refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:d2b Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://refinance.quikcenioans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&c...
Effective URL:
https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&c...
Submission: On November 14 via manual (November 14th 2023, 8:46:49 pm UTC) from US — Scanned from DE

Summary HTTP 144 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 48 IPs in 6 countries across 41 domains to perform 144 HTTP transactions. The main IP is 2606:4700::6812:d2b, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 903425.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 20th 2022. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3037::6815:53cd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2606:4700::68... 2606:4700::6812:d2b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.156.2.81 108.156.2.81	16509 (AMAZON-02) (AMAZON-02)
1	52.58.191.183 52.58.191.183	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:350... 2a02:26f0:3500:2a7::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	13.32.99.40 13.32.99.40	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:e2:... 2606:4700:e2::ac40:8416	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3865	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 6	52.211.35.76 52.211.35.76	16509 (AMAZON-02) (AMAZON-02)
1	108.138.181.64 108.138.181.64	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
3	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	35.173.79.120 35.173.79.120	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.62.135 63.140.62.135	15224 (OMNITURE) (OMNITURE)
8 8	52.30.96.55 52.30.96.55	16509 (AMAZON-02) (AMAZON-02)
1 1	18.197.230.215 18.197.230.215	16509 (AMAZON-02) (AMAZON-02)
8 9	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
6 12	52.17.3.61 52.17.3.61	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:710... 2a02:26f0:7100:789::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	65.109.98.102 65.109.98.102	24940 (HETZNER-AS) (HETZNER-AS)
1	2600:9000:225... 2600:9000:225e:7a00:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
7	151.101.193.44 151.101.193.44	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:94b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.162.38.245 3.162.38.245	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1288:80:... 2a00:1288:80:807::2	203220 (YAHOO-DEB) (YAHOO-DEB)
1	2600:9000:206... 2600:9000:206f:3200:a:8e7d:9900:93a1	16509 (AMAZON-02) (AMAZON-02)
2	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	63.140.62.214 63.140.62.214	15224 (OMNITURE) (OMNITURE)
2	18.135.137.77 18.135.137.77	16509 (AMAZON-02) (AMAZON-02)
11	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
2	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1 1	2600:1f18:730... 2600:1f18:730:b120:c62f:9488:7811:a2e	14618 (AMAZON-AES) (AMAZON-AES)
1	44.216.119.239 44.216.119.239	14618 (AMAZON-AES) (AMAZON-AES)
3	2.19.244.226 2.19.244.226	16625 (AKAMAI-AS) (AKAMAI-AS)
2	46.4.76.120 46.4.76.120	24940 (HETZNER-AS) (HETZNER-AS)
3	2606:4700::68... 2606:4700::6812:1ba3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.238.243.27 18.238.243.27	16509 (AMAZON-02) (AMAZON-02)
3	35.190.43.134 35.190.43.134	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
7 7	151.101.2.49 151.101.2.49	54113 (FASTLY) (FASTLY)
2	3.211.1.160 3.211.1.160	14618 (AMAZON-AES) (AMAZON-AES)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	185.89.210.212 185.89.210.212	29990 (ASN-APPNEX) (ASN-APPNEX)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	198.47.127.205 198.47.127.205	62713 (AS-PUBMATIC) (AS-PUBMATIC)
144	48

1 2606:4700:3037::6815:53cd (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

refinance.quikcenioans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:4700::6812:d2b (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.156.2.81 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-156-2-81.mxp63.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.58.191.183 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-191-183.eu-central-1.compute.amazonaws.com

cs-cdn.deviceatlas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:2a7::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.99.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-40.fra60.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e2::ac40:8416 (United States)

ASN13335 (CLOUDFLARENET, US)

fonts.cdnfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.211.35.76 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-35-76.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.181.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-181-64.mxp64.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.173.79.120 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-79-120.compute-1.amazonaws.com

psp.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.135 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-135.data.adobedc.net

somni.rocketmortgage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.30.96.55 (Dublin, Ireland) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-96-55.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.197.230.215 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-230-215.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.184.194 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 52.17.3.61 (Dublin, Ireland) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-3-61.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:7100:789::1931 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.109.98.102 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.102.98.109.65.clients.your-server.de

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:225e:7a00:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.193.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:94b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mortgage.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.162.38.245 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-162-38-245.cdg52.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:80:807::2 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:3200:a:8e7d:9900:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.pmsrv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.76.131 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.214 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-214.data.adobedc.net

adobedc.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.135.137.77 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-135-137-77.eu-west-2.compute.amazonaws.com

script.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b120:c62f:9488:7811:a2e (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.216.119.239 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-216-119-239.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.19.244.226 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-244-226.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.4.76.120 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.120.76.4.46.clients.your-server.de

pix.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:1ba3 (United States)

ASN13335 (CLOUDFLARENET, US)

somni.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.243.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-243-27.ams58.r.cloudfront.net

ads.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.43.134 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 134.43.190.35.bc.googleusercontent.com

tr.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.2.49 (United States) 7 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.211.1.160 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-211-1-160.compute-1.amazonaws.com

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.36.155 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.212 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.47.127.205 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	everesttech.net 21 redirects cm.everesttech.net — Cisco Umbrella Rank: 1275 pixel.everesttech.net — Cisco Umbrella Rank: 5429 sync-tm.everesttech.net — Cisco Umbrella Rank: 709	10 KB
20	doubleclick.net 8 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 245 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	17 KB
18	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 903425 static-msql-prod.refinance.quickenloans.com trackpixel.refinance.quickenloans.com content.refinance.quickenloans.com cdn.mortgage.quickenloans.com somni.quickenloans.com — Cisco Umbrella Rank: 419068	370 KB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	1 MB
11	google.de www.google.de — Cisco Umbrella Rank: 6862	1 KB
11	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
7	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 1136 trc.taboola.com — Cisco Umbrella Rank: 705	20 KB
7	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 228 quicken.demdex.net — Cisco Umbrella Rank: 90177 adobedc.demdex.net — Cisco Umbrella Rank: 7942	9 KB
6	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 6212 psp.pushnami.com — Cisco Umbrella Rank: 20857 trc.pushnami.com — Cisco Umbrella Rank: 6504	20 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	3 KB
3	snapchat.com tr.snapchat.com — Cisco Umbrella Rank: 874	752 B
3	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 849	2 KB
3	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1417 ads.yahoo.com — Cisco Umbrella Rank: 7567	927 B
3	anura.io script.anura.io — Cisco Umbrella Rank: 58289 ads.anura.io — Cisco Umbrella Rank: 71761	21 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 3063 rp.liadm.com — Cisco Umbrella Rank: 1574 rp4.liadm.com — Cisco Umbrella Rank: 6581	16 KB
3	revjet.com ads.revjet.com — Cisco Umbrella Rank: 7486 pix.revjet.com — Cisco Umbrella Rank: 5592	9 KB
3	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2462	369 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 246	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 625	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 110	1020 B
2	lmbahsj2.com www.lmbahsj2.com — Cisco Umbrella Rank: 784924	19 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 648	7 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	85 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 847	21 KB
2	gstatic.com fonts.gstatic.com	48 KB
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 924	225 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 522	273 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 376	239 B
1	pmsrv.co c.pmsrv.co — Cisco Umbrella Rank: 77562	4 KB
1	sc-static.net sc-static.net — Cisco Umbrella Rank: 1161	17 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 145	19 KB
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 560	479 B
1	rocketmortgage.com somni.rocketmortgage.com — Cisco Umbrella Rank: 79019	471 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1471	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 899	7 KB
1	cdnfonts.com fonts.cdnfonts.com — Cisco Umbrella Rank: 8545	713 B
1	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 466	81 KB
1	deviceatlas.com cs-cdn.deviceatlas.com — Cisco Umbrella Rank: 201765	22 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 5423	7 KB
1	quikcenioans.com 1 redirects refinance.quikcenioans.com	695 B
0	spotxchange.com Failed sync.search.spotxchange.com Failed
144	41

	Domain	Requested by
15	www.googletagmanager.com	refinance.quickenloans.com www.googletagmanager.com trackpixel.refinance.quickenloans.com
12	pixel.everesttech.net	6 redirects
11	www.google.de
11	www.google.com
11	googleads.g.doubleclick.net	www.googletagmanager.com
9	cm.g.doubleclick.net	8 redirects
8	cm.everesttech.net	8 redirects
7	sync-tm.everesttech.net	7 redirects
6	trc.taboola.com	cdn.taboola.com
5	content.refinance.quickenloans.com	static-msql-prod.refinance.quickenloans.com
5	dpm.demdex.net	1 redirects refinance.quickenloans.com
5	refinance.quickenloans.com	www.datadoghq-browser-agent.com
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
3	tr.snapchat.com	sc-static.net
3	somni.quickenloans.com	assets.adobedtm.com
3	ct.pinterest.com	s.pinimg.com
3	region1.google-analytics.com	www.googletagmanager.com
2	ib.adnxs.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	trc.pushnami.com	www.datadoghq-browser-agent.com
2	www.facebook.com
2	pix.revjet.com	ads.revjet.com
2	sp.analytics.yahoo.com
2	script.anura.io	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	www.lmbahsj2.com	trackpixel.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	s.yimg.com	refinance.quickenloans.com s.yimg.com
2	connect.facebook.net	refinance.quickenloans.com connect.facebook.net
2	s.pinimg.com	refinance.quickenloans.com s.pinimg.com
2	fonts.gstatic.com	fonts.googleapis.com
2	psp.pushnami.com	www.datadoghq-browser-agent.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
1	image2.pubmatic.com
1	us-u.openx.net
1	pixel.rubiconproject.com
1	ads.yahoo.com
1	ads.anura.io	www.datadoghq-browser-agent.com
1	rp4.liadm.com
1	rp.liadm.com	1 redirects
1	adobedc.demdex.net	assets.adobedtm.com
1	c.pmsrv.co	trackpixel.refinance.quickenloans.com
1	sc-static.net	refinance.quickenloans.com
1	cdn.mortgage.quickenloans.com	trackpixel.refinance.quickenloans.com
1	cdn.taboola.com	refinance.quickenloans.com
1	www.googleadservices.com	trackpixel.refinance.quickenloans.com
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	refinance.quickenloans.com
1	aa.agkn.com	1 redirects
1	somni.rocketmortgage.com	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	fonts.cdnfonts.com	static-msql-prod.refinance.quickenloans.com
1	assets.adobedtm.com	refinance.quickenloans.com
1	cs-cdn.deviceatlas.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
1	refinance.quikcenioans.com	1 redirects
0	sync.search.spotxchange.com Failed
144	59

This site contains links to these domains. Also see Links.

Domain
www.lowermybills.com
privacyportal-cdn.onetrust.com
www.quickencompare.com
www.rockethomes.com
privacyportal.onetrust.com
www.amerisave.com
www.fhfa.gov
capitalmarkets.fanniemae.com
www.quickenloans.com
www.starleafsquare.com
marketing.lowermybills.com

Subject Issuer	Validity	Valid
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2022-12-20` - `2023-12-20`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M02	`2023-02-02` - `2024-03-02`	a year	crt.sh
*.deviceatlas.com Go Daddy Secure Certificate Authority - G2	`2023-03-04` - `2024-04-04`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
*.pushnami.com Amazon RSA 2048 M01	`2023-03-04` - `2024-04-02`	a year	crt.sh
cdnfonts.com GTS CA 1P5	`2023-10-02` - `2023-12-31`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-14` - `2024-01-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
somni.rocketmortgage.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-17` - `2024-02-17`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-07` - `2024-08-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-08-24` - `2023-11-22`	3 months	crt.sh
*.revjet.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-04-11`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M02	`2023-02-28` - `2024-01-30`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-23` - `2024-11-22`	a year	crt.sh
mortgage.quickenloans.com Cloudflare Inc ECC CA-3	`2023-10-11` - `2024-10-10`	a year	crt.sh
sc-static.net Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-11-06` - `2023-12-27`	2 months	crt.sh
pmsrv.co Amazon RSA 2048 M02	`2023-09-16` - `2024-10-14`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2023-04-28` - `2024-05-13`	a year	crt.sh
adobedc.demdex.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-22` - `2024-11-21`	a year	crt.sh
script.anura.io Amazon RSA 2048 M02	`2023-10-16` - `2024-11-13`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-10-24` - `2024-04-17`	6 months	crt.sh
*.quickenloans.com GeoTrust TLS RSA CA G1	`2023-10-04` - `2024-10-03`	a year	crt.sh
ads.anura.io Amazon RSA 2048 M01	`2023-05-30` - `2024-06-27`	a year	crt.sh
*.snap.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-13` - `2024-04-12`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Frame ID: 69D947F5CEA5D26151C144B7A448C9D5
Requests: 93 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: 2EAEC8A2B1136C0B043FF94F65902D48
Requests: 1 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: DEF464BA94CBE200D0CE96189967951A
Requests: 18 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: 9881AFB1E21B9B1B0BB60B89E0E71117
Requests: 28 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=409e6a74-8d7f-465e-87b0-cc6eb99f3a76&u_scsid=dd664430-f45a-4d7c-ac2e-95ce035dee85&u_sclid=8390867e-cbab-471c-a57e-cae3f9e608a7
Frame ID: 5F1E8F998560EE4A273ADEE734FA11B7
Requests: 1 HTTP requests in this frame

Frame: https://ct.pinterest.com/ct.html
Frame ID: 346D7927CDAC57B4FE21252CD6E2648E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Refinance Mortgage, Refinancing Rates, Mortgage Rates

Page URL History Show full URLs

https://refinance.quikcenioans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-5486... HTTP 302
https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-5486... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

144
Requests

86 %
HTTPS

40 %
IPv6

41
Domains

59
Subdomains

48
IPs

6
Countries

1991 kB
Transfer

5916 kB
Size

50
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.lowermybills.com/legal/stateprivacy/
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/mortgage/mortgage-calculator/
Title: Mortgage Payment Calculator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/personal-loan-calculator/
Title: Personal Loan Payment Calculator

Search URL Search Domain Scan URL

URL: https://www.rockethomes.com/how-much-is-my-house-worth
Title: Home Value Estimator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/home-equity-loans/home-equity-loan-amount-calculator/
Title: Estimated Home Equity Calculator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/state-privacy/
Title: Information That We Collect and Share About You

Search URL Search Domain Scan URL

URL: https://privacyportal.onetrust.com/webform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e
Title: Do Not Sell My Personal Information

Search URL Search Domain Scan URL

URL: https://www.amerisave.com/rates/
Title: Rates

Search URL Search Domain Scan URL

URL: https://www.amerisave.com/loan-programs/cash-out-refinance/
Title: here

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/home-equity-rate-table/
Title: here

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: https://capitalmarkets.fanniemae.com/media/20371/display
Title: https://capitalmarkets.fanniemae.com/media/20371/display

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/privacy-policy/
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/state-privacy/
Title: State Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/disclosures-licenses/
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/ad-targeting/
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://www.starleafsquare.com/o-nrpx-d41-18fc5e526fb936daac7301f127413de5
Title: Unsubscribe

Search URL Search Domain Scan URL

URL: https://marketing.lowermybills.com/api/marketing/redirect?uid=214966&prd=MS
Title: Go To LowerMyBills

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://refinance.quikcenioans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5 HTTP 302
https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1699994803966 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1699994803966

Request Chain 27

https://cm.everesttech.net/cm/dd?d_uuid=24262592977798601211226405558475865174 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZVPctAAAAKKI6wNn

Request Chain 28

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=24262592977798601211226405558475865174 HTTP 302
https://dpm.demdex.net/ibs:dpid=21&dpuuid=216853104700004932073

Request Chain 29

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjQyNjI1OTI5Nzc3OTg2MDEyMTEyMjY0MDU1NTg0NzU4NjUxNzQ= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjQyNjI1OTI5Nzc3OTg2MDEyMTEyMjY0MDU1NTg0NzU4NjUxNzQ=&google_tc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKLiiQObdFAOIeKcLJ5BzDc&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 30

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEEsszgbfVXTbYidmVIGbSm0&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 65

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEEsszgbfVXTbYidmVIGbSm0&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 78

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESEEsszgbfVXTbYidmVIGbSm0&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 83

https://rp.liadm.com/j?dtstmp=1699994804996&aid=a-06d7&se=e30&duid=ddc3c751f117--01hf7sc8e2c7bcx17v8eaxpg7k&tna=v2.11.1&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&wpn=lc-bundle HTTP 302
https://rp4.liadm.com/j?se=e30&duid=ddc3c751f117--01hf7sc8e2c7bcx17v8eaxpg7k&aid=a-06d7&tna=v2.11.1&dtstmp=1699994804996&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&i6=MjAwMTphYzg6MjA6M2EwMDoxMDEyOjM2ZWI6YjdmNToyY2Zj

Request Chain 94

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESEEsszgbfVXTbYidmVIGbSm0&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 122

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEEsszgbfVXTbYidmVIGbSm0&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 123

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEEsszgbfVXTbYidmVIGbSm0&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 127

https://cm.everesttech.net/cm/yh HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZVPctAAAAKKI6wNn&sigv=1&esig=1~97fb42167a52d5d5bb04de252c58f3f78b1b1ff0

Request Chain 128

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WlZQY3RBQUFBS0tJNndObg==

Request Chain 131

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZVPctAAAAKKI6wNn&expires=90

Request Chain 133

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZVPctAAAAKKI6wNn HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZVPctAAAAKKI6wNn&C=1

Request Chain 134

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=ZVPctAAAAKKI6wNn HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZVPctAAAAKKI6wNn

Request Chain 135

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZVPctAAAAKKI6wNn

Request Chain 136

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZVPctAAAAKKI6wNn

Request Chain 137

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZVPctAAAAKKI6wNn&img=1

Request Chain 138

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZVPctAAAAKKI6wNn&t=2592000&o=0

144 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
refinance.quickenloans.com/
Redirect Chain

https://refinance.quikcenioans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269...
https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269...

124 KB
26 KB

1032ms
908ms

Document
text/html

2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

d58d7f14f0a7d11c1b0c4bb8472bd96b15f26ae5a81c3db4a2c607113e4e24ec

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 82621af628139232-FRA
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Tue, 14 Nov 2023 20:46:42 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 82621af3b8c21a49-FRA
content-type: text/html; charset=UTF-8
date: Tue, 14 Nov 2023 20:46:41 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ub5f2S50FBxKpA%2FTUMbkoXrT3aEJ3H%2BJlHjDkhZ6ztbDSFIHJOo58GuDFSanh6WDxed88R6S4uYpP88DQkR08f5tsg0RAmHSPe9H6wcbetUSXoI4hpwxj5sVA0hGMB5LZgJzT2U2KbggYG9%2FDvNwN108KEkihfre5A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 main.23145de2854537d36da0.css
static-msql-prod.refinance.quickenloans.com/ 199 KB
27 KB 76ms
52ms Stylesheet
text/css 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83e8661b82056e8dfae4674c9afdf51abbd4e74107e79adba875f52953d25c9c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:42 GMT
x-amz-version-id: FOjbqty_E2NEYbrrOTbIMXlARU6HWZjE
content-encoding: gzip
cf-cache-status: REVALIDATED
via: 1.1 eaedf92fd05c53aa96f20b6322b473e6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P3
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Sat, 11 Nov 2023 04:25:22 GMT
server: cloudflare
etag: W/"f1e53906815d6e2ed25700a1c88a4d3c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 82621afc0ca49232-FRA
x-amz-cf-id: -rh8KSC1qRAa-lISncZfcw-jWD68zH9lss836ByvdH7K24-RTtXs0Q==
expires: Wed, 15 Nov 2023 00:46:42 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 21 KB
7 KB 58ms
15ms Script
application/x-javascript 108.156.2.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.2.81 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-156-2-81.mxp63.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 14 Nov 2023 02:50:48 GMT
via: 1.1 6b552294ba6a60cc56d1bc328f57165e.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP63-P4
age: 64555
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6759
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Oct 2023 12:27:20 GMT
server: AmazonS3
etag: "15864ce88fa79a3e954417d0c3396798"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: Kx_Y3ik9SmADdRMgcULZ3ZrtNSQR5xXU0t7iy4vFx28OCs_BD3J32Q==

GET
H2 200 dacs.js Show response
cs-cdn.deviceatlas.com/ 21 KB
22 KB 376ms
28ms Script
application/javascript 52.58.191.183
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cs-cdn.deviceatlas.com/dacs.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

52.58.191.183 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-58-191-183.eu-central-1.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

fe49fc14b70cfc4f3edbc08e58087ca0f6e948a953c3eaeabdc7e78f512e5a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:42 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 09 Nov 2023 13:50:26 GMT
server: nginx/1.17.9
accept-ch: DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data
etag: "610a4ab640dd5cfa6750aa2623357f51"
x-cache: HIT
content-type: application/javascript
cache-control: no-cache
accept-ranges: bytes
content-length: 21909
expires: Tue, 14 Nov 2023 20:46:41 GMT

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
560 B 721ms
696ms Script
application/javascript 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53c66fbcad8a3c1f0b77327c59b9f94c7efb0d66c781bc71af60661d8b8570a2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-9217ef20f586bcf2da1d.js
date: Tue, 14 Nov 2023 20:46:43 GMT
via: 1.1 4f516e51d4c38a41272c9098bf829774.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: AMS50-C1
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Nov 2023 20:36:37 GMT
server: cloudflare
etag: W/"2ed36d36ecb033adf89b1e119b18aa3f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 82621afc0ca69232-FRA
x-amz-cf-id: vgCrDv35fFJrtcnMol5SkaKK1df28168P82hpueUzlBfktfXR9LCfA==
expires: Wed, 15 Nov 2023 00:46:43 GMT

GET
H2 200 launch-099982a746cc.min.js Show response
assets.adobedtm.com/b14636b10888/a3ec7ef1f366/ 257 KB
81 KB 103ms
60ms Script
application/x-javascript 2a02:26f0:3500:2a7::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:2a7::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:42 GMT
content-encoding: gzip
last-modified: Mon, 02 Oct 2023 19:55:09 GMT
server: AkamaiNetStorage
etag: "b31a1f9e9f88d2133e2b3a9abeeddcd7:1696276509.604687"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 14 Nov 2023 21:46:42 GMT

GET
H2 200 623bac6703b37600138f67a3 Show response
api.pushnami.com/scripts/v1/push/ 87 KB
18 KB 42ms
12ms Script
application/javascript 13.32.99.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-40.fra60.r.cloudfront.net
Software: /
Resource Hash: 6596ea36bf758c2f1d6dd8d40249ab6dae02d46a4aa02c393d65acb0fab0866f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:45:50 GMT
content-encoding: gzip
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
age: 53
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: OXY_a2yizYFE5i744XKWwjj5LpsUwhA_mQiTZoSB5MW48dsLXcUU0Q==

GET
H2 200 stack-ssi
fonts.cdnfonts.com/css/ 1 KB
713 B 352ms
125ms Stylesheet
text/css 2606:4700:e2::ac40:8416
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/stack-ssi
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8416 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6659e8919d1cde02448dce70dfd9ef0d9b3ba4d416fd904ab564baff472c1ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:42 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 26 Oct 2023 17:36:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1653033
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X5E1BmBoXcjRtQGcll%2FdUDLJqEn5JsHa84R2HRQts%2Fgspv49eYFQipoWRTIN2Q7%2BVdb5IOOOeGBWA2CMdvi9XTmkLuwamcXDSiaatSfPUTjQeF3RZezTkxkqOVLR0LtOXvviB%2FCkHA9pQ8gFvQAfxj4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 82621afe1f8d0631-IAD
alt-svc: h3=":443"; ma=86400

GET
H2 200 css2
fonts.googleapis.com/ 875 B
499 B 65ms
25ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0dd1971699f19f33219608023cd1f3294e8c0bed22cd575610c85644e5942271

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 14 Nov 2023 20:46:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 20:46:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Nov 2023 20:46:42 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 63ms
24ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ead030154a651dbf216d5c043e974bb3f78b640078472f63d4277db7deb1faae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 14 Nov 2023 20:46:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 20:45:18 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Nov 2023 20:46:42 GMT

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
812 B 65ms
26ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0a62530dd1701bdc8d1b3ece6ee812c57c812833d0eecc9163987c8a211b52f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 14 Nov 2023 20:46:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 20:46:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Nov 2023 20:46:42 GMT

GET
H2 200 css2
fonts.googleapis.com/ 427 B
376 B 65ms
26ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 14 Nov 2023 20:46:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 20:46:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Nov 2023 20:46:42 GMT

GET
H2 200 main.23145de2854537d36da0.js Show response
static-msql-prod.refinance.quickenloans.com/ 793 KB
199 KB 41ms
40ms Script
application/javascript 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0519f420dc13e257dd35cc2c20dde8dab78f2ae40d16943a90b230c5cb430ae9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:43 GMT
x-amz-version-id: Qj9wTQXwiSagXiCRS_dr91j4ST_CNxKP
content-encoding: gzip
cf-cache-status: MISS
via: 1.1 456733511c088f8435091e663b2c5430.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P3
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 13 Nov 2023 16:12:01 GMT
server: cloudflare
etag: W/"24edf33e3703e07b30c725bdfcee444c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 82621affcf439232-FRA
x-amz-cf-id: 4hb3qvWOcNT_IzxRSzuD2rarcMtOg1ytY9eh8kZ2YjXFz1ckoq6quQ==
expires: Wed, 15 Nov 2023 00:46:43 GMT

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 104ms
71ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:43 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 82621b009a21bb7a-FRA

GET
H2 200 pixel-9217ef20f586bcf2da1d.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 161 KB
21 KB 678ms
677ms Script
application/javascript 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1a21b72f3aaa0b532aebe5e228e1aaa07bb90b2b84a51c762c410a8c50abfdf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:43 GMT
content-encoding: gzip
via: 1.1 a2cac9c5f0e90f8b7fede4ac9aca75ca.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P4
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 13 Nov 2023 17:50:55 GMT
server: cloudflare
etag: W/"b51b664cb1b6e7633bbc963569679f7b"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 82621b007fe19232-FRA
x-amz-cf-id: y79cSiX2sAD3K5xeoOG-vbC3qGwSxlYksp85okM0fKqu7GF7TdY8lg==
expires: Wed, 15 Nov 2023 00:46:43 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1699994803966
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1699994803966

4 KB
2 KB

34ms
34ms

XHR
application/json

52.211.35.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1699994803966

Requested by

Protocol

Server

52.211.35.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-211-35-76.eu-west-1.compute.amazonaws.com

Software

Resource Hash

c274f0f115069318fd860ed86791936276da8ca856c420c0d31a79967184d81f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v054-005f0e6d9.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: AuHgsMxqQaw=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 1254
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v054-011e9d9b8.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: pNpsTuueQuQ=
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1699994803966
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 102ms
36ms Script
application/javascript 108.138.181.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.181.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-181-64.mxp64.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
via: 1.1 3e6bcbe331beee2f38e13259af01af8e.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: MXP64-P1
age: 1
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: _BPkokt5XiSZSi7NS0FquKS7jyIYeP99zRkiPpoETByxORo5Bg6q_w==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 220 KB
79 KB 47ms
23ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6eb36dbb58898babc1b1bf95608f3b539af1164bb86ffee3bb7fa792978e00ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80205
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 270 KB
90 KB 27ms
26ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4968f5b2103c7562c987a19487da840320056091a24efde004fb3f25a48f2ec0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92252
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 14 Nov 2023 20:46:44 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
261 B 47ms
17ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je3b81v9169491831z89137104487&_p=1699994803979&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1841459884.1699994804&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1699994804&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2951
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 34ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je3b81v9169491831z89137104487&_p=1699994803979&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1841459884.1699994804&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1699994804&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=cdm_source_id&ep.source=lmb-54867-113582-409&_et=2&tfd=2964
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hub Show response
api.pushnami.com/scripts/v1/ Frame 2EAE 2 KB
1 KB 7ms
7ms Document
text/html 13.32.99.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-40.fra60.r.cloudfront.net

Software

Resource Hash

2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 2113
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Tue, 14 Nov 2023 20:11:31 GMT
vary: accept-encoding
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
x-amz-cf-id: sPNbSRTNmzHsiGq98Nv16aSDSLNDn5Ri4aTudQ8ZARnTO2UqK5n1tQ==
x-amz-cf-pop: FRA60-P3
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 5 KB
3 KB 285ms
285ms XHR
application/json 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

52f243d57d00c4be0d55c23e8694028e115a7a586f1d356fa6ed126ec9479a51

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
accept-language: de-DE,de;q=0.9
Authorization: Bearer null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"138b-FaAf5xMC6N+JWddNfR/R7OlwytQ"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 82621b061d039232-FRA
x-xss-protection: 1; mode=block

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
178 B 17ms
17ms XHR
text/plain 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
content-type: application/json

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 82621b061d049232-FRA

OPTIONS
H2 204 psp
psp.pushnami.com/api/ Frame 0
0 749ms
359ms Preflight 35.173.79.120
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.173.79.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-79-120.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

access-control-allow-headers: key
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
date: Tue, 14 Nov 2023 20:46:44 GMT
vary: Access-Control-Request-Headers
x-powered-by: Express

POST
H2 200 psp Show response
psp.pushnami.com/api/ 2 B
152 B 134ms
134ms Fetch
text/html 35.173.79.120
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.173.79.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-79-120.compute-1.amazonaws.com
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Tue, 14 Nov 2023 20:46:45 GMT
x-powered-by: Express
content-length: 2
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type: text/html; charset=utf-8

GET
H2 200 dest5.html Show response
quicken.demdex.net/ Frame DEF4 7 KB
3 KB 34ms
33ms Document
text/html 52.211.35.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.211.35.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-211-35-76.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 14 Nov 2023 20:46:44 GMT
dcs: dcs-prod-irl1-1-v054-06695c737.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 8 Nov 2023 21:00:41 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: vE7LIef+Tuo=

GET
H2 200 id Show response
somni.rocketmortgage.com/ 48 B
471 B 80ms
20ms XHR
application/x-javascript 63.140.62.135
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.rocketmortgage.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=24429965397457649451245694768477042846&ts=1699994804186

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.135 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-135.data.adobedc.net

Software

jag /

Resource Hash

b5474127bd757be40f01f2f8043666c0bae3390b56a20a0deff8eaaeb8b319f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H2

200

ibs:dpid=411&dpuuid=ZVPctAAAAKKI6wNn
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=24262592977798601211226405558475865174
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZVPctAAAAKKI6wNn

42 B
717 B

42ms
41ms

Image
image/gif

52.211.35.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZVPctAAAAKKI6wNn

Protocol

Server

52.211.35.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-211-35-76.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-01efdb06c.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: YgaexGuYSMo=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZVPctAAAAKKI6wNn
Date: Tue, 14 Nov 2023 20:46:44 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2

200

ibs:dpid=21&dpuuid=216853104700004932073
dpm.demdex.net/ Frame DEF4
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=24262592977798601211226405558475865174
https://dpm.demdex.net/ibs:dpid=21&dpuuid=216853104700004932073

42 B
717 B

37ms
36ms

Image
image/gif

52.211.35.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=21&dpuuid=216853104700004932073

Protocol

Server

52.211.35.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-211-35-76.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-0a80e641c.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: Vvab7u6aTdk=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dpm.demdex.net/ibs:dpid=21&dpuuid=216853104700004932073
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
expires: 0

GET
H2

200

ibs:dpid=771&dpuuid=CAESEKLiiQObdFAOIeKcLJ5BzDc&google_cver=1
dpm.demdex.net/ Frame DEF4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjQyNjI1OTI5Nzc3OTg2MDEyMTEyMjY0MDU1NTg0NzU4NjUxNzQ=
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjQyNjI1OTI5Nzc3OTg2MDEyMTEyMjY0MDU1NTg0NzU4NjUxNzQ=&google_tc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKLiiQObdFAOIeKcLJ5BzDc&google_cver=1?gdpr=0&gdpr_consent=

42 B
717 B

38ms
38ms

Image
image/gif

52.211.35.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKLiiQObdFAOIeKcLJ5BzDc&google_cver=1?gdpr=0&gdpr_consent=

Protocol

Server

52.211.35.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-211-35-76.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-0403cf5e4.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 9t8WMmsyQFg=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKLiiQObdFAOIeKcLJ5BzDc&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame DEF4
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEEsszgbfVXTbYidmVIGbSm0&google_cver=1
https://pixel.everesttech.net/1x1

128 B
796 B

35ms
35ms

Image
image/png

52.17.3.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.17.3.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-3-61.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 20:46:44 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 14 Nov 2023 20:46:44 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
981 B 156ms
49ms Image
image/png 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
via: 1.1 dc85053069397a282d87170bb1bcab4a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Mon, 13 Nov 2023 06:33:03 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 82621b088edf9232-FRA
x-amz-cf-id: gMb3yYptFVOGAFaZRuvF-gs0ewObCFKNq2bMxaRb0MJhULvxVetaGQ==
expires: Wed, 15 Nov 2023 00:46:44 GMT

GET
H2 200 overlay-close.svg
content.refinance.quickenloans.com/msql/EdisonOverlay/ 586 B
543 B 165ms
59ms Image
image/svg+xml 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/EdisonOverlay/overlay-close.svg

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
via: 1.1 c3fc8d1fb362a6655af993732c376dc4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 13 Nov 2023 12:43:20 GMT
server: cloudflare
etag: W/"58887760fe01f3933d5ae2d7bcc3f373"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 82621b088ee09232-FRA
x-amz-cf-id: 0Vu-t0vLVkgOM9Rr_LEtucPoKMa6hpt4XwbzfKu8X7xXUS9sc6WwcQ==
expires: Wed, 15 Nov 2023 00:46:44 GMT

GET
H2 200 qllogo.png
content.refinance.quickenloans.com/msql/ 4 KB
4 KB 158ms
53ms Image
image/png 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/qllogo.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
via: 1.1 6c2674fb15c38f5458794dd680986b8e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 3877
x-xss-protection: 1; mode=block
last-modified: Fri, 10 Nov 2023 15:38:41 GMT
server: cloudflare
etag: "277055237f3837abfae204219c13fa6c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 82621b088eda9232-FRA
x-amz-cf-id: 7REbx4p1TXwn8M0sf5MAxVZCatx-aaoXWtRALWQPqPY3RZJ5dKs7Bg==
expires: Wed, 15 Nov 2023 00:46:44 GMT

GET
H2 200 redarrow1.png
content.refinance.quickenloans.com/msql/ 7 KB
7 KB 156ms
50ms Image
image/png 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/redarrow1.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
via: 1.1 ecb3ea567a6c6095a23354fbdc938128.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 6656
x-xss-protection: 1; mode=block
last-modified: Fri, 10 Nov 2023 15:38:41 GMT
server: cloudflare
etag: "55eb59d4535de0b41be9b7465ec7d9c3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 82621b088ed89232-FRA
x-amz-cf-id: 7jI-nIV2x6S6FOv9XJUu0g7_bxwxwS2a8x9BZG5FEPp7T3f4fdGh6A==
expires: Wed, 15 Nov 2023 00:46:44 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
32 KB 132ms
20ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Thu, 09 Nov 2023 18:19:05 GMT
x-content-type-options: nosniff
age: 440859
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Nov 2024 18:19:05 GMT

GET
H2 200 4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2
fonts.gstatic.com/s/shadowsintolighttwo/v17/ 15 KB
16 KB 128ms
16ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/shadowsintolighttwo/v17/4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 16:42:53 GMT
x-content-type-options: nosniff
age: 533031
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15832
x-xss-protection: 0
last-modified: Thu, 24 Aug 2023 20:34:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Nov 2024 16:42:53 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 194 KB
71 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b879a120bb52e45c7a4aed4e5532c00a6754ef932e98a1be617b626b1b7f7aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72278
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ Frame 9881 4 KB
2 KB 94ms
6ms Script
application/javascript 2a02:26f0:7100:789::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:789::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: ef45c21f7e054481c81992c1a46293a28c9bb8b3722bc566479326187f473c8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

akamai-x-true-ttl: 7200
content-encoding: br
x-cdn: akamai
etag: "8d7d8ce32aa2a45d64e9f04a9a5cb1c4"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 1793

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 28ms
28ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cb265cef0cdde168183a311e1d257bb00ebede2a32820572ae20ce5a62e2f63b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67267
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 9881 202 KB
54 KB 94ms
7ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 14 Nov 2023 20:46:44 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: +8UZinM9JQQcpKFFxX0Fq3L9bBh3xL0r43dk67BSTzhInG7QM03HhYIZ4fF5d334ZKmGGuEFiL+34yhV5ILt3g==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
ads.revjet.com/ Frame 9881 19 KB
8 KB 158ms
40ms Script
application/javascript 65.109.98.102
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 65.109.98.102 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.102.98.109.65.clients.your-server.de
Software: nginx /
Resource Hash: 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: gzip
last-modified: Thu, 20 Jul 2023 19:19:32 GMT
server: nginx
etag: W/"64b988c4-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Tue, 14 Nov 2023 20:56:44 GMT

GET
H2 200 a-06d7.min.js Show response
b-code.liadm.com/ Frame 9881 47 KB
15 KB 105ms
20ms Script
application/javascript 2600:9000:225e:7a00:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:7a00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dfe95d6caa54f07ba9b49b18abc39a75fea04ae82b23a9b99dcfa8036d3c6421

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 12:30:54 GMT
content-encoding: gzip
via: 1.1 5b21c56dde1a436b4b6766d2406627d2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
age: 29750
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: mhDtmttAogHeBsqoPswQa7a992oCS21HtKn941MxR7GNBOyz-swb8g==

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 50 KB
19 KB 163ms
78ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

34eace17373618f0ef6ad0052c607c2b3a6c02af6a6e0a1d16fa15efb97c139d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18823
x-xss-protection: 0
server: cafe
etag: 4145344891725561964
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 202 KB
73 KB 32ms
31ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b115f2a2c595f674c520f50628824dac12ca4b1dc3ecca6426e6a49d580a4f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74341
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1390358/ Frame 9881 64 KB
20 KB 219ms
136ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 23e9b9449e428772001f22e230c11dcb018b33441b1074a10391c0e1fbc88ce2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-amz-version-id: XcOQ6wp2zv1y.qT3V80wbDyZkoRu2FUJ
content-encoding: gzip
via: 1.1 varnish
date: Tue, 14 Nov 2023 20:46:44 GMT
x-amz-request-id: KBH79H3JPPMMBG5K
age: 27033
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
fastly-restarts: 1
x-amz-id-2: AXzZB9uWyfxVkuNfak+38ZUtRHS31n94uboMd3mfGVNwHLuV8ANg+vnF03CE77NDxDQYJMSSe7c=
x-served-by: cache-fra-eddf8230090-FRA
content-length: 19523
last-modified: Tue, 14 Nov 2023 13:14:57 GMT
server: AmazonS3
x-timer: S1699994805.576633,VS0,VE129
etag: "ce048021c9b4cca62a7c7f1d8a66add5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 87
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 772

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 202 KB
73 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d5fa4d0a688648c44990c30ea43421c1e9d2673aa8a46c3be65cfb30f5f7bff1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74247
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 202 KB
73 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3c55cd3fb294791215bb0be21defd42d4b61c4eb28a670c10f54be823145bbea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74401
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
80 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11388547050

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eabd357c31110ddee72bc72488f6bc95bea1848042b11889d3ba7af9f2ad9e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81751
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 deviceAtlasLmb.min.js Show response
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame 9881 8 KB
3 KB 899ms
820ms Script
application/javascript 2606:4700::6812:94b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:94b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com
p3p: CP="NON DSP COR LAW CONi TELi OUR SAM IND CNT"
x-xss-protection: 1; mode=block
last-modified: Fri, 21 May 2021 02:42:28 GMT
server: cloudflare
etag: W/"20fc-5c2ce02c32fd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 82621b089bfd65d3-FRA
expires: Wed, 15 Nov 2023 00:46:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 206 KB
74 KB 30ms
30ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9296b9b930c75d444fa5c1cb60fe857648f3a2de3ddf0b7a3e6d19239e0e8e35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75358
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 202 KB
73 KB 38ms
38ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

050f5e831a79d1d622bdf0611ebcd10c91f186208a0cde464349733d0df5e8cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74404
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 206 KB
74 KB 33ms
33ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ecc0ea32675d5db78a0a6d0626e12dc619fdad460d473b6166894d14cc654d6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75341
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
80 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11380533681

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d60e5df9737467ba7c22c3791a5f5591f48f8ad7d9bfcbd7540fb4ea477ecd39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81829
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame 9881 39 KB
17 KB 160ms
60ms Script
application/javascript 3.162.38.245
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.38.245 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-38-245.cdg52.r.cloudfront.net
Software: CloudFront /
Resource Hash: 1339d97cacf1c9e291a7b552e853a97abd2b294cdec06935e6f6ec0bbf4a0728

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: gzip
via: 1.1 9c28a4cfd39f1c1e72b45d8c2f7c9d26.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: CDG52-P6
x-cache: Miss from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 16941
x-amz-cf-id: hmRc6O6RZrHM9gd0vpcXXJDfXRn7GUGEisQqmTg_T2gSEW4CjqqH9Q==

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ Frame 9881 18 KB
7 KB 86ms
15ms Script
application/javascript 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:38 GMT
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: 2KXE61F630QBV967
age: 7
x-amz-server-side-encryption: AES256
x-amz-id-2: HLinmE2fiaqTSeuLJkdse1ubUoUhNz95+umHp8owY071PwXiXDuJj6naINJz6k/3+nWZS6z3u2lxfmPkXnVtrH0J3fUUmUOo
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
server: ATS
etag: "5c6ed25dce803fd84288922b8928409e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 206 KB
74 KB 30ms
30ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8b188996cbd0eec651238aa848787993fa58133624e7faff28e0894c13116dd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75448
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 src Show response
c.pmsrv.co/v2/conversion/ Frame 9881 3 KB
4 KB 539ms
479ms Script
text/javascript 2600:9000:206f:3200:a:8e7d:9900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:3200:a:8e7d:9900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash: 3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
via: 1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 3435
x-amz-cf-pop: FRA56-C1
x-amzn-requestid: 4681d0c2-8a79-4a9c-96fe-b37163a54470
x-amzn-remapped-connection: close
x-powered-by: Express
x-cache: Miss from cloudfront
x-amz-apigw-id: OZ9sVESbSK4EGbg=
content-length: 3435
pragma: no-cache
etag: W/"d6b-sia6N7ids5ScRDuTaHkjdTsJcfc"
x-amzn-trace-id: Root=1-6553dcb5-25062b326bf1ad943baae786;Sampled=0;lineage=c8fdcb33:0
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
x-amzn-remapped-date: Tue, 14 Nov 2023 20:46:45 GMT
x-amz-cf-id: a2wmeDLPCvAcjr-aR9j9QaSzxYVfFEW9Ts-7jHvtmBIcnLi_lVJZwg==
expires: -1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 202 KB
73 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4e05b21f2ea5f497b4c3763f0d81bd5de900d8394ac88eb8b6a88b471d367ad1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74395
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 60 KB
19 KB 184ms
116ms Script
text/javascript 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9217ef20f586bcf2da1d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 00bfb9da74d6c2c325c27e60fc9aea44f272cba1b072ad7b2ba4a805c3e8d555

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: ffcf7c2a-ea5a-4bf5-8a55-73c5ffcd0707
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 ip Show response
refinance.quickenloans.com/api/geo/ 161 B
236 B 290ms
289ms XHR
application/json 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/geo/ip

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

50720620cf7e9ce770da56c1b14dc195dc82b8196bda291ddaeaebd9f44576c9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"a1-Wapz41YDp04BVkovl+Eu+shBoSc"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 82621b084ea79232-FRA
x-xss-protection: 1; mode=block

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
133 B 868ms
866ms XHR
text/plain 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 82621b084eac9232-FRA
content-length: 2
x-xss-protection: 1; mode=block

GET
H2 200 quicken_sprite_4_4_18.png
content.refinance.quickenloans.com/msql/ 75 KB
75 KB 92ms
57ms Image
image/png 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/quicken_sprite_4_4_18.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 76537
x-xss-protection: 1; mode=block
last-modified: Fri, 10 Nov 2023 15:38:41 GMT
server: cloudflare
etag: "1f80b3d1f05cc5648c262fba9d39b61a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 82621b088edd9232-FRA
x-amz-cf-id: xQvkI6Pg10bSYJkOLODuLt7k_bJ28JuN1H1LaYyJ6bSwlInHG-NFqA==
expires: Wed, 15 Nov 2023 00:46:44 GMT

POST
H2 200 interact Show response
adobedc.demdex.net/ee/v1/ 1 KB
1011 B 143ms
65ms Fetch
application/json 63.140.62.214
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://adobedc.demdex.net/ee/v1/interact?configId=b1d8d3c2-1fda-4646-9d8a-484cec8d3f55&requestId=9e3807ea-d523-4849-a8be-a1495597ff98

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.214 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-214.data.adobedc.net

Software

jag /

Resource Hash

a0ba99855a35218e2432e543683e24171f33537761055ed09be59578520d9399

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: jag
vary: Origin
content-type: application/json;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Retry-After, X-Adobe-Edge, X-Request-ID
x-adobe-edge: IRL1;6
access-control-allow-credentials: true
x-konductor: N/A
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-request-id: 9e3807ea-d523-4849-a8be-a1495597ff98

GET
H2 200 request.js Show response
script.anura.io/ 55 KB
20 KB 171ms
91ms Script
application/javascript 18.135.137.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/request.js?instance=3439535758&exid=60470365-4832-535d-acab-43ae67d306ba&source=lmb-54867-113582-409&campaign=44&601121851822

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.23145de2854537d36da0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.135.137.77 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-135-137-77.eu-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

d435ed1fbca08de3a40833bc4301e231a7e254414d1222364306d04e046b7f2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame DEF4
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEE...
https://pixel.everesttech.net/1x1

128 B
691 B

35ms
35ms

Image
image/png

52.17.3.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.17.3.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-3-61.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 20:46:44 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 14 Nov 2023 20:46:44 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 main.74d80534.js Show response
s.pinimg.com/ct/lib/ Frame 9881 65 KB
19 KB 7ms
7ms Script
application/javascript 2a02:26f0:7100:789::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.74d80534.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:789::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 60cc60a6fcbd230def379432395199b585791ed521e2e5f595369a2193e617fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

akamai-x-true-ttl: 1209600
content-encoding: br
x-cdn: akamai
etag: "cb251578b1e91b3cc440fd1521770cc5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 18895

GET
H2 200 10182570.json Show response
s.yimg.com/wi/config/ Frame 9881 46 B
701 B 137ms
111ms XHR
application/json 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10182570.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
x-amz-version-id: 1ZYINFOniub0Ev0M8D_80wuqsJ9ajO51
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-request-id: PQSV888S71YN3M6C
age: 0
x-amz-server-side-encryption: AES256
content-length: 46
x-amz-id-2: rdAv3OxxlvcIp8UF03l8fWnIg9sOYizICeMmN2qsCSlrk8sDjIf6MYX2Jg+aPELUMA5HZhHb4u8EZPX9iKa8EZxEOu6W6RYh1DjAeMG7IFg=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 19 Dec 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Nov 2023 20:38:55 GMT
server: ATS
etag: "f31aca15ae5b24f87583e3de167c9828"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 1736491679707345 Show response
connect.facebook.net/signals/config/ Frame 9881 115 KB
31 KB 140ms
140ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1736491679707345?v=2.9.138&r=stable&domain=refinance.quickenloans.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fee6efd88421ec6ef4ae03c305f40a7584fc72a1882b84afe829f08e9e031a68

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 14 Nov 2023 20:46:44 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: XMMwFZvrVz+Bh96XlDNxOkDc9drNAJP5tDmF6q2ChGcRpmK0zI1tz+rPRmXZXiLoyfOEMwdgzOHpUCO8giZuLw==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 194 KB
71 KB 24ms
24ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fb1cb928b1a68f9e4b20213a51edb62396c3e21b58b586e8514bb9598665397c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72217
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 14 Nov 2023 20:46:44 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 3 KB
2 KB 43ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1699994804704&cv=11&fst=1699994804704&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca1fff728f0ea8e7b11b0e508bc4c43927aea4c04f94516d3e828461c0e7300f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1395
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 3 KB
1 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1699994804733&cv=11&fst=1699994804733&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-700319321

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

96ada9bedfdb1f5a4eb57e55c0bfb50b9c0ffb736435bce8568bed3a030c6a97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11388547050/ 3 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11388547050/?random=1699994804777&cv=11&fst=1699994804777&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11388547050

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1c55751b1b1ae1514f4d12d4b8435db9b06e2d8fc75b4a24e07b70adb85f2d3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1395
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 3 KB
1 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1699994804807&cv=11&fst=1699994804807&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-813495030

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

861c991ecc36d7ee01d015ba66ec62421862e0a621b3a216ab3fb8af307fc562

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1390
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 3 KB
1 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1699994804831&cv=11&fst=1699994804831&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e93d2b723f88a862141b1f90227046fbc48dc8aa261b27d501c2fa80c3b07ea3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1393
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/ 3 KB
1 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/?random=1699994804854&cv=11&fst=1699994804854&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-755089552

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43c125935df3e3d7b3a0e5b2c9c8d6b13c1c55433c6fc77199619ca2be12e67c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 3 KB
1 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1699994804880&cv=11&fst=1699994804880&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-865435318

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c75e8e5fd6eea9b973a59097b8a8eb4d09b67baaec481d096e4a07f0426c04ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1395
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/ 3 KB
1 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/?random=1699994804901&cv=11&fst=1699994804901&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bfd8add66198494d7458de03d748b04f1a269e1ccb4734507c892b9dc075f2f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame DEF4
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
691 B

35ms
35ms

Image
image/png

52.17.3.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.17.3.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-3-61.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 20:46:45 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 14 Nov 2023 20:46:44 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/ 3 KB
1 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/?random=1699994804928&cv=11&fst=1699994804928&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e04ebe92fdbf7da46bf7e6ea1c74ddab006a1538d5939d2406e057c94597f23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1395
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 3 KB
1 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1699994804951&cv=11&fst=1699994804951&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-857412364

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f9a2aecd5d5a63aa7c05140d086643b0e3e607c0f1d7bb45cdcb6b94dbcd4591

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1393
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame 9881 43 B
635 B 111ms
33ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2014%20Nov%202023%2020%3A46%3A44%20GMT&n=-1&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&e=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&enc=UTF-8&yv=1.15.1&isIframe=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 14 Nov 2023 20:46:45 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame 9881 43 B
245 B 111ms
33ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&e=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&enc=UTF-8&yv=1.15.1&isIframe=1&et=custom&ec=pg1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 14 Nov 2023 20:46:45 GMT

GET
H2

200

j Show response
rp4.liadm.com/ Frame 9881
Redirect Chain

https://rp.liadm.com/j?dtstmp=1699994804996&aid=a-06d7&se=e30&duid=ddc3c751f117--01hf7sc8e2c7bcx17v8eaxpg7k&tna=v2.11.1&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26p...
https://rp4.liadm.com/j?se=e30&duid=ddc3c751f117--01hf7sc8e2c7bcx17v8eaxpg7k&aid=a-06d7&tna=v2.11.1&dtstmp=1699994804996&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpke...

13 B
318 B

431ms
131ms

XHR
application/json

44.216.119.239
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?se=e30&duid=ddc3c751f117--01hf7sc8e2c7bcx17v8eaxpg7k&aid=a-06d7&tna=v2.11.1&dtstmp=1699994804996&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&i6=MjAwMTphYzg6MjA6M2EwMDoxMDEyOjM2ZWI6YjdmNToyY2Zj
Protocol: H2
Server: 44.216.119.239 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-216-119-239.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
x-pixel-event-id: 5f09f497-fc91-44ef-a176-0f02362bf9a6
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: null
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 13

Redirect headers

location: https://rp4.liadm.com/j?se=e30&duid=ddc3c751f117--01hf7sc8e2c7bcx17v8eaxpg7k&aid=a-06d7&tna=v2.11.1&dtstmp=1699994804996&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&i6=MjAwMTphYzg6MjA6M2EwMDoxMDEyOjM2ZWI6YjdmNToyY2Zj
access-control-allow-origin: https://refinance.quickenloans.com
date: Tue, 14 Nov 2023 20:46:45 GMT
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET

GET
H2 200 / Show response
ct.pinterest.com/user/ Frame 9881 303 B
716 B 788ms
218ms XHR
application/json 2.19.244.226
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&cb=1699994805009&dep=2%2CPAGE_LOAD

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.74d80534.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.244.226 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-19-244-226.deploy.static.akamaitechnologies.com

Software

Resource Hash

4e7140f58b2b89a1c8ffba6df69a1e845f6e8fee48987276a7523b8244191c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.dcb20f17.1699994805.194e1515
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=600
content-length: 172
x-pinterest-rid: 3731099677292357
pin-unauth: dWlkPU9EWTROV1F5T0RndE5UbGtaUzAwTVRjNExUbG1OV1F0T0RsbFpHTmlNMkpoWkRFNQ
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: 5d3c2f1679281f2c8de82ecae570034b947dbf31
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pd2259 Show response
pix.revjet.com/track/ Frame 9881 46 B
224 B 61ms
11ms Script
text/javascript 46.4.76.120
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd2259?__noscript=false&__cbf=revjet.callbacks.cb1699994805011&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.76.120 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.120.76.4.46.clients.your-server.de
Software: /
Resource Hash: 1f88d3e6dd5f8b29e7f614da71e08bc9eb24f694fd2f5421070efeb3ef54f54a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 pd3876 Show response
pix.revjet.com/track/ Frame 9881 46 B
222 B 61ms
11ms Script
text/javascript 46.4.76.120
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd3876?__noscript=false&__cbf=revjet.callbacks.cb1699994805012&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.76.120 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.120.76.4.46.clients.your-server.de
Software: /
Resource Hash: b525176c325c24ef89c7729189be8c60cb70c128a57d32db236a2a3d016d5a94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
content-length: 46
content-type: text/javascript

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 9881 0
64 B 31ms
17ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1699994805029&ref=null&cv=20231114-18-RELEASE&tos=2&ssd=1&scd=0&mrir=u&vi=1699994805025
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-vcl-time-ms: 10
date: Tue, 14 Nov 2023 20:46:45 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7267
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230090-FRA
pragma: no-cache
server: nginx
x-timer: S1699994805.043124,VS0,VE10
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 9881 0
68 B 22ms
17ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1699994805038&ref=null&cv=20231114-18-RELEASE&tos=10&ssd=1&scd=0&mrir=u&vi=1699994805025
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-vcl-time-ms: 10
date: Tue, 14 Nov 2023 20:46:45 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7298
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230090-FRA
pragma: no-cache
server: nginx
x-timer: S1699994805.043149,VS0,VE10
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 9881 0
334 B 18ms
16ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1699994805042&ref=null&cv=20231114-18-RELEASE&tos=14&ssd=1&scd=0&mrir=u&vi=1699994805025
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-vcl-time-ms: 9
date: Tue, 14 Nov 2023 20:46:45 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7431
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230090-FRA
pragma: no-cache
server: nginx
x-timer: S1699994805.043133,VS0,VE9
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 /
ct.pinterest.com/v3/ Frame 9881 35 B
456 B 745ms
211ms Image
image/gif 2.19.244.226
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5%22%2C%22ref%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5%22%2C%22if%22%3Atrue%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%2274d80534%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1699994805046

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.244.226 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-19-244-226.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.dcb20f17.1699994805.194e1516
content-type: image/gif
access-control-allow-origin: *
pinterest-version: 5d3c2f1679281f2c8de82ecae570034b947dbf31
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 3
content-length: 35
x-pinterest-rid: 1363548457518049
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 interact Show response
somni.quickenloans.com/ee/irl1/v1/ 800 B
2 KB 177ms
123ms Fetch
application/json 2606:4700::6812:1ba3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/ee/irl1/v1/interact?configId=b1d8d3c2-1fda-4646-9d8a-484cec8d3f55&requestId=1305e44d-7ea9-459c-b6ba-c3a4ca21077d

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2606:4700::6812:1ba3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81da90d4443f7435771a6e04b1a83ca215141c1bb9cacb8cc826ba6e73772fe2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-adobe-edge: IRL1;6
x-xss-protection: 1; mode=block
x-request-id: 1305e44d-7ea9-459c-b6ba-c3a4ca21077d
server: cloudflare
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Retry-After, X-Adobe-Edge, X-Request-ID
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-konductor: N/A
cf-ray: 82621b0beecf65e0-FRA

GET
H2 200 showads.js Show response
ads.anura.io/ 0
350 B 60ms
13ms XHR
application/javascript 18.238.243.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.anura.io/showads.js?98386821295
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.243.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-243-27.ams58.r.cloudfront.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 11:34:49 GMT
content-encoding: gzip
via: 1.1 b10069b378f22e10f0382c21d0a9578e.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: AMS58-P1
age: 33116
vary: Accept-Encoding
x-cache: Hit from cloudfront
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: application/javascript; charset=utf-8
x-amz-cf-id: 43cyvszqKhJNMINwk_CjqusOtpfFcDvuq1oz7i7XGA2IAgMlaaivyA==

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/ 3 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/?random=1699994805134&cv=11&fst=1699994805134&bg=ffffff&guid=ON&async=1&gtm=45be3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=2052575055.1699994804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e80e9a23ab8043bbb4d265bded2f4dcece3a1172bd28f34aae1574f8e7df4fae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame DEF4
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

41ms
41ms

Image
image/png

52.17.3.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.17.3.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-3-61.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 20:46:45 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 14 Nov 2023 20:46:45 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 409e6a74-8d7f-465e-87b0-cc6eb99f3a76.js Show response
tr.snapchat.com/config/com/ Frame 9881 168 B
452 B 67ms
17ms Script
application/javascript 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/config/com/409e6a74-8d7f-465e-87b0-cc6eb99f3a76.js?v=3.4.19-2311140809

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

7dab8fbc8b1dd9da6c1559af2b4af2c968389b9d58931bc3fecd0a916dd41066

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google
server: API Gateway
content-type: application/javascript
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 168

GET
H2 200 i Show response
tr.snapchat.com/cm/ Frame 5F1E 0
201 B 66ms
18ms Document
text/html 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=409e6a74-8d7f-465e-87b0-cc6eb99f3a76&u_scsid=dd664430-f45a-4d7c-ac2e-95ce035dee85&u_sclid=8390867e-cbab-471c-a57e-cae3f9e608a7

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 14 Nov 2023 20:46:45 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
via: 1.1 google
x-envoy-upstream-service-time: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/865435318/ 42 B
455 B 42ms
19ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865435318/?random=1699994804880&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNjqSOILpz88USMgsusuPLP2CFVg9YAPHUkJAam90kCe2TwUhD&random=2454589823&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/865435318/ 42 B
108 B 51ms
19ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/865435318/?random=1699994804880&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNjqSOILpz88USMgsusuPLP2CFVg9YAPHUkJAam90kCe2TwUhD&random=2454589823&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10910338944/ 42 B
108 B 42ms
20ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10910338944/?random=1699994804901&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNpMpU-_u-T4M38LMV88PLy2B3cMTdKFSt-SkMDP-u7hP7qh03&random=291018087&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10910338944/ 42 B
108 B 51ms
20ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10910338944/?random=1699994804901&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNpMpU-_u-T4M38LMV88PLy2B3cMTdKFSt-SkMDP-u7hP7qh03&random=291018087&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
108 B 32ms
21ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1699994804704&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaN6yjUHsEudABiYoFXq3Cuq7JRIbXjcqG-G9ExopYGJnLaSH31&random=2685540800&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/966730890/ 42 B
455 B 39ms
19ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/966730890/?random=1699994804704&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaN6yjUHsEudABiYoFXq3Cuq7JRIbXjcqG-G9ExopYGJnLaSH31&random=2685540800&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/700319321/ 42 B
108 B 30ms
20ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/700319321/?random=1699994804733&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNMpb7HWkWNt_Ru5qkcoV9Ly3frIu9IbctOpK5610qWu-zF4nu&random=1045447317&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/700319321/ 42 B
108 B 26ms
22ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/700319321/?random=1699994804733&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNMpb7HWkWNt_Ru5qkcoV9Ly3frIu9IbctOpK5610qWu-zF4nu&random=1045447317&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11388547050/ 42 B
108 B 23ms
19ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11388547050/?random=1699994804777&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNH744HsFlOIhCOIC84Q2V74MGA9X63VQDBlntsSski6K3t4vW&random=2603057679&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/11388547050/ 42 B
108 B 23ms
21ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/11388547050/?random=1699994804777&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNH744HsFlOIhCOIC84Q2V74MGA9X63VQDBlntsSski6K3t4vW&random=2603057679&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/813495030/ 42 B
108 B 22ms
20ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/813495030/?random=1699994804807&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNEXuqd4kI3Wan_MyA2oJOUvPWmZfJ1hj3EbQ9PPew3f9GbT6f&random=636599067&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/813495030/ 42 B
108 B 23ms
21ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/813495030/?random=1699994804807&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNEXuqd4kI3Wan_MyA2oJOUvPWmZfJ1hj3EbQ9PPew3f9GbT6f&random=636599067&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10866179376/ 42 B
108 B 25ms
22ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866179376/?random=1699994804831&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNoHtNxM2pMl3d9TCmFUfgWptPogFK6AZ7zxNvUAXai6wiWVTd&random=1335541648&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10866179376/ 42 B
108 B 21ms
19ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10866179376/?random=1699994804831&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNoHtNxM2pMl3d9TCmFUfgWptPogFK6AZ7zxNvUAXai6wiWVTd&random=1335541648&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/755089552/ 42 B
108 B 20ms
18ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/755089552/?random=1699994804854&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNuNn_wn1HVMHb0JFxFf1Pvu87g2m0bfWDGMUUPZUNrgVMWlMq&random=2574645747&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/755089552/ 42 B
108 B 23ms
22ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/755089552/?random=1699994804854&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNuNn_wn1HVMHb0JFxFf1Pvu87g2m0bfWDGMUUPZUNrgVMWlMq&random=2574645747&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ Frame 9881 0
185 B 24ms
8ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com&rl=https%3A%2F%2Frefinance.quickenloans.com&if=true&ts=1699994805171&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4124&fbp=fb.1.1699994805169.322572868&pm=1&hrl=1db7cd&it=1699994804688&coo=false&cs_cc=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 14 Nov 2023 20:46:45 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/10866176763/ 42 B
108 B 20ms
19ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866176763/?random=1699994804928&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNg4275zuYPweslh4c6vRVtqFSqME1wzJ9l1joHWxXMBQfjXl4&random=1940947394&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10866176763/ 42 B
108 B 23ms
22ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10866176763/?random=1699994804928&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNg4275zuYPweslh4c6vRVtqFSqME1wzJ9l1joHWxXMBQfjXl4&random=1940947394&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/857412364/ 42 B
108 B 18ms
18ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/857412364/?random=1699994804951&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNdsDOceIuMR6GsWiCXyHh0rFQdR3nUIt-XCFVfB2kAFKsfisB&random=624876571&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/857412364/ 42 B
108 B 22ms
21ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/857412364/?random=1699994804951&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNdsDOceIuMR6GsWiCXyHh0rFQdR3nUIt-XCFVfB2kAFKsfisB&random=624876571&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/848879802/ 42 B
108 B 18ms
18ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848879802/?random=1699994805134&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNS8PacqW6mL6mSMjnPrq0t29Bm7D-NDY-MRZHnxd_AR5noNyI&random=3793629286&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/848879802/ 42 B
108 B 21ms
20ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/848879802/?random=1699994805134&cv=11&fst=1699992000000&bg=ffffff&guid=ON&async=1&gtm=45be3b81&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNS8PacqW6mL6mSMjnPrq0t29Bm7D-NDY-MRZHnxd_AR5noNyI&random=3793629286&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 interact Show response
somni.quickenloans.com/ee/irl1/v1/ 436 B
372 B 78ms
78ms Fetch
application/json 2606:4700::6812:1ba3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/ee/irl1/v1/interact?configId=b1d8d3c2-1fda-4646-9d8a-484cec8d3f55&requestId=614cb398-93fa-4127-8f78-b27b4aca356e

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2606:4700::6812:1ba3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02ebbba0ac47cbfddf2f55610a473a06a8562c993e104b9e770e2a13fa25dd64

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-adobe-edge: IRL1;6
x-xss-protection: 1; mode=block
x-request-id: 614cb398-93fa-4127-8f78-b27b4aca356e
server: cloudflare
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Retry-After, X-Adobe-Edge, X-Request-ID
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-konductor: N/A
cf-ray: 82621b0cbfd065e0-FRA

POST
H2 200 interact Show response
somni.quickenloans.com/ee/irl1/v1/ 436 B
371 B 102ms
102ms Fetch
application/json 2606:4700::6812:1ba3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/ee/irl1/v1/interact?configId=b1d8d3c2-1fda-4646-9d8a-484cec8d3f55&requestId=7b102191-1b14-4361-b587-cb46a51c63e7

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2606:4700::6812:1ba3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de6f3e2ff3555116895ef3cf7329968bc82d80d5467e3d53d7a61a44fb8d7428

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-adobe-edge: IRL1;6
x-xss-protection: 1; mode=block
x-request-id: 7b102191-1b14-4361-b587-cb46a51c63e7
server: cloudflare
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Retry-After, X-Adobe-Edge, X-Request-ID
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-konductor: N/A
cf-ray: 82621b0cbfd165e0-FRA

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame DEF4
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

128 B
691 B

43ms
43ms

Image
image/png

52.17.3.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.17.3.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-3-61.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 20:46:45 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 14 Nov 2023 20:46:45 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame DEF4
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlZQY3RBQUFBS0tJNndObg&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://pixel.everesttech.net/1x1

128 B
691 B

38ms
38ms

Image
image/png

52.17.3.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.17.3.61 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-3-61.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Tue, 14 Nov 2023 20:46:45 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 14 Nov 2023 20:46:45 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 p
tr.snapchat.com/ Frame 9881 0
99 B 21ms
20ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google
server: API Gateway
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 click Show response
www.lmbahsj2.com/sdk/ 85 B
353 B 150ms
149ms Fetch
application/json 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/sdk/click?effp=c4ead11768282fb0896b3c7305e5696b&sec_ch_ua_platform=&sec_ch_ua_platform_version=&sec_ch_ua_model=&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5&oid=9&affid=409&__cc=&async=json
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ecdf1b4c70df047c53cfe9f9a281ea07aa28b7846c89b5224349405bb6afcc48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
via: 1.1 google
server: nginx
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
x-eflow-request-id: 94c909e9-0867-448e-8428-ec47f37e4d98
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

POST
H2 200 response.json Show response
script.anura.io/ 141 B
479 B 188ms
130ms XHR
application/json 18.135.137.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/response.json

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.135.137.77 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-135-137-77.eu-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

98941d1e3b57fc2d5aa18aa81173f051d57acb5ec010d156e61147cad5657ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
access-control-allow-methods: POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2

204

v1
ads.yahoo.com/cms/ Frame DEF4
Redirect Chain

https://cm.everesttech.net/cm/yh
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZVPctAAAAKKI6wNn&sigv=1&esig=1~97fb42167a52d5d5bb04de252c58f3f78b1b1ff0

0
47 B

19ms
13ms

Image
text/plain

2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZVPctAAAAKKI6wNn&sigv=1&esig=1~97fb42167a52d5d5bb04de252c58f3f78b1b1ff0

Protocol

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 20:46:45 GMT
strict-transport-security: max-age=31536000
cache-control: no-store
x-content-type-options: nosniff
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZVPctAAAAKKI6wNn&sigv=1&esig=1~97fb42167a52d5d5bb04de252c58f3f78b1b1ff0
Date: Tue, 14 Nov 2023 20:46:45 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DEF4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WlZQY3RBQUFBS0tJNndObg==

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WlZQY3RBQUFBS0tJNndObg==

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230064-FRA
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1699994806.689164,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WlZQY3RBQUFBS0tJNndObg==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

POST
H2 200 track Show response
trc.pushnami.com/api/push/ 2 B
168 B 120ms
120ms Fetch
text/html 3.211.1.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.1.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-1-160.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Tue, 14 Nov 2023 20:46:46 GMT
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
content-length: 2
content-type: text/html; charset=utf-8

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 322ms
103ms Preflight 3.211.1.160
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.1.160 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-1-160.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame DEF4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZVPctAAAAKKI6wNn&expires=90

0
239 B

59ms
10ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZVPctAAAAKKI6wNn&expires=90
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: cc9654c54e9aa67bf2b10be1073297a8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-fra-eddf8230064-FRA
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1699994806.716459,VS0,VE0
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZVPctAAAAKKI6wNn&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 ct.html Show response
ct.pinterest.com/ Frame 346D 565 B
625 B 210ms
209ms Document
text/html 2.19.244.226
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/ct.html

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.74d80534.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.244.226 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-19-244-226.deploy.static.akamaitechnologies.com

Software

Resource Hash

f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

akamai-grn: 0.dcb20f17.1699994805.194e15ed
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Tue, 14 Nov 2023 20:46:45 GMT
pinterest-version: 5d3c2f1679281f2c8de82ecae570034b947dbf31
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
vary: Accept-Encoding
x-cdn: akamai
x-envoy-upstream-service-time: 1
x-pinterest-rid: 2323307234887998

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame DEF4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZVPctAAAAKKI6wNn
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZVPctAAAAKKI6wNn&C=1

43 B
345 B

38ms
35ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZVPctAAAAKKI6wNn&C=1
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tt%2FyUJg%2BweL3E9Mk6ml8yk5MO%2B6ok6CQN1n%2Fal%2BtF0oN5W%2BonYKFcEMf1pAIKAt0hnFQkd6gpVyh4C4HvLEPGyxvjXiFIZGLbucOu%2BQlkYR9Heu3f%2FzSSme3n4H6pPTJQOQhSygt%2FyarOA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82621b111f5830e4-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5%2Fv9D1wQtiYxOjqsK6ZdIua3mb%2BZ3UPbxJvcOhM9TI5N1R8pIC9vehh7GjYj8%2BSJ9zxg4d0B7qWT0naPO9FcT5AjHFOZQw%2BXp%2Fc6u57afRso6oyG2RGMh3nQHU7tTUPy183G88gZ3nPZJg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=88&external_user_id=ZVPctAAAAKKI6wNn&C=1
cache-control: no-cache
cf-ray: 82621b10df0730e4-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

200

bounce
ib.adnxs.com/ Frame DEF4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=ZVPctAAAAKKI6wNn
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZVPctAAAAKKI6wNn

43 B
898 B

14ms
13ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZVPctAAAAKKI6wNn

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
an-x-request-uuid: 76d13a91-ebe9-436e-bbac-e18d3e4c8b29
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 45.141.152.75; 45.141.152.75; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:45 GMT
an-x-request-uuid: 29e32389-974c-4fcf-a358-5284992f0525
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZVPctAAAAKKI6wNn
cache-control: no-store, no-cache, private
x-proxy-origin: 45.141.152.75; 45.141.152.75; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame DEF4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZVPctAAAAKKI6wNn

43 B
273 B

67ms
24ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZVPctAAAAKKI6wNn
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:46 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230064-FRA
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:46 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1699994806.019810,VS0,VE0
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZVPctAAAAKKI6wNn
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame DEF4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZVPctAAAAKKI6wNn

0
225 B

64ms
15ms

Image
text/html

198.47.127.205
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZVPctAAAAKKI6wNn
Protocol: H2
Server: 198.47.127.205 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 14 Nov 2023 20:46:45 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by: cache-fra-eddf8230064-FRA
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:46 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1699994806.122788,VS0,VE0
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZVPctAAAAKKI6wNn
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET

partner
sync.search.spotxchange.com/ Frame DEF4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZVPctAAAAKKI6wNn&img=1

0
0

GET
H2

200

b.php
www.facebook.com/fr/ Frame DEF4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZVPctAAAAKKI6wNn&t=2592000&o=0

43 B
835 B

122ms
120ms

Image
image/gif

2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZVPctAAAAKKI6wNn&t=2592000&o=0

Protocol

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 12:46:46 PST
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
pragma: public
x-fb-debug: AeLdPSZzL8RVh89RrAFLrQpsYbvHeYm9XQY87HeC97ee/LGNHt/gufBlL5h24DxlFmJIRqEWR4Ni/uVgSQWTQQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: image/gif
origin-agent-cluster: ?0
cache-control: public, max-age=0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), payment=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=()
expires: Tue, 14 Nov 2023 12:46:46 PST

Redirect headers

x-served-by: cache-fra-eddf8230064-FRA
pragma: no-cache
date: Tue, 14 Nov 2023 20:46:46 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1699994806.328340,VS0,VE0
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZVPctAAAAKKI6wNn&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 9881 0
68 B 22ms
22ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=1626&scd=0&ssd=1&est=1699994805027&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1699994806654&mrir=u&vi=1699994805025&ref=null&cv=20231114-18-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-vcl-time-ms: 11
date: Tue, 14 Nov 2023 20:46:46 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7380
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230090-FRA
pragma: no-cache
server: nginx
x-timer: S1699994807.656809,VS0,VE11
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 9881 0
87 B 18ms
18ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=1627&scd=0&ssd=1&est=1699994805027&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1699994806655&mrir=u&vi=1699994805025&ref=null&cv=20231114-18-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-vcl-time-ms: 10
date: Tue, 14 Nov 2023 20:46:46 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7262
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230090-FRA
pragma: no-cache
server: nginx
x-timer: S1699994807.656505,VS0,VE10
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 9881 0
107 B 18ms
17ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=1628&scd=0&ssd=1&est=1699994805027&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1699994806656&mrir=u&vi=1699994805025&ref=null&cv=20231114-18-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-vcl-time-ms: 10
date: Tue, 14 Nov 2023 20:46:46 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7566
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230090-FRA
pragma: no-cache
server: nginx
x-timer: S1699994807.656083,VS0,VE10
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 23ms
22ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je3b81v9169491831&_p=1699994803979&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1841459884.1699994804&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&_s=3&sid=1699994804&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D409%26pkey2%3D44%26pkey3%3Dacc12835d9994c269476c9a06510dbc5%26sourceid%3Dlmb-54867-113582-409%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D409%26_ef_transaction_id%3Dacc12835d9994c269476c9a06510dbc5&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=scroll&epn.percent_scrolled=90&_et=4&tfd=7965
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Nov 2023 20:46:49 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sync.search.spotxchange.com
URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZVPctAAAAKKI6wNn&img=1

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

50 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 16:14:41	Name: X-AB Value: 0d6e407936704bd380072f5891d28b0e
.liadm.com/j	1970-01-21 01:49:14	Name: lidid Value: cd4bc7e8-1d7a-40ad-a519-6b07d1db1667
refinance.quikcenioans.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: bda8d4ede3ba8cdce93b014a1a0f00ca
.quickenloans.com/	1970-01-21 00:58:50	Name: visitorId Value: 44dffa77-42f7-4743-a73e-e4dd7fe8ceb8
refinance.quickenloans.com/	1970-01-21 00:58:50	Name: visitorId Value: 44dffa77-42f7-4743-a73e-e4dd7fe8ceb8
refinance.quickenloans.com/	1970-01-20 16:23:19	Name: contentTarget Value: %7B%22sourceId%22%3A%22lmb-54867-113582-409%22%7D
.quickenloans.com/	1970-01-20 18:22:50	Name: _gcl_au Value: 1.1.2052575055.1699994804
refinance.quickenloans.com/	1970-01-20 16:13:15	Name: _dd_s Value: rum=0&expire=1699995704091
.demdex.net/	1970-01-20 20:32:26	Name: demdex Value: 24262592977798601211226405558475865174
.quickenloans.com/	1970-01-21 01:49:14	Name: _ga Value: GA1.1.1841459884.1699994804
.quickenloans.com/	1970-01-21 01:49:14	Name: _ga_RXLL9Z7XBK Value: GS1.1.1699994804.1.0.1699994804.0.0.0
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
.agkn.com/	1970-01-21 00:58:50	Name: ab Value: 0001%3AWpQbUjfU%2BpUuacBCQctT%2BAhvBG7Z4DHc
.dpm.demdex.net/	1970-01-20 20:32:26	Name: dpm Value: 24262592977798601211226405558475865174
.everesttech.net/	1970-01-21 00:58:50	Name: everest_g_v2 Value: g_surferid~ZVPctAAAAKKI6wNn
.quickenloans.com/	1970-01-21 01:49:14	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 179643557%7CMCIDTS%7C19676%7CMCMID%7C24429965397457649451245694768477042846%7CMCAAMLH-1700599604%7C6%7CMCAAMB-1700599604%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1700002004s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19683%7CvVersion%7C5.5.0
.doubleclick.net/	1970-01-21 01:34:50	Name: IDE Value: AHWqTUnHtPbzorjIf-giOumzm9U4aqHc3yHUB4ekgnh8X1igixrnnTtTyXvzxK62OGM
refinance.quickenloans.com/	1970-01-20 16:23:19	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNjA0NzAzNjUtNDgzMi01MzVkLWFjYWItNDNhZTY3ZDMwNmJhIiwidmlzaXRvcklkIjoiNDRkZmZhNzctNDJmNy00NzQzLWE3M2UtZTRkZDdmZThjZWI4Iiwic2Vzc2lvbklkIjoiZjc1OWJmYzUtOWVlMC00OTI1LTljYjItZDhjZTFkYzc4NDYyIiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiI0MDkiLCJwa2V5MiI6IjQ0IiwicGtleTMiOiJhY2MxMjgzNWQ5OTk0YzI2OTQ3NmM5YTA2NTEwZGJjNSIsInNvdXJjZUlkIjoibG1iLTU0ODY3LTExMzU4Mi00MDkiLCJzaWQiOiI5IiwiY21waWQiOiI5IiwiY3J0aWQiOiIiLCJvaWQiOiI5IiwiYWZmaWQiOiI0MDkiLCJfZWZfdHJhbnNhY3Rpb25faWQiOiJhY2MxMjgzNWQ5OTk0YzI2OTQ3NmM5YTA2NTEwZGJjNSIsImFnZSI6bnVsbCwiZGV2aWNlIjpudWxsLCJmb3JjZU5hbWVzIjpudWxsLCJmb3JjZUlwIjpudWxsLCJmb3JjZVRlc3RJZHMiOm51bGwsImlucXVpcnlJZCI6bnVsbCwiaW5xdWlyeVNpZ25hdHVyZSI6bnVsbCwiaXNUZXN0IjpudWxsLCJsZXZlbE9mRWR1Y2F0aW9uIjpudWxsLCJtb2lkIjpudWxsLCJwcm9wZXJ0eVN0YXRlQ29kZSI6bnVsbCwicmVzb2x1dGlvbiI6IiIsInR0VHJhY2VJZCI6bnVsbCwicHJvdmlkZXJJZCI6bnVsbCwicWxzIjpudWxsLCJzdGlkIjpudWxsLCJvdmtleSI6bnVsbCwib3ZyYXciOm51bGwsIm92bXRjIjpudWxsLCJtb3J0Z2FnZUJhbGFuY2VSYW5nZSI6bnVsbCwiZGF0ZU5vdyI6MTY5OTk5NDgwNDAxNSwicmFuZG9tTnVtYmVyIjo3MTk3MSwibWFya2V0aW5nT2ZmZXJJZCI6bnVsbCwidGltZU9uRm9ybVN0YXJ0VGltZSI6IjIwMjMtMTEtMTRUMjA6NDY6NDQuMTcwWiIsIm9yaWdpblJlcXVlc3RlZFVyaSI6Imh0dHBzOi8vcmVmaW5hbmNlLnF1aWNrZW5sb2Fucy5jb20iLCJwcmVzZW50YXRpb25OYW1lIjoiMjg5MDUwNF9NU1FMX0xSRV9MUF8yMDIzLTEwLTE3X2NhbGN1bGF0b3JfbGlua3MiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vcmVmaW5hbmNlLnF1aWNrZW5sb2Fucy5jb20vP3BrZXkxPTQwOSZwa2V5Mj00NCZwa2V5Mz1hY2MxMjgzNWQ5OTk0YzI2OTQ3NmM5YTA2NTEwZGJjNSZzb3VyY2VpZD1sbWItNTQ4NjctMTEzNTgyLTQwOSZzaWQ9OSZjbXBpZD05JmNydGlkPSZvaWQ9OSZhZmZpZD00MDkmX2VmX3RyYW5zYWN0aW9uX2lkPWFjYzEyODM1ZDk5OTRjMjY5NDc2YzlhMDY1MTBkYmM1IiwidmVydGljYWxOYW1lIjoiTVNRTF9MUkVfTEFORElORyIsInJlZmVycmluZ1VyaSI6IiIsImZsb3dJZCI6Ik1TUUxfTFJFX0xBTkRJTkdfVkVSVElDQUxfRkxPV18xIiwidGVzdElkIjoyMTU1MTc0LCJjbGllbnRJcEFkZHJlc3MiOiIyMDAxOmFjODoyMDozYTAwOjEwMTI6MzZlYjpiN2Y1OjJjZmMiLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE5LjAuNjA0NS4xMjMgU2FmYXJpLzUzNy4zNiIsImJvdCI6ZmFsc2UsImlhdCI6MTY5OTk5NDgwNH0.CIOXArWo65VuN2uoTMvVDDwP4qo3hG9rwJu9RhlbpYvZ6Nm0WUBY-cmCpArU5Ehh_bBDC7UiOmHlp0TnwRDsUpJuNAevD_UWO4e569FMLlu3xBZvyfrFYmEIzaSd5kA9tKq8Yy3WvAGQ-bsPriXprfiJkUyoVeKZeIhdBhTt-v9hHd2aoLJVXEl4gZt3nIYnRvkUU1C-Yz8ijEF7eC8xqr31jG2lD3kEtryP1jPQeNBbNDOLDzJpj54fvaUmOTpj-va6G7ePQzxfbOfgTfODuAK8ap2YPbltewjisKbyrdzXKWV-Rf6SnuTt_4c5LmqcYdDxWrdjO8R7CcbxIQy_lQmUzpRBwtetl4r1Mj15wb-zwk1f7YyL17ton58OZ9ccFWTbbI4XAPbpxvRq94_bkNKPOI3EfJiKZRAEyp72yiKquU4La2ZYkmqBnkubwJteLS_aztXSU2suRd9lk6P-0cgDB3RoMuUX_Bc5HTe2JJyPABuadjVBMulOI5hzYj7_F-HXFUb0jVl1XnuznemwJfMrbeJCWhC2ZlNbmPiqvxn35UP4v59iT0tvHfnSxYLsKiiJdaCfHN0yhTPwssfvUXTZe5wJAHWI4oHsaz9UTCxIGO5e_Qrvvt-QO3W6gmmR9m_z8IRya0IL4pN_AEpPtH8xSRskKuUAfSrrKQSREytUhwi7-Vfin0iFvsGKUC8TCHnOQho8yonRcboBEI9OWi07ASKmmspkctnZtOov99PyNgfNxmBe8s1lhKPw5PcpD3qKWnUGuj1symaT_eFuvNtMsfZ4hDohvE0cKyLsVy5_vJidB_Z6jJEIVAHVvdbgsborUJMfv-QiO5ormLsbR2E8XC1KINDdL2wTTUzZW-H6BObvZPilPjPRsxPc8oPyqtiNu92sSEWNH103Kcj4OF9HaOYtn_EV7FqdkSAgIM1a_NIEQRjZZ27OknvRKmyGvOeU10fxUNd4-EiWAS-eQePM6Of8szUe_G4XKPVVLuCIGAe_vJLkK70jg4CrxzBUL8bIcQsxqDGoTzWIOJZfvBsSlPDP7KUWShQwfXSn1Tmxt4bjqy81HPpGs9XIxTrQbAq0VQ1iioT2AYaF508wobpsBR_LlLGAA_40ZU7tbHQYwd6ZyaxLvfX-XkWbeXVcKVlGPQ6ebLzLx_SeyXP_M33O4hijaqX9_kCDW3xTeiEjmnlg5-ZX4yfBQ87m74VXrwEgPwQYUK2hEAIApON19g0hP2tLF5wHzGt7Y3n69JhDjcGyU7hFW-5BP8BssOUFDGG7vRwGWv4sZn62hVIWrUolXFc6mSSNp50_dc2RdpB0nSinIwugbt3V-kyJiWu9tjgI8Q_BKz1DEcFTNwyHDA
.quickenloans.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .quickenloans.com
.quickenloans.com/	1970-01-21 01:49:14	Name: _lc2_fpi Value: ddc3c751f117--01hf7sc8e2c7bcx17v8eaxpg7k
.quickenloans.com/	1970-01-21 01:49:14	Name: _lc2_fpi_meta Value: {%22w%22:1699994804674}
.everesttech.net/	1970-01-20 16:57:53	Name: ev_sync_ax Value: 20231114
.everesttech.net/	1969-12-31 23:59:59	Name: everest_session_v2 Value: ZVPctAAAAStkBnTB
.quickenloans.com/	1970-01-21 01:43:01	Name: _scid Value: 6ce8b7bd-bb56-445b-bd67-2d5a047dd55a
.quickenloans.com/	1970-01-21 01:43:01	Name: _scid_r Value: 6ce8b7bd-bb56-445b-bd67-2d5a047dd55a
.quickenloans.com/	1970-01-20 16:13:16	Name: mboxEdgeCluster Value: 37
.quickenloans.com/	1970-01-20 16:13:16	Name: kndctr_5D60123F5245B13E0A490D45_AdobeOrg_cluster Value: irl1
.quickenloans.com/	1970-01-21 01:42:02	Name: kndctr_5D60123F5245B13E0A490D45_AdobeOrg_identity Value: CiYyNDQyOTk2NTM5NzQ1NzY0OTQ1MTI0NTY5NDc2ODQ3NzA0Mjg0NlIRCNPD2Py8MRgBKgRJUkwxMAPwAdPD2Py8MQ==
.revjet.com/	1970-01-21 01:49:14	Name: trx Value: 4922293671595221832
.yahoo.com/	1970-01-21 00:59:12	Name: A3 Value: d=AQABBLXcU2UCECn6NwWQjwfe95nzk_4skmQFEgEBAQEuVWVdZeAKyiMA_eMAAA&S=AQAAAmk1cO003Q1XVMcvjf8_0io
.pmsrv.co/	1970-01-20 18:24:38	Name: _pmedia_opt-out Value: 1
.quickenloans.com/	1970-01-20 18:22:50	Name: _fbp Value: fb.1.1699994805169.322572868
.quickenloans.com/	1970-01-21 01:49:14	Name: mbox Value: session%2324429965397457649451245694768477042846%2DEWTmBi%231699996665
.quickenloans.com/	1970-01-20 16:13:16	Name: __cf_bm Value: iXUYbBTyhjcrcth.BD0dhMDTctgLRoCcM5NIybiNNyI-1699994805-0-AWlqFM3iZiQC7QNDUEJ0mEoDGM+hKwWEOHuRYQETUf4SgvKh19kwuoVNlMGxVj70OATFy+OD3t6KApxBfU8B5ow=
.liadm.com/	1970-01-21 01:49:14	Name: lidid Value: cd4bc7e8-1d7a-40ad-a519-6b07d1db1667
.mortgage.quickenloans.com/	1970-01-20 16:13:16	Name: __cf_bm Value: i_tAZDCanqvBKeqX9wmN7i0rwHlSpHBnMYsXhKl2ruo-1699994805-0-AYtp1RgYAkYei6C3+hsi2FWgzENDiUNHXkf0wT6L8ZkG2TSo+MRBhbuxkGSKZxOOXcDtaP9jwDr0J9GYeRHL2Y8=
.everesttech.net/	1970-01-20 16:57:53	Name: ev_sync_yh Value: 20231114
www.lmbahsj2.com/	1970-01-20 16:14:41	Name: uniqueClick Value: 706ade25-8638-4872-a569-d8d7236dd52a:1699994805
.quickenloans.com/	1970-01-20 16:56:26	Name: ef_witness Value: 1
.quickenloans.com/	1970-01-20 16:56:26	Name: ef_tid_c_o_9 Value: 6269c4702d094a88b05c2aecd1ad02b2
.quickenloans.com/	1970-01-20 16:56:26	Name: ef_tid_c_a_1 Value: 6269c4702d094a88b05c2aecd1ad02b2
.pinterest.com/	1970-01-21 00:58:50	Name: ar_debug Value: 1
.refinance.quickenloans.com/	1970-01-21 00:58:50	Name: _pin_unauth Value: dWlkPU9EWTROV1F5T0RndE5UbGtaUzAwTVRjNExUbG1OV1F0T0RsbFpHTmlNMkpoWkRFNQ
.casalemedia.com/	1970-01-21 00:58:50	Name: CMID Value: ZVPctXPLTLBMFRlDa3cjtAAA
.casalemedia.com/	1970-01-20 18:22:50	Name: CMPS Value: 2157
.casalemedia.com/	1970-01-20 18:22:50	Name: CMPRO Value: 2157
.adnxs.com/	1970-01-20 18:22:50	Name: uuid2 Value: 5452594852422808614
.adnxs.com/	1970-01-20 18:22:50	Name: anj Value: dTM7k!M4.FErk#WF']wIg2In<j'HdH!]tbPl1MwL(!R7qUY#QT8bZb.(=wTOV`-i6%$NJGMQNAX9RFMZ9bmtwgM/]vGiOa(2nC6s3jy1642tv0!$#F4NL/_Q
.demdex.net/	1970-01-20 20:32:26	Name: dextp Value: 21-1-1699994804252\|771-1-1699994804354\|1083-1-1699994804455\|1085-1-1699994804606\|1086-1-1699994804914\|1087-1-1699994805145\|1088-1-1699994805245\|19913-1-1699994805382\|83349-1-1699994805516\|144230-1-1699994805617\|144231-1-1699994805718\|144232-1-1699994805818\|144233-1-1699994805920\|144234-1-1699994806021\|144235-1-1699994806122\|144236-1-1699994806223\|144237-1-1699994806327
.refinance.quickenloans.com/	1970-01-20 16:13:16	Name: __cf_bm Value: 9EUsDFc7mvB0VC5uXXUNka8qbPqj6kpFuPTH9jpREfQ-1699994806-0-AWVmJ/mxCja8fjz7EnzJQmMoeE+HLqn1vA04iTX9PxQnZEy2AIJsAbZIeyn5ZpQbqPzwGholeaf55LocL4spplQ=

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZVPctAAAAKKI6wNn&img=1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
other	error	URL: https://refinance.quickenloans.com/?pkey1=409&pkey2=44&pkey3=acc12835d9994c269476c9a06510dbc5&sourceid=lmb-54867-113582-409&sid=9&cmpid=9&crtid=&oid=9&affid=409&_ef_transaction_id=acc12835d9994c269476c9a06510dbc5 Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
adobedc.demdex.net
ads.anura.io
ads.revjet.com
ads.yahoo.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
content.refinance.quickenloans.com
cs-cdn.deviceatlas.com
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
fonts.cdnfonts.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
pix.revjet.com
pixel.everesttech.net
pixel.rubiconproject.com
psp.pushnami.com
quicken.demdex.net
refinance.quickenloans.com
refinance.quikcenioans.com
region1.google-analytics.com
rp.liadm.com
rp4.liadm.com
s.pinimg.com
s.yimg.com
sc-static.net
script.anura.io
somni.quickenloans.com
somni.rocketmortgage.com
sp.analytics.yahoo.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
sync-tm.everesttech.net
sync.search.spotxchange.com
tr.snapchat.com
trackpixel.refinance.quickenloans.com
trc.pushnami.com
trc.taboola.com
us-u.openx.net
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
sync.search.spotxchange.com
104.18.36.155
108.138.181.64
108.156.2.81
13.32.99.40
142.250.184.194
142.250.186.66
151.101.193.44
151.101.2.49
18.135.137.77
18.197.230.215
18.238.243.27
185.89.210.212
198.47.127.205
2.19.244.226
2001:4860:4802:32::36
212.82.100.181
2600:1f18:730:b120:c62f:9488:7811:a2e
2600:9000:206f:3200:a:8e7d:9900:93a1
2600:9000:225e:7a00:8:8845:1500:93a1
2606:4700:3037::6815:53cd
2606:4700::6810:3865
2606:4700::6812:1ba3
2606:4700::6812:94b
2606:4700::6812:d2b
2606:4700:e2::ac40:8416
2a00:1288:80:807::2
2a00:1450:4001:80b::2008
2a00:1450:4001:80f::200a
2a00:1450:4001:812::2003
2a00:1450:4001:827::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2003
2a02:26f0:3500:2a7::1e80
2a02:26f0:7100:789::1931
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
3.162.38.245
3.211.1.160
35.173.79.120
35.190.43.134
35.201.76.131
35.244.159.8
44.216.119.239
46.4.76.120
52.17.3.61
52.211.35.76
52.30.96.55
52.58.191.183
63.140.62.135
63.140.62.214
65.109.98.102
69.173.144.139
00bfb9da74d6c2c325c27e60fc9aea44f272cba1b072ad7b2ba4a805c3e8d555
02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9
02ebbba0ac47cbfddf2f55610a473a06a8562c993e104b9e770e2a13fa25dd64
050f5e831a79d1d622bdf0611ebcd10c91f186208a0cde464349733d0df5e8cc
0519f420dc13e257dd35cc2c20dde8dab78f2ae40d16943a90b230c5cb430ae9
0a62530dd1701bdc8d1b3ece6ee812c57c812833d0eecc9163987c8a211b52f0
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d
0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005
0dd1971699f19f33219608023cd1f3294e8c0bed22cd575610c85644e5942271
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
1339d97cacf1c9e291a7b552e853a97abd2b294cdec06935e6f6ec0bbf4a0728
1c55751b1b1ae1514f4d12d4b8435db9b06e2d8fc75b4a24e07b70adb85f2d3a
1f88d3e6dd5f8b29e7f614da71e08bc9eb24f694fd2f5421070efeb3ef54f54a
1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532
23e9b9449e428772001f22e230c11dcb018b33441b1074a10391c0e1fbc88ce2
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
34eace17373618f0ef6ad0052c607c2b3a6c02af6a6e0a1d16fa15efb97c139d
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
3c55cd3fb294791215bb0be21defd42d4b61c4eb28a670c10f54be823145bbea
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae
4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
43c125935df3e3d7b3a0e5b2c9c8d6b13c1c55433c6fc77199619ca2be12e67c
480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91
4968f5b2103c7562c987a19487da840320056091a24efde004fb3f25a48f2ec0
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b879a120bb52e45c7a4aed4e5532c00a6754ef932e98a1be617b626b1b7f7aa
4e05b21f2ea5f497b4c3763f0d81bd5de900d8394ac88eb8b6a88b471d367ad1
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e7140f58b2b89a1c8ffba6df69a1e845f6e8fee48987276a7523b8244191c3e
4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b
50720620cf7e9ce770da56c1b14dc195dc82b8196bda291ddaeaebd9f44576c9
52f243d57d00c4be0d55c23e8694028e115a7a586f1d356fa6ed126ec9479a51
53c66fbcad8a3c1f0b77327c59b9f94c7efb0d66c781bc71af60661d8b8570a2
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
60cc60a6fcbd230def379432395199b585791ed521e2e5f595369a2193e617fb
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
6596ea36bf758c2f1d6dd8d40249ab6dae02d46a4aa02c393d65acb0fab0866f
6eb36dbb58898babc1b1bf95608f3b539af1164bb86ffee3bb7fa792978e00ea
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7dab8fbc8b1dd9da6c1559af2b4af2c968389b9d58931bc3fecd0a916dd41066
7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5
81da90d4443f7435771a6e04b1a83ca215141c1bb9cacb8cc826ba6e73772fe2
83e8661b82056e8dfae4674c9afdf51abbd4e74107e79adba875f52953d25c9c
861c991ecc36d7ee01d015ba66ec62421862e0a621b3a216ab3fb8af307fc562
8b188996cbd0eec651238aa848787993fa58133624e7faff28e0894c13116dd3
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
9296b9b930c75d444fa5c1cb60fe857648f3a2de3ddf0b7a3e6d19239e0e8e35
96ada9bedfdb1f5a4eb57e55c0bfb50b9c0ffb736435bce8568bed3a030c6a97
98941d1e3b57fc2d5aa18aa81173f051d57acb5ec010d156e61147cad5657ec2
a0ba99855a35218e2432e543683e24171f33537761055ed09be59578520d9399
afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7
b115f2a2c595f674c520f50628824dac12ca4b1dc3ecca6426e6a49d580a4f7a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b525176c325c24ef89c7729189be8c60cb70c128a57d32db236a2a3d016d5a94
b5474127bd757be40f01f2f8043666c0bae3390b56a20a0deff8eaaeb8b319f1
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
bfd8add66198494d7458de03d748b04f1a269e1ccb4734507c892b9dc075f2f8
c274f0f115069318fd860ed86791936276da8ca856c420c0d31a79967184d81f
c6659e8919d1cde02448dce70dfd9ef0d9b3ba4d416fd904ab564baff472c1ca
c75e8e5fd6eea9b973a59097b8a8eb4d09b67baaec481d096e4a07f0426c04ae
ca1fff728f0ea8e7b11b0e508bc4c43927aea4c04f94516d3e828461c0e7300f
cb265cef0cdde168183a311e1d257bb00ebede2a32820572ae20ce5a62e2f63b
d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321
d435ed1fbca08de3a40833bc4301e231a7e254414d1222364306d04e046b7f2c
d58d7f14f0a7d11c1b0c4bb8472bd96b15f26ae5a81c3db4a2c607113e4e24ec
d5fa4d0a688648c44990c30ea43421c1e9d2673aa8a46c3be65cfb30f5f7bff1
d60e5df9737467ba7c22c3791a5f5591f48f8ad7d9bfcbd7540fb4ea477ecd39
de6f3e2ff3555116895ef3cf7329968bc82d80d5467e3d53d7a61a44fb8d7428
dfe95d6caa54f07ba9b49b18abc39a75fea04ae82b23a9b99dcfa8036d3c6421
e04ebe92fdbf7da46bf7e6ea1c74ddab006a1538d5939d2406e057c94597f23a
e1a21b72f3aaa0b532aebe5e228e1aaa07bb90b2b84a51c762c410a8c50abfdf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e80e9a23ab8043bbb4d265bded2f4dcece3a1172bd28f34aae1574f8e7df4fae
e93d2b723f88a862141b1f90227046fbc48dc8aa261b27d501c2fa80c3b07ea3
eabd357c31110ddee72bc72488f6bc95bea1848042b11889d3ba7af9f2ad9e49
ead030154a651dbf216d5c043e974bb3f78b640078472f63d4277db7deb1faae
ecc0ea32675d5db78a0a6d0626e12dc619fdad460d473b6166894d14cc654d6f
ecdf1b4c70df047c53cfe9f9a281ea07aa28b7846c89b5224349405bb6afcc48
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef45c21f7e054481c81992c1a46293a28c9bb8b3722bc566479326187f473c8c
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0
f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3
f9a2aecd5d5a63aa7c05140d086643b0e3e607c0f1d7bb45cdcb6b94dbcd4591
fb1cb928b1a68f9e4b20213a51edb62396c3e21b58b586e8514bb9598665397c
fe49fc14b70cfc4f3edbc08e58087ca0f6e948a953c3eaeabdc7e78f512e5a22
fee6efd88421ec6ef4ae03c305f40a7584fc72a1882b84afe829f08e9e031a68

refinance.quickenloans.com Open in urlscan Pro 2606:4700::6812:d2b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

144 Requests

86 %HTTPS

40 %IPv6

41 Domains

59 Subdomains

48 IPs

6 Countries

1991 kBTransfer

5916 kBSize

50 Cookies

20 Outgoing links

Page URL History

Redirected requests

144 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:d2b Public Scan

Screenshot
Live screenshot

Full Image

144
Requests

86 %
HTTPS

40 %
IPv6

41
Domains

59
Subdomains

48
IPs

6
Countries

1991 kB
Transfer

5916 kB
Size

50
Cookies

144 HTTP transactions
0 data transactions