8b9d-b99d63225e11
https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=5459c7af-9b57-4287-bdbe-e596cdb9f7ec|49d93f30-0738-468c-8b9d-b99d63225e11
https://vidassets.terminus.services/s.gif?d=5459c7af-9b57-4287-bdbe-e596cdb9f7ec|49d93f30-0738-468c-8b9d-b99d63225e11&t=1d4493ff-7ef3-4a16-a557-1618843bbfe7

42 B
682 B

17ms
17ms

Image
image/gif

13.224.99.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vidassets.terminus.services/s.gif?d=5459c7af-9b57-4287-bdbe-e596cdb9f7ec|49d93f30-0738-468c-8b9d-b99d63225e11&t=1d4493ff-7ef3-4a16-a557-1618843bbfe7

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.99.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-99-39.zrh50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:02:46 GMT
via: 1.1 4e0fd86f7afa735e772d6f7fe5e91f5b.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 182
x-cache: Hit from cloudfront
content-length: 42
last-modified: Thu, 17 Jun 2021 21:36:07 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: ZRH50-C1
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: KoFEwfARzXs6rJaNQmLlu3hTsvUU6fCV6naO4BkjJAH9IByijfZs7Q==

Redirect headers

pragma: no-cache
date: Wed, 14 Jul 2021 06:05:43 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://vidassets.terminus.services/s.gif?d=5459c7af-9b57-4287-bdbe-e596cdb9f7ec|49d93f30-0738-468c-8b9d-b99d63225e11&t=1d4493ff-7ef3-4a16-a557-1618843bbfe7
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 343

GET
H2 200 t.gif
vidassets.terminus.services/5459c7af-9b57-4287-bdbe-e596cdb9f7ec/ 42 B
691 B 18ms
17ms Image
image/gif 13.224.99.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vidassets.terminus.services/5459c7af-9b57-4287-bdbe-e596cdb9f7ec/t.gif?d=49d93f30-0738-468c-8b9d-b99d63225e11&s=b9fdf72c-0ed7-460b-8145-f977de55e6a2&p=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&cb=1626242743621

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.99.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-99-39.zrh50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 05:50:15 GMT
via: 1.1 4e0fd86f7afa735e772d6f7fe5e91f5b.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 928
x-cache: Hit from cloudfront
content-length: 42
last-modified: Thu, 17 Jun 2021 21:36:07 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: ZRH50-C1
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: 2bij0HfxJcSkw8kRQYV7JODE_AsWOnuSVtkA_1tIiIp-CicMaJpIlA==

GET
H2 200 adsct
t.co/i/ 43 B
454 B 129ms
113ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nxv1h&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 14 Jul 2021 06:05:43 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: d246c3fe8bfb75084a8ca742af673af374c0e8230d7c419075186df8142fac89
x-transaction: 34ec18acaf98ed02
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-29 200 1066230166811859 Show response
connect.facebook.net/signals/config/ 260 KB
74 KB 11ms
10ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1066230166811859?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

56271e1d11fc115698bb49be84ea7e56b958703b45913481bec2b5dd741c96eb

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 75599
x-xss-protection: 0
pragma: public
x-fb-debug: B/3T0Tabz14PIiMYuVMzbOk9IOkf3tSBvyxRCzVanuui9Jdy9jYevdLXAmuzN7qeiq8Q58sUwet+NZ4xrTE6vw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 14 Jul 2021 06:05:43 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 9ms
9ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=333347490424190&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242743640&sw=1600&sh=1200&v=2.9.43&r=stable&ec=0&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:43 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Wed, 14 Jul 2021 06:05:43 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
110 B 22ms
22ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-4372550-2&cid=329137014.1626242744&jid=313257320&_u=aGBAgEAjAAAAAE~&z=2146796478

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jul 2021 06:05:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 23ms
22ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-4372550-2&cid=329137014.1626242744&jid=313257320&_u=aGBAgEAjAAAAAE~&z=2146796478

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jul 2021 06:05:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tbw Show response
match.prod.bidr.io/cookie-sync/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/tbw
https://match.prod.bidr.io/cookie-sync/tbw?_bee_ppp=1

44 B
656 B

32ms
31ms

Script
application/javascript

34.247.100.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync/tbw?_bee_ppp=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.247.100.44 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-247-100-44.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

f2e953aa24359d5a94e55040ed454c32c2bf2caa98da4be6e8fc77f356f6671d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:43 GMT
x-content-type-options: nosniff
Server: nginx
Connection: keep-alive
Content-Length: 44
strict-transport-security: max-age=2592000; includeSubDomains
content-type: application/javascript

Redirect headers

location: https://match.prod.bidr.io/cookie-sync/tbw?_bee_ppp=1
Date: Wed, 14 Jul 2021 06:05:43 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H3-29 200 321786608898478 Show response
connect.facebook.net/signals/config/ 260 KB
74 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/321786608898478?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ee1814b597ec6e24b94fc0d55a38fe38a25c3823d801fe9fc7e9eae0218c92c3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 75678
x-xss-protection: 0
pragma: public
x-fb-debug: HaYmzVL6UE8geqNVc5mr7EX664JDdi3iJj1j+lTXZDuKdud0yQqMqjkZhcOKdvYVw3cR9zyPmEXFMvYiM4tgGA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 14 Jul 2021 06:05:43 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 9ms
9ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1066230166811859&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242743677&sw=1600&sh=1200&v=2.9.43&r=stable&ec=0&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&rqm=GET

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:43 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:43 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=321786608898478&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242743704&sw=1600&sh=1200&v=2.9.43&r=stable&ec=0&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&rqm=GET

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:43 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:43 GMT

GET
H/1.1 200
OK pista.js Show response
d26x5ounzdjojj.cloudfront.net/2.14.0/ 98 KB
98 KB 23ms
23ms Script
application/javascript 52.84.193.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d26x5ounzdjojj.cloudfront.net/2.14.0/pista.js
Requested by: Host: d26x5ounzdjojj.cloudfront.net
URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.193.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-193-138.cdg52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 10deca523f2d7d41a77738b61b503fb9ec9f7c8e5f96d34b4e760f7ab807983a

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Jul 2021 23:40:53 GMT
Via: 1.1 a5b64a1ac22cdce92ad57684d05480be.cloudfront.net (CloudFront)
Last-Modified: Thu, 06 Aug 2020 17:08:18 GMT
Server: AmazonS3
Age: 23091
ETag: "8f4885b5f0517e98f2ecf6c734d1decd"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: CDG52-P1
Accept-Ranges: bytes
Content-Length: 100013
X-Amz-Cf-Id: ccRM2M9fnFQuqbWQRvG0SLaPYnN9vSsyGrmZAMmUJ4c0mA42BmFcYw==

OPTIONS
H2 200 tp2
com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/ Frame 0
0 309ms
103ms Preflight 52.20.197.48
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Server: 52.20.197.48 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-197-48.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://go.ceridian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
content-length: 0
access-control-allow-origin: https://go.ceridian.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-max-age: 5
server: akka-http/10.1.12

POST
H2 200 tp2 Show response
com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/ 2 B
328 B 307ms
102ms XHR
text/plain 52.20.197.48
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/tp2
Requested by: Host: d26x5ounzdjojj.cloudfront.net
URL: https://d26x5ounzdjojj.cloudfront.net/2.14.0/pista.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.197.48 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-197-48.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://go.ceridian.com
date: Wed, 14 Jul 2021 06:05:44 GMT
access-control-allow-credentials: true
server: akka-http/10.1.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
content-length: 2
content-type: text/plain; charset=UTF-8

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 83 B
310 B 100ms
99ms Stylesheet
text/css 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 7db8db403268a3d02b08ac151a519e2fb02ce6e9ce19e67fd10d57396e81e17e

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 14 Jul 2021 06:05:44 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 83
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 0
881 B 396ms
99ms Fetch
image/jpeg 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 14 Jul 2021 06:05:44 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/160/ 11 KB
5 KB 25ms
25ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/160/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net//munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:44 GMT
Content-Encoding: gzip
Last-Modified: Fri, 19 Feb 2021 02:54:38 GMT
Server: AkamaiNetStorage
ETag: "19a9335fd71267d56e65bc19390f3100:1613703278.138281"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4811
Expires: Fri, 22 Oct 2021 06:05:44 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
659 B 134ms
118ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.1&p_id=Twitter&p_user_id=0&txn_id=nxv1h&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 14 Jul 2021 06:05:44 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: c2aa7b7afc19239b433a588c1683c13f1cf02c6859b22d3f6b20640ce0c4b823
x-transaction: 8a03d767a4193d8b
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
95 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=26082856&tm=gtm001&Ver=2&mid=cd3b1ebe-212e-41a2-982f-09d36a458fad&sid=86487d30e46911eb8bdc1116c5b50928&vid=86488630e46911ebb445c923785c447a&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&p=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&r=https%3A%2F%2Fclick.ceridian.com%2F&lt=1003&evt=pageLoad&msclkid=N&sv=1&rn=960983
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1&mkt_tok=Mjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 14 Jul 2021 06:05:43 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: C0A7E8FB2F4E47C4AC3E5C7E6773F2DF Ref B: FRAEDGE1512 Ref C: 2021-07-14T06:05:44Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 forms2.css
app-sj29.marketo.com/js/forms2/css/ 13 KB
3 KB 29ms
29ms Stylesheet
text/css 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj29.marketo.com/js/forms2/css/forms2.css

Requested by

Host: app-sj29.marketo.com
URL: https://app-sj29.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6168
content-length: 2623
last-modified: Fri, 18 Jun 2021 20:07:07 GMT
server: cloudflare
etag: "16c03a4-3437-5c50fde38d0c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 66e88f9fc9e0ee3b-CDG
expires: Wed, 14 Jul 2021 10:05:44 GMT

GET
H2 200 forms2-theme-simple.css
app-sj29.marketo.com/js/forms2/css/ 826 B
332 B 33ms
33ms Stylesheet
text/css 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj29.marketo.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: app-sj29.marketo.com
URL: https://app-sj29.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1073
vary: Accept-Encoding
content-length: 242
last-modified: Fri, 18 Jun 2021 20:07:07 GMT
server: cloudflare
etag: "16c03a2-33a-5c50fde38d0c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 66e88f9fc9e1ee3b-CDG
expires: Wed, 14 Jul 2021 10:05:44 GMT

GET
H2 200 XDFrame Show response
app-sj29.marketo.com/index.php/form/ Frame C2AC 2 KB
861 B 199ms
199ms Document
text/html 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj29.marketo.com/index.php/form/XDFrame

Requested by

Host: app-sj29.marketo.com
URL: https://app-sj29.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5404ebe573d9956d980bbff3612a582f2a3e4f38dba55e3f9eac39ac9bfefce0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: app-sj29.marketo.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://go.ceridian.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cf_bm=a3a4ccc17a7d98d55b6098be5866122f3a4dce7e-1626242743-1800-ARzZdQUckqaoWGCDULuuf4/wpzf0DwKsXSHIKzH0MUyF4nNwjGsL7kg25rtayHQh26pG3I66DzGbQmLLEg3gDwo=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.ceridian.com/

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
content-type: text/html; charset=utf-8
content-length: 651
cache-control: max-age=3600
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
set-cookie: BIGipServersj29web-nginx-app_https=!+R6oO3mdNlVE+GumfApvaf9MEhiEHfUthVUM1RsoJxkLQxVyTbizcOEYLPe7x+9WTvo4YXcZZeP04vA=;Path=/;Version=1;Secure;Httponly
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 66e88fa03a51ee3b-CDG

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 94 B
397 B 100ms
100ms XHR
text/plain 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=kSPvt411qnIpJGK2dJvYOg&is_js=true&landing_url=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1%26mkt_tok%3DMjg1LVNDWi0zMjgAAAF-PwZKnbv1OIEMx4ApLyN9D-0k7G70kiUarFbp_nEuKmM5FOlmkSgqp0jHjIyOpvlhpgaxuyCNFdMDv-5E_fqnqPOPxf2CY1wgGYg68QVU0kHt&t=&host=https://go.ceridian.com&sa_conv_data_css_value=%20%220-f8c4ca7a-a65a-493e-5896-5c4bf65db72e%24ip%24185.230.127.84%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd92bc72b8460a442624736201f775ecf8ab9e67f54
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:44 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://go.ceridian.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 94

POST
H2 200 tp2 Show response
com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/ 2 B
327 B 103ms
103ms XHR
text/plain 52.20.197.48
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/tp2
Requested by: Host: d26x5ounzdjojj.cloudfront.net
URL: https://d26x5ounzdjojj.cloudfront.net/2.14.0/pista.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.197.48 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-197-48.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://go.ceridian.com
date: Wed, 14 Jul 2021 06:05:44 GMT
access-control-allow-credentials: true
server: akka-http/10.1.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
content-length: 2
content-type: text/plain; charset=UTF-8

OPTIONS
H2 200 tp2
com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/ Frame 0
0 102ms
102ms Preflight 52.20.197.48
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Server: 52.20.197.48 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-197-48.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://go.ceridian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
content-length: 0
access-control-allow-origin: https://go.ceridian.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-max-age: 5
server: akka-http/10.1.12

GET
H2 200 forms2.min.js Show response
app-sj29.marketo.com/js/forms2/js/ Frame C2AC 204 KB
68 KB 26ms
25ms Script
application/x-javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj29.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: app-sj29.marketo.com
URL: https://app-sj29.marketo.com/index.php/form/XDFrame

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://app-sj29.marketo.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 18 Jun 2021 20:07:07 GMT
server: cloudflare
age: 4173
etag: "16a03b9-33187-5c50fde38d0c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 66e88fa18bb9ee3b-CDG
expires: Wed, 14 Jul 2021 10:05:44 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=333347490424190&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242744604&sw=1600&sh=1200&v=2.9.43&r=stable&ec=1&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:44 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1066230166811859&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242744605&sw=1600&sh=1200&v=2.9.43&r=stable&ec=1&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:44 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 8ms
8ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=321786608898478&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242744606&sw=1600&sh=1200&v=2.9.43&r=stable&ec=1&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:44 GMT

POST
H2 200 save2 Show response
app-sj29.marketo.com/index.php/leadCapture/ Frame C2AC 93 B
388 B 678ms
678ms XHR
application/json 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-sj29.marketo.com/index.php/leadCapture/save2
Requested by: Host: app-sj29.marketo.com
URL: https://app-sj29.marketo.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e70f07b3a5eef58eb16a158084471795dc268ec5eb1f3b57561e371afa13e3cd

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://app-sj29.marketo.com/index.php/form/XDFrame
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 14 Jul 2021 06:05:45 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json;charset=utf-8
access-control-allow-origin: *
x-form-service-request-id: fd18#17aa39f01b3
x-marketo-source: Form Service
cf-ray: 66e88fa1dc12ee3b-CDG

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=333347490424190&ev=Microdata&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242745143&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.43&r=stable&ec=2&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&es=automatic&tm=3&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:45 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:45 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1066230166811859&ev=Microdata&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242745181&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.43&r=stable&ec=2&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&es=automatic&tm=3&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:45 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:45 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=321786608898478&ev=Microdata&dl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&rl=https%3A%2F%2Fclick.ceridian.com%2F&if=false&ts=1626242745206&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.43&r=stable&ec=2&o=30&fbp=fb.1.1626242743639.519264168&it=1626242743584&coo=false&es=automatic&tm=3&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:45 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:45 GMT

GET
H/1.1 200
OK Primary Request preference-change-thank-you.html Show response
go.ceridian.com/ 11 KB
4 KB 351ms
351ms Document
text/html 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://go.ceridian.com/preference-change-thank-you.html

Requested by

Host: marketingops.ceridian.ca
URL: https://marketingops.ceridian.ca/mkto/mkto-preference-center/mkto-preference-center-oc-unsubscribe.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84a9f1c843897c262dfae57a3bd3bebd1755319f72a66c68e1b28c2df8450143

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Host: go.ceridian.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=; __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==; _gcl_au=1.1.266603597.1626242744; gtmCustomerProgression=Non-Customer; _ga=GA1.2.329137014.1626242744; _gid=GA1.2.667563826.1626242744; _dc_gtm_UA-4372550-2=1; d-a8e6=49d93f30-0738-468c-8b9d-b99d63225e11; s-9da4=b9fdf72c-0ed7-460b-8145-f977de55e6a2; _fbp=fb.1.1626242743639.519264168; tbw_bw_uid=bito.AADEkk7B3P0AADaMJim9cw; tbw_bw_sd=1626242744; _sp_ses.c8c1=*; _sp_id.c8c1=9764b551-af92-4d87-8a30-d419b9b95eb2.1626242744.1.1626242744.1626242744.d17534a7-c235-4b67-80c3-f6a7d4c17bf4; _uetsid=86487d30e46911eb8bdc1116c5b50928; _uetvid=86488630e46911ebb445c923785c447a
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://go.ceridian.com/oneclick-unsubscribe.html?mkt_unsubscribe=1

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: stale-while-revalidate=60, max-age=300, public
P3p: CP="CAO CURa ADMa DEVa TAIa OUR IND UNI COM NAV INT"
Vary: *,Accept-Encoding
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 66e88fa62abe9bdf-AMS
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-CDN: Imperva
X-Iinfo: 5-5035159-5035161 ENNN RT(1626242742204 2240) q(0 0 0 -1) r(3 3) U5

POST 0
bat.bing.com/actionp/ 0
0

GET
H/1.1 200
OK bootstrap.css
templates.marketo.net/template1/css/ 138 KB
21 KB 13ms
12ms Stylesheet
text/css 104.117.217.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://templates.marketo.net/template1/css/bootstrap.css
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.117.217.134 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-217-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 May 2015 00:16:12 GMT
Server: AkamaiNetStorage
ETag: "2183d05f5a0a9a3b2e8cb0509ca363e3:1432772172"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20801

GET
H2 200 css
v.fastcdn.co/f/ 13 KB
1 KB 107ms
42ms Stylesheet
text/css 192.229.133.208
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://v.fastcdn.co/f/css?family=Muli%3A200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset=latin%2Clatin-ext

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.133.208 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ESF /

Resource Hash

17a08dc345dfd79e1e5f01a0423bcb275e4cbc38390b02760c84be798a24954c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 06:05:45 GMT
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Jul 2021 06:05:45 GMT

GET
H/1.1 200
OK mkto-font-styles.css
go.ceridian.com/rs/285-SCZ-328/images/ 2 KB
1 KB 186ms
185ms Stylesheet
text/css 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://go.ceridian.com/rs/285-SCZ-328/images/mkto-font-styles.css

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db98642bb6772bbac107a70504ca503e4cd259958732195acd15b2f4c97036a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: go.ceridian.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://go.ceridian.com/preference-change-thank-you.html
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=; __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==; _gcl_au=1.1.266603597.1626242744; gtmCustomerProgression=Non-Customer; _ga=GA1.2.329137014.1626242744; _gid=GA1.2.667563826.1626242744; _dc_gtm_UA-4372550-2=1; d-a8e6=49d93f30-0738-468c-8b9d-b99d63225e11; s-9da4=b9fdf72c-0ed7-460b-8145-f977de55e6a2; _fbp=fb.1.1626242743639.519264168; tbw_bw_uid=bito.AADEkk7B3P0AADaMJim9cw; tbw_bw_sd=1626242744; _sp_ses.c8c1=*; _sp_id.c8c1=9764b551-af92-4d87-8a30-d419b9b95eb2.1626242744.1.1626242744.1626242744.d17534a7-c235-4b67-80c3-f6a7d4c17bf4; _uetsid=86487d30e46911eb8bdc1116c5b50928; _uetvid=86488630e46911ebb445c923785c447a
Connection: keep-alive
Referer: https://go.ceridian.com/preference-change-thank-you.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
CF-Cache-Status: REVALIDATED
X-CDN: Imperva
X-Iinfo: 5-5035159-5035161 ENNN RT(1626242742204 2601) q(0 0 0 -1) r(1 1) U5
Connection: keep-alive
Content-Length: 389
Last-Modified: Sat, 26 Jun 2021 05:25:39 GMT
Server: cloudflare
ETag: "1d003bb-969-5c5a47ca38614"
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css
Cache-Control: public, max-age=60
Accept-Ranges: bytes
CF-RAY: 66e88fa86b169bdf-AMS
Expires: Wed, 14 Jul 2021 06:06:45 GMT

GET
H2 200 css
fonts.googleapis.com/ 6 KB
737 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Slab:400,300,700&subset=latin,cyrillic-ext

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab88b3cf3ffa1ee64aecfc8eb25913843288e1785c2a03a2544ebc151c1972d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 06:05:45 GMT
server: ESF
date: Wed, 14 Jul 2021 06:05:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 14 Jul 2021 06:05:45 GMT

GET
H/1.1 200
OK ie10-viewport-bug-workaround.js Show response
templates.marketo.net/template1/js/ 694 B
982 B 21ms
8ms Script
application/x-javascript 104.117.217.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://templates.marketo.net/template1/js/ie10-viewport-bug-workaround.js
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.117.217.134 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-217-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: ce01c41255d7e61cc44e865184559085737a98cf6911ef67f915692152b88852

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Last-Modified: Thu, 28 May 2015 00:15:45 GMT
Server: AkamaiNetStorage
ETag: "b5a0dd7ce1f7c1c6b80b5abe13308dd2:1432772145"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 694

GET
H/1.1 200
OK Ceridian_WordMark_email_banner.png
go.ceridian.com/rs/285-SCZ-328/images/ 2 KB
3 KB 213ms
209ms Image
image/png 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://go.ceridian.com/rs/285-SCZ-328/images/Ceridian_WordMark_email_banner.png

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c951f2fa032172e753c0246b65c0cbe03237deb39fdfa207a239c563bfbc6891

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: go.ceridian.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://go.ceridian.com/preference-change-thank-you.html
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=; __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==; _gcl_au=1.1.266603597.1626242744; gtmCustomerProgression=Non-Customer; _ga=GA1.2.329137014.1626242744; _gid=GA1.2.667563826.1626242744; _dc_gtm_UA-4372550-2=1; d-a8e6=49d93f30-0738-468c-8b9d-b99d63225e11; s-9da4=b9fdf72c-0ed7-460b-8145-f977de55e6a2; _fbp=fb.1.1626242743639.519264168; tbw_bw_uid=bito.AADEkk7B3P0AADaMJim9cw; tbw_bw_sd=1626242744; _sp_ses.c8c1=*; _sp_id.c8c1=9764b551-af92-4d87-8a30-d419b9b95eb2.1626242744.1.1626242744.1626242744.d17534a7-c235-4b67-80c3-f6a7d4c17bf4; _uetsid=86487d30e46911eb8bdc1116c5b50928; _uetvid=86488630e46911ebb445c923785c447a
Connection: keep-alive
Referer: https://go.ceridian.com/preference-change-thank-you.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:46 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
CF-Cache-Status: REVALIDATED
X-CDN: Imperva
X-Iinfo: 9-2794514-2794515 NNNN CT(8 10 0) RT(1626242744988 9) q(0 0 1 -1) r(2 2) U5
Connection: keep-alive
Content-Length: 2003
Last-Modified: Sun, 27 Jun 2021 00:45:54 GMT
Server: cloudflare
ETag: "1d01f60-7d3-5c5b4b1f69460"
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=60
Accept-Ranges: bytes
CF-RAY: 66e88fa9bbe0c82f-AMS
Expires: Wed, 14 Jul 2021 06:06:46 GMT

GET
H/1.1 200
OK 30786471-0-ceridian.png
go.ceridian.com/rs/285-SCZ-328/images/ 112 KB
113 KB 211ms
196ms Image
image/png 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://go.ceridian.com/rs/285-SCZ-328/images/30786471-0-ceridian.png

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5d4e8cc5fa6639f96e94e4f1d410cafd05f9bf12c2744daa228f87968ac7a2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: go.ceridian.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://go.ceridian.com/preference-change-thank-you.html
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=; __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==; _gcl_au=1.1.266603597.1626242744; gtmCustomerProgression=Non-Customer; _ga=GA1.2.329137014.1626242744; _gid=GA1.2.667563826.1626242744; _dc_gtm_UA-4372550-2=1; d-a8e6=49d93f30-0738-468c-8b9d-b99d63225e11; s-9da4=b9fdf72c-0ed7-460b-8145-f977de55e6a2; _fbp=fb.1.1626242743639.519264168; tbw_bw_uid=bito.AADEkk7B3P0AADaMJim9cw; tbw_bw_sd=1626242744; _sp_ses.c8c1=*; _sp_id.c8c1=9764b551-af92-4d87-8a30-d419b9b95eb2.1626242744.1.1626242744.1626242744.d17534a7-c235-4b67-80c3-f6a7d4c17bf4; _uetsid=86487d30e46911eb8bdc1116c5b50928; _uetvid=86488630e46911ebb445c923785c447a
Connection: keep-alive
Referer: https://go.ceridian.com/preference-change-thank-you.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:46 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
CF-Cache-Status: REVALIDATED
X-CDN: Imperva
X-Iinfo: 14-10009178-10009180 NNNN CT(7 10 0) RT(1626242745003 8) q(0 0 0 -1) r(1 1) U5
Connection: keep-alive
Content-Length: 114654
Last-Modified: Sat, 26 Jun 2021 05:25:40 GMT
Server: cloudflare
ETag: "1d01144-1bfde-5c5a47cb06705"
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=60
Accept-Ranges: bytes
CF-RAY: 66e88fa9cf9f1e99-AMS
Expires: Wed, 14 Jul 2021 06:06:46 GMT

GET
H/1.1 200
OK jquery.min.js Show response
templates.marketo.net/template1/js/ 91 KB
32 KB 13ms
13ms Script
application/x-javascript 104.117.217.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://templates.marketo.net/template1/js/jquery.min.js
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.117.217.134 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-217-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c3a7b608ebfa8d1dfe658bc119e6236a6aaf878a779e7c560aa11dd30881a56a

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 May 2015 00:15:45 GMT
Server: AkamaiNetStorage
ETag: "841dc30647f93349b7d8ef61deebe411:1432772145"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32822

GET
H/1.1 200
OK bootstrap.min.js Show response
templates.marketo.net/template1/js/ 35 KB
10 KB 11ms
10ms Script
application/x-javascript 104.117.217.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://templates.marketo.net/template1/js/bootstrap.min.js
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.117.217.134 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-217-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 May 2015 00:15:45 GMT
Server: AkamaiNetStorage
ETag: "8c237312864d2e4c4f03544cd4f9b195:1432772145"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9538

GET
H/1.1 200
OK retina-1.1.0.js Show response
templates.marketo.net/template1/js/ 4 KB
2 KB 7ms
7ms Script
application/x-javascript 104.117.217.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://templates.marketo.net/template1/js/retina-1.1.0.js
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.117.217.134 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-217-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 982fa97eccae21e893548687e91b35de93861805706a57fa1eab73455f9ed72f

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 May 2015 00:15:45 GMT
Server: AkamaiNetStorage
ETag: "345b675832f1977383da64e0f3e9c867:1432772145"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1422

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net// 1 KB
1 KB 25ms
24ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net//munchkin.js
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 May 2021 01:40:41 GMT
Server: AkamaiNetStorage
ETag: "5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H/1.1 200
OK stripmkttok.js Show response
go.ceridian.com/js/ 2 KB
1 KB 34ms
24ms Script
application/x-javascript 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://go.ceridian.com/js/stripmkttok.js

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: go.ceridian.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://go.ceridian.com/preference-change-thank-you.html
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=; __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==; _gcl_au=1.1.266603597.1626242744; gtmCustomerProgression=Non-Customer; _ga=GA1.2.329137014.1626242744; _gid=GA1.2.667563826.1626242744; _dc_gtm_UA-4372550-2=1; d-a8e6=49d93f30-0738-468c-8b9d-b99d63225e11; s-9da4=b9fdf72c-0ed7-460b-8145-f977de55e6a2; _fbp=fb.1.1626242743639.519264168; tbw_bw_uid=bito.AADEkk7B3P0AADaMJim9cw; tbw_bw_sd=1626242744; _sp_ses.c8c1=*; _sp_id.c8c1=9764b551-af92-4d87-8a30-d419b9b95eb2.1626242744.1.1626242744.1626242744.d17534a7-c235-4b67-80c3-f6a7d4c17bf4; _uetsid=86487d30e46911eb8bdc1116c5b50928; _uetvid=86488630e46911ebb445c923785c447a
Connection: keep-alive
Referer: https://go.ceridian.com/preference-change-thank-you.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
CF-Cache-Status: HIT
X-CDN: Imperva
Age: 1671
X-Iinfo: 5-5035159-5035161 ENNN RT(1626242742204 2788) q(0 0 0 -1) r(1 1) U5
Connection: keep-alive
Content-Length: 678
Last-Modified: Fri, 18 Jun 2021 20:07:07 GMT
Server: cloudflare
ETag: "16403ee-602-5c50fde38d0c0"
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/x-javascript
Cache-Control: public, max-age=14400
Accept-Ranges: bytes
CF-RAY: 66e88fa99b3f9bdf-AMS
Expires: Wed, 14 Jul 2021 10:05:45 GMT

GET
H3-29 200 gtm.js Show response
www.googletagmanager.com/ 196 KB
58 KB 41ms
38ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e7910b65941559d45a76bb78d9155b414ffc11ab3ba90ecccb190ed4bbd30a00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:45 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59479
x-xss-protection: 0
expires: Wed, 14 Jul 2021 06:05:45 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/160/ 11 KB
5 KB 26ms
25ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/160/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net//munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:45 GMT
Content-Encoding: gzip
Last-Modified: Fri, 19 Feb 2021 02:54:38 GMT
Server: AkamaiNetStorage
ETag: "19a9335fd71267d56e65bc19390f3100:1613703278.138281"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4811
Expires: Fri, 22 Oct 2021 06:05:45 GMT

GET
H/1.1 200
OK 359476_1_0.woff
go.ceridian.com/rs/285-SCZ-328/images/ 49 KB
50 KB 627ms
625ms Font
text/plain 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://go.ceridian.com/rs/285-SCZ-328/images/359476_1_0.woff

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/rs/285-SCZ-328/images/mkto-font-styles.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

34aafe7c6dad5376ccdb7ad152394aae82a3e28d78c556e8f4d86eff4261e78a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://go.ceridian.com
Accept-Encoding: gzip, deflate, br
Host: go.ceridian.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://go.ceridian.com/rs/285-SCZ-328/images/mkto-font-styles.css
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=; __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==; _gcl_au=1.1.266603597.1626242744; gtmCustomerProgression=Non-Customer; _ga=GA1.2.329137014.1626242744; _gid=GA1.2.667563826.1626242744; _dc_gtm_UA-4372550-2=1; d-a8e6=49d93f30-0738-468c-8b9d-b99d63225e11; s-9da4=b9fdf72c-0ed7-460b-8145-f977de55e6a2; _fbp=fb.1.1626242743639.519264168; tbw_bw_uid=bito.AADEkk7B3P0AADaMJim9cw; tbw_bw_sd=1626242744; _sp_ses.c8c1=*; _sp_id.c8c1=9764b551-af92-4d87-8a30-d419b9b95eb2.1626242744.1.1626242744.1626242744.d17534a7-c235-4b67-80c3-f6a7d4c17bf4; _uetsid=86487d30e46911eb8bdc1116c5b50928; _uetvid=86488630e46911ebb445c923785c447a
Connection: keep-alive
Origin: https://go.ceridian.com
Referer: https://go.ceridian.com/rs/285-SCZ-328/images/mkto-font-styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
CF-Cache-Status: REVALIDATED
X-CDN: Imperva
Transfer-Encoding: chunked
X-Iinfo: 4-3608170-3608173 NNNN CT(8 10 0) RT(1626242745005 11) q(0 0 0 -1) r(6 6) U5
Connection: keep-alive
Last-Modified: Sat, 26 Jun 2021 05:25:41 GMT
Server: cloudflare
ETag: W/"1d013a5-c3b4-5c5a47cb4cff3"
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=60
CF-RAY: 66e88fa9dc170c1d-AMS
Expires: Wed, 14 Jul 2021 06:06:46 GMT

GET
H/1.1 200
OK 359476_2_0.woff
go.ceridian.com/rs/285-SCZ-328/images/ 47 KB
48 KB 183ms
178ms Font
text/plain 45.60.65.3
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://go.ceridian.com/rs/285-SCZ-328/images/359476_2_0.woff

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/rs/285-SCZ-328/images/mkto-font-styles.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

45.60.65.3 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed9fb272ab75e1584ffacf1c2458db36a6f559dc57424995d7dc1260f3582073

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://go.ceridian.com
Accept-Encoding: gzip, deflate, br
Host: go.ceridian.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://go.ceridian.com/rs/285-SCZ-328/images/mkto-font-styles.css
Cookie: visid_incap_2152313=/uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi; nlbi_2152313=fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ; incap_ses_188_2152313=fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==; BIGipServersj29web-nginx-app_https=!sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=; __cf_bm=7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=; visid_incap_2152312=NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63; nlbi_2152312=m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI; incap_ses_876_2152312=0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==; _gcl_au=1.1.266603597.1626242744; gtmCustomerProgression=Non-Customer; _ga=GA1.2.329137014.1626242744; _gid=GA1.2.667563826.1626242744; _dc_gtm_UA-4372550-2=1; d-a8e6=49d93f30-0738-468c-8b9d-b99d63225e11; s-9da4=b9fdf72c-0ed7-460b-8145-f977de55e6a2; _fbp=fb.1.1626242743639.519264168; tbw_bw_uid=bito.AADEkk7B3P0AADaMJim9cw; tbw_bw_sd=1626242744; _sp_ses.c8c1=*; _sp_id.c8c1=9764b551-af92-4d87-8a30-d419b9b95eb2.1626242744.1.1626242744.1626242744.d17534a7-c235-4b67-80c3-f6a7d4c17bf4; _uetsid=86487d30e46911eb8bdc1116c5b50928; _uetvid=86488630e46911ebb445c923785c447a
Connection: keep-alive
Origin: https://go.ceridian.com
Referer: https://go.ceridian.com/rs/285-SCZ-328/images/mkto-font-styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
CF-Cache-Status: REVALIDATED
X-CDN: Imperva
Transfer-Encoding: chunked
X-Iinfo: 5-5035159-5035161 ENNN RT(1626242742204 2815) q(0 0 0 -1) r(1 1) U5
Connection: keep-alive
Last-Modified: Sat, 26 Jun 2021 05:25:40 GMT
Server: cloudflare
ETag: W/"1d010a1-bbd3-5c5a47cae098a"
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=60
CF-RAY: 66e88fa9bb499bdf-AMS
Expires: Wed, 14 Jul 2021 06:06:46 GMT

GET
H2 200 7Auwp_0qiz-afTLGLQ.woff2
fonts.gstatic.com/s/muli/v22/ 30 KB
31 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/muli/v22/7Auwp_0qiz-afTLGLQ.woff2

Requested by

Host: v.fastcdn.co
URL: https://v.fastcdn.co/f/css?family=Muli%3A200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://go.ceridian.com
Referer: https://v.fastcdn.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Jul 2021 21:42:00 GMT
x-content-type-options: nosniff
age: 116625
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31120
x-xss-protection: 0
last-modified: Wed, 15 Jul 2020 20:50:02 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Jul 2022 21:42:00 GMT

GET
H3-29 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 4486
date: Wed, 14 Jul 2021 04:50:59 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Wed, 14 Jul 2021 06:50:59 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 30 KB
9 KB 32ms
30ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 73e2e5173ed0d5a77b02914fa0ef1f67bb53143da75f0348f558f95565220ca1

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:45 GMT
content-encoding: gzip
last-modified: Fri, 28 May 2021 20:25:24 GMT
x-msedge-ref: Ref A: 8FA7455D9E084C7F9F2B1B31A212D2AF Ref B: FRAEDGE1512 Ref C: 2021-07-14T06:05:45Z
etag: "0d2a696ff53d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 9008

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 23ms
22ms Script
application/x-javascript 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:46 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Jun 2021 01:25:13 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=71552
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2079

GET
H3-29 200 fbevents.js Show response
connect.facebook.net/en_US/ 95 KB
24 KB 9ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0d17b8a38d3dce6f7357bbc8da105d92c21b6cf1c4b92351ce2b1861b065f2c5

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 24676
x-xss-protection: 0
pragma: public
x-fb-debug: tZm3V1ctxIB4X4mRqY59EWZVKlshOe/+jKltaKTwSU5zRtdjK1FzE+gnxAV2avBP57eUFWSVaIaVHeHrSh3+og==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 14 Jul 2021 06:05:45 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 t.js Show response
vidassets.terminus.services/5459c7af-9b57-4287-bdbe-e596cdb9f7ec/ 4 KB
2 KB 20ms
18ms Script
application/javascript 13.224.99.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vidassets.terminus.services/5459c7af-9b57-4287-bdbe-e596cdb9f7ec/t.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5J9G99C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.99.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-99-39.zrh50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

0e4b8d24a97bf67e39fcebe6b138ff9db6a5a01b38b3f2d2d2ab0ee90f44a729

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 05:50:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 932
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Thu, 17 Jun 2021 21:36:07 GMT
server: nginx/1.10.3 (Ubuntu)
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript;charset=utf-8
via: 1.1 4e0fd86f7afa735e772d6f7fe5e91f5b.cloudfront.net (CloudFront)
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: ZRH50-C1
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: PWtZTt_A7xiU7N_OAwjuyXwKwP9gmXVurmMxVEJ8BijpwkNe5EP44w==

GET
H2 200 80.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 16 B
237 B 142ms
140ms Script
text/javascript 2606:4700::6812:1bbe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/80.js?p=https://go.ceridian.com/preference-change-thank-you.html&e=

Requested by

Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1bbe , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .g2crowd.com .g2.com; connect-src 'self' .g2crowd.com .g2.com; font-src 'self' .g2crowd.com .g2.com; form-action 'self' .g2crowd.com .g2.com; frame-src 'self' .g2crowd.com .g2.com; img-src 'self' .g2crowd.com .g2.com; manifest-src 'self' .g2crowd.com .g2.com; media-src 'self' .g2crowd.com .g2.com; object-src 'self' .g2crowd.com .g2.com; script-src 'self' .g2crowd.com .g2.com; style-src 'self' .g2crowd.com .g2.com; worker-src 'self' .g2crowd.com .g2.com
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
content-encoding: br
x-xss-protection: 1; mode=block
x-request-id: 3e4b69cb-7feb-4e82-82ab-3e18a83560c9
x-runtime: 0.009097
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=604800
x-download-options: noopen
content-type: text/javascript; charset=utf-8
cache-control: max-age=600, public
content-security-policy: default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray: 66e88faa788705d0-FRA

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 9ms
7ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:45 GMT
via: 1.1 varnish
last-modified: Mon, 12 Jul 2021 21:25:31 GMT
age: 21523
etag: "65cf0c0ceb852397f0d1e6732cd3c533+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1626242746.998941,VS0,VE0
x-served-by: cache-fra19123-FRA

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 26ms
24ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: templates.marketo.net
URL: https://templates.marketo.net/template1/js/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:46 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 May 2021 01:40:41 GMT
Server: AkamaiNetStorage
ETag: "5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 13 KB
5 KB 100ms
99ms Script
text/javascript 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: ca85907595c81e151acf1dcc1fb2f6bba9aa046640d12bde12fdac17dc81c986

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 14 Jul 2021 06:05:46 GMT
Content-Encoding: gzip
Cache-Control: max-age=30
Content-Length: 4437
Connection: keep-alive
Content-Type: text/javascript

GET
H/1.1 200
OK tbw_analytics_v1.0.js Show response
d26x5ounzdjojj.cloudfront.net/tbw/ 12 KB
12 KB 22ms
21ms Script
application/javascript 52.84.193.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8
Requested by: Host: click.ceridian.com
URL: https://click.ceridian.com/Mjg1LVNDWi0zMjgAAAF-PwZKnXQqg-N5auVVHm1JcctL1D3EAM_6NUwA4E_VCnVRrHre4_xq8Pzp5JPe0XYLNBsHXOU=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.193.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-193-138.cdg52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 09fdb2959efa7f317724a5762ad6dd73d941613bfd3764ed8be04ddbc4338b4b

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Jul 2021 21:07:42 GMT
Via: 1.1 a5b64a1ac22cdce92ad57684d05480be.cloudfront.net (CloudFront)
Last-Modified: Tue, 24 Mar 2020 04:06:51 GMT
Server: AmazonS3
Age: 32285
ETag: "463d5912885bbaf6257aaac2e9d8935e"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: CDG52-P1
Accept-Ranges: bytes
Content-Length: 11917
X-Amz-Cf-Id: _0P4-WB7NznUK6XRWdMFLt3YIqhRo5DD8OzxXCoedM0LK-qgrMpQvw==

GET
H3-29 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
882 B 11ms
8ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:02:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 168
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Wed, 14 Jul 2021 07:02:58 GMT

GET
H3-29 200 333347490424190 Show response
connect.facebook.net/signals/config/ 260 KB
74 KB 11ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/333347490424190?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9cb4ff0846a38ebd8470fd80247ed90430ffe4072164fed4f5eb101123ace2a0

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 75651
x-xss-protection: 0
pragma: public
x-fb-debug: B75xCLBN3iDaj0IwCRSzvPmved++b2ep5Rbz9hJCrJ8YEVQ2IjjsyJo1JXncYKBgkQ/T9fWe3IhlRo9A06tUSg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 14 Jul 2021 06:05:46 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242746062&url=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242746062&url=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&e_ipv6=AQLCg2Fpo6BEeAAAAXqjnwc4U5g66gbpkHr0FBLW_0Dy...

0
64 B

187ms
186ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242746062&url=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&e_ipv6=AQLCg2Fpo6BEeAAAAXqjnwc4U5g66gbpkHr0FBLW_0Dyn1imvCCD0AS_-OpaC6i2j-Dj-SUv
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-edc2
content-type: application/javascript
content-length: 0
x-li-uuid: j7SXXCmTkRaQ0VkWSisAAA==

Redirect headers

date: Wed, 14 Jul 2021 06:05:46 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=56607&time=1626242746062&url=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&e_ipv6=AQLCg2Fpo6BEeAAAAXqjnwc4U5g66gbpkHr0FBLW_0Dyn1imvCCD0AS_-OpaC6i2j-Dj-SUv
x-li-proto: http/2
x-li-pop: prod-esv5
content-length: 0
x-li-uuid: WOCHUimTkRbg3Qw0rCoAAA==

GET
H/1.1 200
OK pista.js Show response
d26x5ounzdjojj.cloudfront.net/2.14.0/ 98 KB
98 KB 23ms
22ms Script
application/javascript 52.84.193.138
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d26x5ounzdjojj.cloudfront.net/2.14.0/pista.js
Requested by: Host: d26x5ounzdjojj.cloudfront.net
URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.193.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-193-138.cdg52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 10deca523f2d7d41a77738b61b503fb9ec9f7c8e5f96d34b4e760f7ab807983a

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Jul 2021 23:40:53 GMT
Via: 1.1 a5b64a1ac22cdce92ad57684d05480be.cloudfront.net (CloudFront)
Last-Modified: Thu, 06 Aug 2020 17:08:18 GMT
Server: AmazonS3
Age: 23094
ETag: "8f4885b5f0517e98f2ecf6c734d1decd"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: CDG52-P1
Accept-Ranges: bytes
Content-Length: 100013
X-Amz-Cf-Id: 987q_TnROA91142FSyTD941zqA6WKk9dvQWkTenx6McSlKCSD12fBg==

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
6ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j91&a=1960711346&t=pageview&_s=1&dl=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&ul=en-us&de=UTF-8&dt=Ceridian%20%7C%20Preference%20Center&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SCCAgEAj~&jid=&gjid=&cid=329137014.1626242744&tid=UA-4372550-2&_gid=667563826.1626242744&gtm=2wg7c05J9G99C&cd2=Non-Customer&cd5=8&cd6=Wednesday&z=2128111606

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 14 Jul 2021 02:07:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 14276
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 204 26082856.js Show response
bat.bing.com/p/action/ 0
118 B 227ms
225ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/26082856.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 14 Jul 2021 06:05:45 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: E4E8A6A10FAD458EA16CAE49C8B0F9B6 Ref B: FRAEDGE1512 Ref C: 2021-07-14T06:05:46Z
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
150 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=26082856&tm=gtm001&Ver=2&mid=32083fae-35dc-4cae-915b-111a8ca92084&sid=86487d30e46911eb8bdc1116c5b50928&vid=86488630e46911ebb445c923785c447a&vids=0&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Ceridian%20%7C%20Preference%20Center&p=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&r=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&lt=655&evt=pageLoad&msclkid=N&sv=1&rn=223554
Requested by: Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 14 Jul 2021 06:05:45 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: C5E39F72B653455EBF7C66BC886F0A62 Ref B: FRAEDGE1512 Ref C: 2021-07-14T06:05:46Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 t.gif
vidassets.terminus.services/5459c7af-9b57-4287-bdbe-e596cdb9f7ec/ 42 B
693 B 19ms
18ms Image
image/gif 13.224.99.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.99.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-99-39.zrh50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 05:50:15 GMT
via: 1.1 4e0fd86f7afa735e772d6f7fe5e91f5b.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 931
x-cache: Hit from cloudfront
content-length: 42
last-modified: Thu, 17 Jun 2021 21:36:07 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: ZRH50-C1
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: WgzTQRZCjP7tFU2FzRQYXVy3WIJAVdpyhctl5W2tV1XjVdwVOaQz-g==

GET
H2 200 adsct
t.co/i/ 43 B
165 B 119ms
119ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 14 Jul 2021 06:05:46 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: d246c3fe8bfb75084a8ca742af673af374c0e8230d7c419075186df8142fac89
x-transaction: c64f425c73a06402
expires: Tue, 31 Mar 1981 05:00:00 GMT

OPTIONS
H2 200 tp2
com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/ Frame 0
0 102ms
102ms Preflight 52.20.197.48
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Server: 52.20.197.48 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-197-48.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://go.ceridian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
content-length: 0
access-control-allow-origin: https://go.ceridian.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-max-age: 5
server: akka-http/10.1.12

POST
H2 200 tp2 Show response
com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/ 2 B
327 B 104ms
103ms XHR
text/plain 52.20.197.48
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/tp2
Requested by: Host: d26x5ounzdjojj.cloudfront.net
URL: https://d26x5ounzdjojj.cloudfront.net/2.14.0/pista.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.197.48 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-197-48.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://go.ceridian.com
date: Wed, 14 Jul 2021 06:05:46 GMT
access-control-allow-credentials: true
server: akka-http/10.1.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
content-length: 2
content-type: text/plain; charset=UTF-8

GET
H3-29 200 1066230166811859 Show response
connect.facebook.net/signals/config/ 260 KB
74 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1066230166811859?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

56271e1d11fc115698bb49be84ea7e56b958703b45913481bec2b5dd741c96eb

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 75599
x-xss-protection: 0
pragma: public
x-fb-debug: B/3T0Tabz14PIiMYuVMzbOk9IOkf3tSBvyxRCzVanuui9Jdy9jYevdLXAmuzN7qeiq8Q58sUwet+NZ4xrTE6vw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 14 Jul 2021 06:05:46 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=333347490424190&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&rl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&if=false&ts=1626242746160&sw=1600&sh=1200&v=2.9.43&r=stable&ec=0&o=30&fbp=fb.1.1626242743639.519264168&it=1626242746056&coo=false&rqm=GET

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:46 GMT

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 83 B
310 B 100ms
100ms Stylesheet
text/css 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 7db8db403268a3d02b08ac151a519e2fb02ce6e9ce19e67fd10d57396e81e17e

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 14 Jul 2021 06:05:46 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 83
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 651 B
881 B 100ms
100ms Fetch
image/jpeg 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 52ce9e9318cbdad681270ac08ab476cb091a097c03780f13754aa4711c0bb6be

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 14 Jul 2021 06:05:46 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

GET
H3-29 200 321786608898478 Show response
connect.facebook.net/signals/config/ 260 KB
74 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/321786608898478?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ee1814b597ec6e24b94fc0d55a38fe38a25c3823d801fe9fc7e9eae0218c92c3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 75678
x-xss-protection: 0
pragma: public
x-fb-debug: HaYmzVL6UE8geqNVc5mr7EX664JDdi3iJj1j+lTXZDuKdud0yQqMqjkZhcOKdvYVw3cR9zyPmEXFMvYiM4tgGA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 14 Jul 2021 06:05:46 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1066230166811859&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&rl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&if=false&ts=1626242746193&sw=1600&sh=1200&v=2.9.43&r=stable&ec=0&o=30&fbp=fb.1.1626242743639.519264168&it=1626242746056&coo=false&rqm=GET

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:46 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=321786608898478&ev=PageView&dl=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&rl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&if=false&ts=1626242746235&sw=1600&sh=1200&v=2.9.43&r=stable&ec=0&o=30&fbp=fb.1.1626242743639.519264168&it=1626242746056&coo=false&rqm=GET

Requested by

Host: go.ceridian.com
URL: https://go.ceridian.com/preference-change-thank-you.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:46 GMT

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 94 B
397 B 107ms
101ms XHR
text/plain 54.165.186.74
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=kSPvt411qnIpJGK2dJvYOg&is_js=true&landing_url=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&t=Ceridian%20%7C%20Preference%20Center&host=https://go.ceridian.com&sa_conv_data_css_value=%20%220-f8c4ca7a-a65a-493e-5896-5c4bf65db72e%24ip%24185.230.127.84%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd97b9c06cb5b9c438c424e768d9a952b1fb9e67f54
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.186.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 14 Jul 2021 06:05:46 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://go.ceridian.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 94

POST
H2 200 tp2 Show response
com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/ 2 B
327 B 103ms
102ms XHR
text/plain 52.20.197.48
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/tp2
Requested by: Host: d26x5ounzdjojj.cloudfront.net
URL: https://d26x5ounzdjojj.cloudfront.net/2.14.0/pista.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.197.48 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-197-48.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://go.ceridian.com
date: Wed, 14 Jul 2021 06:05:46 GMT
access-control-allow-credentials: true
server: akka-http/10.1.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
content-length: 2
content-type: text/plain; charset=UTF-8

OPTIONS
H2 200 tp2
com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/ Frame 0
0 109ms
108ms Preflight 52.20.197.48
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://com-thebigwillow-prod1.collector.snplow.net/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Server: 52.20.197.48 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-197-48.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://go.ceridian.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
content-length: 0
access-control-allow-origin: https://go.ceridian.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-max-age: 5
server: akka-http/10.1.12

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
158 B 114ms
114ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 14 Jul 2021 06:05:46 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: c2aa7b7afc19239b433a588c1683c13f1cf02c6859b22d3f6b20640ce0c4b823
x-transaction: dfa9b8cc73eeb520
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=333347490424190&ev=Microdata&dl=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&rl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&if=false&ts=1626242747662&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Ceridian%20%7C%20Preference%20Center%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.43&r=stable&ec=1&o=30&fbp=fb.1.1626242743639.519264168&it=1626242746056&coo=false&es=automatic&tm=3&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:47 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1066230166811859&ev=Microdata&dl=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&rl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&if=false&ts=1626242747697&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Ceridian%20%7C%20Preference%20Center%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.43&r=stable&ec=1&o=30&fbp=fb.1.1626242743639.519264168&it=1626242746056&coo=false&es=automatic&tm=3&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:47 GMT

GET
H3-29 200 /
www.facebook.com/tr/ 44 B
88 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=321786608898478&ev=Microdata&dl=https%3A%2F%2Fgo.ceridian.com%2Fpreference-change-thank-you.html&rl=https%3A%2F%2Fgo.ceridian.com%2Foneclick-unsubscribe.html%3Fmkt_unsubscribe%3D1&if=false&ts=1626242747739&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Ceridian%20%7C%20Preference%20Center%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.43&r=stable&ec=1&o=30&fbp=fb.1.1626242743639.519264168&it=1626242746056&coo=false&es=automatic&tm=3&rqm=GET

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://go.ceridian.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 14 Jul 2021 06:05:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Wed, 14 Jul 2021 06:05:47 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bat.bing.com
URL: https://bat.bing.com/actionp/0?ti=26082856&tm=gtm001&Ver=2&mid=cd3b1ebe-212e-41a2-982f-09d36a458fad&sid=86487d30e46911eb8bdc1116c5b50928&vid=86488630e46911ebb445c923785c447a&vids=1&evt=pageHide

Verdicts & Comments Add Verdict or Comment

74 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
go.ceridian.com/	1970-01-20 13:15:14	Name: _sp_id.c8c1 Value: 9764b551-af92-4d87-8a30-d419b9b95eb2.1626242744.1.1626242746.1626242744.d17534a7-c235-4b67-80c3-f6a7d4c17bf4
.ceridian.com/	1970-01-19 19:45:29	Name: _uetsid Value: 86487d30e46911eb8bdc1116c5b50928
go.ceridian.com/	1970-02-25 07:44:02	Name: tbw_bw_sd Value: 1626242744
.ceridian.com/	1970-01-20 05:05:38	Name: _uetvid Value: 86488630e46911ebb445c923785c447a
.ceridian.com/	1970-01-19 21:53:38	Name: _fbp Value: fb.1.1626242743639.519264168
go.ceridian.com/	1970-01-19 19:44:04	Name: _sp_ses.c8c1 Value: *
go.ceridian.com/	1970-01-19 19:44:03	Name: s-9da4 Value: b9fdf72c-0ed7-460b-8145-f977de55e6a2
go.ceridian.com/	1970-01-20 04:29:38	Name: d-a8e6 Value: 49d93f30-0738-468c-8b9d-b99d63225e11
.ceridian.com/	1970-01-19 19:44:02	Name: _dc_gtm_UA-4372550-2 Value: 1
.ceridian.com/	1970-01-19 19:45:29	Name: _gid Value: GA1.2.667563826.1626242744
go.ceridian.com/	1970-02-25 07:44:02	Name: tbw_bw_uid Value: bito.AADEkk7B3P0AADaMJim9cw
.ceridian.com/	1970-01-20 04:28:35	Name: visid_incap_2152312 Value: NEVxtCjYR2ydZay4Bb/YgrZ+7mAAAAAAQUIPAAAAAAAzqDk3XSI9wP30hE3ROP63
.ceridian.com/	1970-01-20 13:15:14	Name: _ga Value: GA1.2.329137014.1626242744
.ceridian.com/	1969-12-31 23:59:59	Name: incap_ses_876_2152312 Value: 0kdER/iuXzeCYfWhvS0oDLZ+7mAAAAAAvKiXN7t+lJx5zxKLNXvm1g==
.ceridian.com/	1970-01-19 21:53:38	Name: _gcl_au Value: 1.1.266603597.1626242744
.ceridian.com/	1969-12-31 23:59:59	Name: nlbi_2152312 Value: m0gHGnjMmWdjs5/KE6yW5AAAAADmyYw2xdMeytLIzJxv9VFI
.ceridian.com/	1970-01-19 19:54:07	Name: gtmCustomerProgression Value: Non-Customer
.go.ceridian.com/	1970-01-19 19:44:04	Name: __cf_bm Value: 7c73370eb5b3bd2ebdf04b80d188ed160f334308-1626242743-1800-AQqUwu2dvOEQu6HY3W87AZ5ZPlYO0etZzU0Ejk2mBGj6FWzGPhx/TBcXXJ3CpPzGN17WdTty4Qpl39DnDuvFySg=
go.ceridian.com/	1969-12-31 23:59:59	Name: BIGipServersj29web-nginx-app_https Value: !sOlpfPcf911yII6mfApvaf9MEhiEHRHD14Fz75PdmYlkr7dbq8+MzZpDwBXMggVORuU71ZXuX5H6syc=
.ceridian.com/	1970-01-20 04:28:38	Name: visid_incap_2152313 Value: /uRT+mx4RWWsBZAxicUSsbZ+7mAAAAAAQUIPAAAAAABShB9U4mMA+eFKI0wL4qIi
.ceridian.com/	1969-12-31 23:59:59	Name: incap_ses_188_2152313 Value: fitOVIb22xwu7M9giumbArZ+7mAAAAAA7Z+JQ9cgLIm4BuBSxDNZ0A==
.ceridian.com/	1969-12-31 23:59:59	Name: nlbi_2152313 Value: fl2fau1fYWvt3rxmbqcpsAAAAAC8HLIpp5GY5+niKdcKoeZQ

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: tbwlog: %c The following parameters were collected from the page color:green
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: [object Object]
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: tbwlog: %c Got response from Beeswax. Setting tbw_bw_uid color: green
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: tbwlog: %c The following parameters were sent to the collector color: green
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: [object Object]
console-api	debug	URL: https://munchkin.marketo.net/160/munchkin.js(Line 22) Message: Munchkin.init("%s") options: 285-SCZ-328 [object Object]
console-api	debug	URL: https://munchkin.marketo.net/160/munchkin.js(Line 22) Message: Munchkin.init("%s") options: 285-SCZ-328 [object Object]
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: tbwlog: %c The following parameters were collected from the page color:green
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: [object Object]
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: tbwlog: %c The following parameters were sent to the collector color: green
console-api	log	URL: https://d26x5ounzdjojj.cloudfront.net/tbw/tbw_analytics_v1.0.js?8(Line 1) Message: [object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
app-sj29.marketo.com
bat.bing.com
click.ceridian.com
com-thebigwillow-prod1.collector.snplow.net
connect.facebook.net
d26x5ounzdjojj.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
go.ceridian.com
marketingops.ceridian.ca
match.adsrvr.org
match.prod.bidr.io
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.srv.stackadapt.com
templates.marketo.net
tracking.g2crowd.com
v.fastcdn.co
vidassets.terminus.services
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
bat.bing.com
104.111.234.67
104.117.217.134
104.16.94.80
104.244.42.197
104.244.42.3
108.174.10.14
13.224.99.39
13.248.242.197
151.101.12.157
192.229.133.208
2606:4700::6812:1bbe
2620:119:50e1:101::6cae:b25
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:801::2004
2a00:1450:4001:810::200e
2a00:1450:4001:813::2008
2a00:1450:4001:827::200a
2a00:1450:4001:828::2003
2a00:1450:4001:829::2003
2a00:1450:4001:82b::200e
2a00:1450:400c:c09::9c
2a02:26f0:6c00:28c::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.247.100.44
45.60.65.3
52.20.197.48
52.84.193.138
54.165.186.74
007c00dbfcdbfee461e9ccca651fe3f85007a5a83acd692b6dd39e556cc5df8b
014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
09fdb2959efa7f317724a5762ad6dd73d941613bfd3764ed8be04ddbc4338b4b
0ac8b9ca26c489b803659ad5eb1da8b938b45b5e0d2bbc522984ea045298114a
0d17b8a38d3dce6f7357bbc8da105d92c21b6cf1c4b92351ce2b1861b065f2c5
0e4b8d24a97bf67e39fcebe6b138ff9db6a5a01b38b3f2d2d2ab0ee90f44a729
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
10deca523f2d7d41a77738b61b503fb9ec9f7c8e5f96d34b4e760f7ab807983a
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
17a08dc345dfd79e1e5f01a0423bcb275e4cbc38390b02760c84be798a24954c
1f5ef4a6099e359413e336775a92a596b105a570a340a881f2ca9ce1224a7498
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
34aafe7c6dad5376ccdb7ad152394aae82a3e28d78c556e8f4d86eff4261e78a
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
52ce9e9318cbdad681270ac08ab476cb091a097c03780f13754aa4711c0bb6be
5404ebe573d9956d980bbff3612a582f2a3e4f38dba55e3f9eac39ac9bfefce0
56271e1d11fc115698bb49be84ea7e56b958703b45913481bec2b5dd741c96eb
6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
73e2e5173ed0d5a77b02914fa0ef1f67bb53143da75f0348f558f95565220ca1
75582afe1c0f748de4c68c6765b14151347d08c5aa3f24b04e914cece76ac3c3
7db8db403268a3d02b08ac151a519e2fb02ce6e9ce19e67fd10d57396e81e17e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a9f1c843897c262dfae57a3bd3bebd1755319f72a66c68e1b28c2df8450143
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
982fa97eccae21e893548687e91b35de93861805706a57fa1eab73455f9ed72f
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1
9cb4ff0846a38ebd8470fd80247ed90430ffe4072164fed4f5eb101123ace2a0
a53ea60fbea6cb1775430998564d5f295aba7d3bfe548a0ba79aa2a049aba839
a5d4e8cc5fa6639f96e94e4f1d410cafd05f9bf12c2744daa228f87968ac7a2f
ab88b3cf3ffa1ee64aecfc8eb25913843288e1785c2a03a2544ebc151c1972d9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
c3a7b608ebfa8d1dfe658bc119e6236a6aaf878a779e7c560aa11dd30881a56a
c942686010e285633d77a24341c43850ccd6162fcc7e8281ae8a70c2921a9af5
c951f2fa032172e753c0246b65c0cbe03237deb39fdfa207a239c563bfbc6891
ca85907595c81e151acf1dcc1fb2f6bba9aa046640d12bde12fdac17dc81c986
ce01c41255d7e61cc44e865184559085737a98cf6911ef67f915692152b88852
d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
db98642bb6772bbac107a70504ca503e4cd259958732195acd15b2f4c97036a5
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e70f07b3a5eef58eb16a158084471795dc268ec5eb1f3b57561e371afa13e3cd
e7910b65941559d45a76bb78d9155b414ffc11ab3ba90ecccb190ed4bbd30a00
ed9fb272ab75e1584ffacf1c2458db36a6f559dc57424995d7dc1260f3582073
ee1814b597ec6e24b94fc0d55a38fe38a25c3823d801fe9fc7e9eae0218c92c3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2e953aa24359d5a94e55040ed454c32c2bf2caa98da4be6e8fc77f356f6671d
f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715

go.ceridian.com Open in urlscan Pro 45.60.65.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

111 Requests

99 %HTTPS

50 %IPv6

27 Domains

31 Subdomains

28 IPs

4 Countries

1435 kBTransfer

3671 kBSize

22 Cookies

2 Outgoing links

Page URL History

Redirected requests

111 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

go.ceridian.com Open in urlscan Pro
45.60.65.3 Public Scan

Screenshot
Live screenshot

Full Image

111
Requests

99 %
HTTPS

50 %
IPv6

27
Domains

31
Subdomains

28
IPs

4
Countries

1435 kB
Transfer

3671 kB
Size

22
Cookies

111 HTTP transactions
0 data transactions