refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:c2b Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://quickenloansrefi.com/?_kx=FEEH9AFB93CSAhfFMTdzI667up-8niaunVPXkGAZ5ZfTl6Vhtk7XFmfEdGTn0T6e.Y9qupU
Effective URL:
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&...
Submission: On July 14 via api (July 14th 2024, 3:49:34 pm UTC) from US — Scanned from US

Summary HTTP 37 Redirects Behaviour Indicators

Summary

This website contacted 21 IPs in 2 countries across 24 domains to perform 37 HTTP transactions. The main IP is 2606:4700::6812:c2b, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 486782.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 22nd 2023. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	66.29.132.28 66.29.132.28	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 1	34.36.162.171 34.36.162.171	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	2606:4700::68... 2606:4700::6812:c2b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:d2b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.162.125.20 3.162.125.20	16509 (AMAZON-02) (AMAZON-02)
1	2600:141b:f00... 2600:141b:f000:c0a6::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.238.4.94 18.238.4.94	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:303... 2606:4700:3033::6815:487c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:400d:c04::5f	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:1ff5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	34.239.196.49 34.239.196.49	14618 (AMAZON-AES) (AMAZON-AES)
1	13.32.206.192 13.32.206.192	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:400d:c0b::61	15169 (GOOGLE) (GOOGLE)
1 2	2606:4700:440... 2606:4700:4400::6812:2412	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 4	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 2	74.125.192.156 74.125.192.156	15169 (GOOGLE) (GOOGLE)
2 2	68.67.179.153 68.67.179.153	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	44.199.30.155 44.199.30.155	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.38.138 63.140.38.138	14618 (AMAZON-AES) (AMAZON-AES)
2	2607:f8b0:400... 2607:f8b0:400d:c0b::66	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c0c::9d	15169 (GOOGLE) (GOOGLE)
1	18.238.4.44 18.238.4.44	16509 (AMAZON-02) (AMAZON-02)
1	174.129.180.120 174.129.180.120	() ()
37	21

1 66.29.132.28 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: business135-1.web-hosting.com

quickenloansrefi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.36.162.171 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 171.162.36.34.bc.googleusercontent.com

www.npvnt7trk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.76.131 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:c2b (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:d2b (United States)

ASN13335 (CLOUDFLARENET, US)

static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.162.125.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-162-125-20.iad61.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:f000:c0a6::1e80 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.4.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-4-94.phl51.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3033::6815:487c (United States)

ASN13335 (CLOUDFLARENET, US)

fonts.cdnfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c04::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1ff5 (United States)

ASN13335 (CLOUDFLARENET, US)

content.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.239.196.49 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-239-196-49.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.206.192 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-206-192.iad66.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c0b::61 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::6812:2412 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

action.dstillery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
action.media6degrees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.223.40.198 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.192.156 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: qn-in-f156.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.179.153 (North Bergen, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.36.155 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.199.30.155 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-199-30-155.compute-1.amazonaws.com

quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.38.138 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-138.data.adobedc.net

somni.rocketmortgage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c0b::66 (Morganton, United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c0c::9d (Morganton, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.4.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-4-44.phl51.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.129.180.120 (None, )

ASN- ()

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 486782 static-msql-prod.refinance.quickenloans.com — Cisco Umbrella Rank: 736455 trackpixel.refinance.quickenloans.com — Cisco Umbrella Rank: 755607	363 KB
4	adsrvr.org 4 redirects insight.adsrvr.org — Cisco Umbrella Rank: 882 match.adsrvr.org — Cisco Umbrella Rank: 387	3 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 74	3 KB
3	doubleclick.net 2 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 264 stats.g.doubleclick.net — Cisco Umbrella Rank: 133	2 KB
3	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 232 quicken.demdex.net — Cisco Umbrella Rank: 81725	2 KB
3	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 7396 psp.pushnami.com Failed trc.pushnami.com Failed	19 KB
2	google.com analytics.google.com — Cisco Umbrella Rank: 157	308 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 641	2 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 265	2 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 72	200 KB
2	cdnfonts.com fonts.cdnfonts.com — Cisco Umbrella Rank: 8828	1 KB
1	rocketmortgage.com somni.rocketmortgage.com — Cisco Umbrella Rank: 94500	471 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 402	2 KB
1	media6degrees.com action.media6degrees.com — Cisco Umbrella Rank: 9950	631 B
1	dstillery.com 1 redirects action.dstillery.com — Cisco Umbrella Rank: 8522	539 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1420	37 KB
1	lowermybills.com content.lowermybills.com	7 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 950	7 KB
1	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 391	81 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 5628	7 KB
1	lmbahsj2.com 1 redirects www.lmbahsj2.com — Cisco Umbrella Rank: 698213	1 KB
1	npvnt7trk.com 1 redirects www.npvnt7trk.com	616 B
1	quickenloansrefi.com 1 redirects quickenloansrefi.com	957 B
0	deviceatlas.com Failed cs-cdn.deviceatlas.com Failed
37	24

	Domain	Requested by
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
3	match.adsrvr.org	3 redirects
3	refinance.quickenloans.com	www.datadoghq-browser-agent.com
2	analytics.google.com	www.datadoghq-browser-agent.com
2	dsum-sec.casalemedia.com	1 redirects refinance.quickenloans.com
2	ib.adnxs.com	2 redirects
2	cm.g.doubleclick.net	2 redirects
2	www.googletagmanager.com	refinance.quickenloans.com www.googletagmanager.com
2	dpm.demdex.net	1 redirects refinance.quickenloans.com
2	fonts.cdnfonts.com	static-msql-prod.refinance.quickenloans.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
1	trc.pushnami.com	www.datadoghq-browser-agent.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	somni.rocketmortgage.com	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	pixel.rubiconproject.com	1 redirects
1	insight.adsrvr.org	1 redirects
1	action.media6degrees.com	refinance.quickenloans.com
1	action.dstillery.com	1 redirects
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	content.lowermybills.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	assets.adobedtm.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
1	www.lmbahsj2.com	1 redirects
1	www.npvnt7trk.com	1 redirects
1	quickenloansrefi.com	1 redirects
0	psp.pushnami.com Failed	www.datadoghq-browser-agent.com
0	cs-cdn.deviceatlas.com Failed	refinance.quickenloans.com
37	31

This site contains no links.

Subject Issuer	Validity	Valid
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2023-12-22` - `2024-12-21`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M03	`2024-01-03` - `2025-01-31`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.pushnami.com Amazon RSA 2048 M02	`2024-02-03` - `2025-03-03`	a year	crt.sh
cloudflareinsights.com WE1	`2024-07-06` - `2024-10-04`	3 months	crt.sh
cdnfonts.com GTS CA 1P5	`2024-05-25` - `2024-08-23`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
lowermybills.com Cloudflare Inc ECC CA-3	`2023-10-11` - `2024-10-10`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-12` - `2024-12-14`	a year	crt.sh
*.google-analytics.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
somni.rocketmortgage.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-19` - `2025-02-18`	a year	crt.sh
*.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Frame ID: 7492F7A4450C28A80932AE74B7D52828
Requests: 32 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: 42B03F6481FF79A1BC71D00CFC3BE4EB
Requests: 1 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: D360E6B8A8EFD69E0099628154A8116A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Refinance Mortgage, Refinancing Rates, Mortgage Rates

Page URL History Show full URLs

http://quickenloansrefi.com/?_kx=FEEH9AFB93CSAhfFMTdzI667up-8niaunVPXkGAZ5ZfTl6Vhtk7XFmfEdGTn0T6e.Y9qupU HTTP 307
https://quickenloansrefi.com/?_kx=FEEH9AFB93CSAhfFMTdzI667up-8niaunVPXkGAZ5ZfTl6Vhtk7XFmfEdGTn0T6e.Y9qupU HTTP 301
https://www.npvnt7trk.com/28KL61/79C6G4/?sub1=QM HTTP 302
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=6d2b3f1796d143a388f3f563fc3be441 HTTP 302
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d14... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Page Statistics

37
Requests

76 %
HTTPS

41 %
IPv6

24
Domains

31
Subdomains

21
IPs

2
Countries

728 kB
Transfer

3072 kB
Size

36
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://quickenloansrefi.com/?_kx=FEEH9AFB93CSAhfFMTdzI667up-8niaunVPXkGAZ5ZfTl6Vhtk7XFmfEdGTn0T6e.Y9qupU HTTP 307
https://quickenloansrefi.com/?_kx=FEEH9AFB93CSAhfFMTdzI667up-8niaunVPXkGAZ5ZfTl6Vhtk7XFmfEdGTn0T6e.Y9qupU HTTP 301
https://www.npvnt7trk.com/28KL61/79C6G4/?sub1=QM HTTP 302
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=6d2b3f1796d143a388f3f563fc3be441 HTTP 302
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720972168768 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720972168768

Request Chain 20

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId] HTTP 302
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]

Request Chain 21

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:4ld0kml&fmt=3 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NzI5ZWFjZTItNDAzYS00ODhmLThmYzQtOTM4ZTdiMGM5Y2Q4&gdpr=0&gdpr_consent=&ttd_tdid=729eace2-403a-488f-8fc4-938e7b0c9cd8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=NzI5ZWFjZTItNDAzYS00ODhmLThmYzQtOTM4ZTdiMGM5Y2Q4&gdpr=0&gdpr_consent=&ttd_tdid=729eace2-403a-488f-8fc4-938e7b0c9cd8&google_tc= HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=729eace2-403a-488f-8fc4-938e7b0c9cd8&google_gid=CAESEKVo5LMB30kCK1_5riBfHaw&google_cver=1 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=729eace2-403a-488f-8fc4-938e7b0c9cd8 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D729eace2-403a-488f-8fc4-938e7b0c9cd8 HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1933191573267914905&ttd_tdid=729eace2-403a-488f-8fc4-938e7b0c9cd8 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=729eace2-403a-488f-8fc4-938e7b0c9cd8&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=729eace2-403a-488f-8fc4-938e7b0c9cd8&expiration=1723564172&gdpr=0&gdpr_consent= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=729eace2-403a-488f-8fc4-938e7b0c9cd8&expiration=1723564172&gdpr=0&gdpr_consent=&C=1

37 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
refinance.quickenloans.com/
Redirect Chain

http://quickenloansrefi.com/?_kx=FEEH9AFB93CSAhfFMTdzI667up-8niaunVPXkGAZ5ZfTl6Vhtk7XFmfEdGTn0T6e.Y9qupU
https://quickenloansrefi.com/?_kx=FEEH9AFB93CSAhfFMTdzI667up-8niaunVPXkGAZ5ZfTl6Vhtk7XFmfEdGTn0T6e.Y9qupU
https://www.npvnt7trk.com/28KL61/79C6G4/?sub1=QM
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=6d2b3f1796d143a388f3f563fc3be441
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&aff...

115 KB
24 KB

1049ms
649ms

Document
text/html

2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

63c06c381b72584bd7a3bd4d24e7cfeae8c3be981caba35e8f86b3734cd286e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8a32a94a19141a28-EWR
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Sun, 14 Jul 2024 15:49:11 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 388
content-type: text/html; charset=utf-8
date: Sun, 14 Jul 2024 15:49:10 GMT
location: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: be8f8f3e-0c60-454b-839f-9102334cba3d

GET
H2 200 main.dd3603c48add10bbaae9.css
static-msql-prod.refinance.quickenloans.com/ 384 KB
46 KB 1010ms
223ms Stylesheet
text/css 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.dd3603c48add10bbaae9.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42b33a83f133036dadd5e7cdaedcb4f66b8a6696ddd8fa2b1ebc2f610359f43e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:12 GMT
x-amz-version-id: 6Yb_JQ.CpZb64tm7QUQugPjwU1fZuIe6
via: 1.1 ca247e02ffb307c612b610d164b0478a.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: BOS50-P4
age: 5558
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 03 Jul 2024 18:46:57 GMT
server: cloudflare
etag: W/"9ffeeb53017ec87e01f08aa2963cc437"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 8a32a95338b618cc-EWR
x-amz-cf-id: P-fkhpo_kIxy1_M-rm-eHBfjPtLU7h98MHr-Hq2d3Ol55EWaGru5UA==
expires: Sun, 14 Jul 2024 19:49:12 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 21 KB
7 KB 879ms
103ms Script
application/x-javascript 3.162.125.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.162.125.20 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-162-125-20.iad61.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 06:57:51 GMT
content-encoding: gzip
via: 1.1 6f3ebc2cbc39563710a79620f7c154f0.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: IAD61-P3
age: 31882
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6759
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Oct 2023 12:27:20 GMT
server: AmazonS3
etag: "15864ce88fa79a3e954417d0c3396798"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: iFaOPrPJD9cnANUe2Xo9a9ZNzU3mXZZu7zPi8uO4n3aFILjTdAep7A==

GET dacs.js
cs-cdn.deviceatlas.com/ 0
0

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
917 B 944ms
159ms Script
application/javascript 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efc6ca568cdf9d36f57664a37cceeab3585bb68a764e331c7c81e240e8d18137

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-c7114233cd489ae347ae.js
date: Sun, 14 Jul 2024 15:49:12 GMT
via: 1.1 8cdf4e2d4f4070992665477c4dbca0c0.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P2
age: 3657
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 26 Jun 2024 23:05:50 GMT
server: cloudflare
etag: W/"4c57be2488b4787a0d3e7b447f231fe3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8a32a9533d6242b8-EWR
x-amz-cf-id: IQLSTwA21oTjAR9HEHNq0YEu8Rsegw1bo4S4cSIGY6zMD-YQmlHQBg==
expires: Sun, 14 Jul 2024 19:49:12 GMT

GET
H2 200 launch-099982a746cc.min.js Show response
assets.adobedtm.com/b14636b10888/a3ec7ef1f366/ 257 KB
81 KB 876ms
91ms Script
application/x-javascript 2600:141b:f000:c0a6::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:f000:c0a6::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:12 GMT
content-encoding: gzip
last-modified: Mon, 02 Oct 2023 19:55:09 GMT
server: AkamaiNetStorage
etag: "b31a1f9e9f88d2133e2b3a9abeeddcd7:1696276509.604687"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 82392
expires: Sun, 14 Jul 2024 16:49:12 GMT

GET
H2 200 5fa1b4cbe02a560012bcbdf7 Show response
api.pushnami.com/scripts/v1/push/ 92 KB
19 KB 449ms
105ms Script
application/javascript 18.238.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/5fa1b4cbe02a560012bcbdf7
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.4.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-4-94.phl51.r.cloudfront.net
Software: /
Resource Hash: 71ca1526b583a6283752d155fada0ed1a64f1ea43cf17d88f4d39cfc315cc7d9

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:42:23 GMT
content-encoding: gzip
via: 1.1 a147f9c60c162e36df3586fdd9c01478.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL51-P1
age: 410
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: 15Q4BiCmVtm9FvFI3NMfjyGwDUGay-yN87e65Nu1pnEzZGh5s60Yxg==

GET
H2 200 main.dd3603c48add10bbaae9.js Show response
static-msql-prod.refinance.quickenloans.com/ 1 MB
246 KB 690ms
109ms Script
application/javascript 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.dd3603c48add10bbaae9.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2ceae1969bbea48adbdd6768a156dac3975e2c5d37a4634dc086ba327eb510d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:12 GMT
x-amz-version-id: pe3ET3xfdCy.d8JBi.ZgV22YEhN4HFF7
via: 1.1 fed200cefaebfb8fa1ffcc5b43eee6be.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: BOS50-P4
age: 3658
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 03 Jul 2024 18:46:57 GMT
server: cloudflare
etag: W/"1a85ff6394f78b84b90780b38dcbbd1a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8a32a95338b718cc-EWR
x-amz-cf-id: tIK31hN8-KTcCa8sx-jYv6I41QyNPsA65KqrF6UxE0deHFHUQhoFwg==
expires: Sun, 14 Jul 2024 19:49:12 GMT

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 433ms
126ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:14 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
server: cloudflare
etag: W/"2024.6.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8a32a95cac9a17e1-EWR

GET
H3 200 stack-ssi
fonts.cdnfonts.com/css/ 1 KB
739 B 404ms
97ms Stylesheet
text/css 2606:4700:3033::6815:487c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/stack-ssi
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dd3603c48add10bbaae9.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:487c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76b65310895e8341f3804e1f3d436a0910928874964daf20f6e2d7a8a69553f4

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1242358
cf-polished: origSize=1385
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sun, 30 Jun 2024 06:43:15 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1575gMahSC7nCTI4K41jrLVDePOW429VJHsi0ysMFC%2FfkESgJQziQtEYNFlRmNGmK3a%2B8oSWh6tYzsH1k8uXLkAeFQSx7%2FqQRfBebh%2Fqh85bLxi3XRqYfQhn2k6zYo4BqxwkmsCxGc0CZ%2FAXTEA%2B1jo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 8a32a956aa297c6a-EWR

GET
H3 200 myriad-pro
fonts.cdnfonts.com/css/ 2 KB
729 B 404ms
98ms Stylesheet
text/css 2606:4700:3033::6815:487c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/myriad-pro
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dd3603c48add10bbaae9.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:487c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ebc3cd1d0af023685181ad52ed67b334bad44ea95407db09b40c2de15fcc165

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 10628156
cf-polished: origSize=2010
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 13 Mar 2024 15:33:17 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tDWlHfyzBtVDrEbe4Lf8zAroUcNilN7IoAKZiKF701MpeWFi1sY6YhuRkhYzLCbnKvNKqXzZQNRK%2B64%2FnuRs4oFhv18BdJqNeaM6CtnyDjHNi36a2IBx%2FHG772EcP5bc9DGWOIkpMvCAaZ3F0GjJwAs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 8a32a956aa2b7c6a-EWR

GET
H2 200 css2
fonts.googleapis.com/ 875 B
502 B 488ms
165ms Stylesheet
text/css 2607:f8b0:400d:c04::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dd3603c48add10bbaae9.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c04::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4d2816f1f714364675a3a4ff25db96f2a5677b6cce94e150e61250bfdde4d258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 14 Jul 2024 15:49:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 14 Jul 2024 15:27:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 14 Jul 2024 15:49:13 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 445ms
123ms Stylesheet
text/css 2607:f8b0:400d:c04::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dd3603c48add10bbaae9.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c04::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

971b2673f92ee01c1b6e98372fdefdd4f0a83714167783eba0671fa0d966f9f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 14 Jul 2024 15:49:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 14 Jul 2024 15:27:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 14 Jul 2024 15:49:13 GMT

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
861 B 480ms
157ms Stylesheet
text/css 2607:f8b0:400d:c04::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dd3603c48add10bbaae9.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c04::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fef95b324850099ff32808fb88cbf0af034d69cc4558110ea65e3b323fc17d0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 14 Jul 2024 15:49:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 14 Jul 2024 15:27:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 14 Jul 2024 15:49:13 GMT

GET
H2 200 css2
fonts.googleapis.com/ 427 B
400 B 479ms
157ms Stylesheet
text/css 2607:f8b0:400d:c04::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dd3603c48add10bbaae9.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c04::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 14 Jul 2024 15:49:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 14 Jul 2024 15:27:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 14 Jul 2024 15:49:13 GMT

GET
H2 200 dacs.js Show response
content.lowermybills.com/deviceatlas-1.6/ 21 KB
7 KB 460ms
110ms Script
application/javascript 2606:4700::6812:1ff5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://content.lowermybills.com/deviceatlas-1.6/dacs.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:1ff5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

592f244a454b1fabb9420ddc74002f325b0ebfc4d912815f45a4585b0685da8f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:28 GMT
via: 1.1 5ba825173b1f7429171e730e7ae12588.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 2156
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Jul 2024 03:49:46 GMT
server: cloudflare
etag: W/"bce79d9575b3d328f46a0c856ff9bf44"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 8a32a9b7ffee7ce8-EWR
x-amz-cf-id: 26wEzM6HoyDlr9rZdgvsyINgdSBJ8ua_1SToNw52kUAhy_VsExQZ6A==
expires: Sun, 14 Jul 2024 17:49:28 GMT

GET
H2 200 pixel-c7114233cd489ae347ae.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 190 KB
24 KB 105ms
105ms Script
application/javascript 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd35d03cc363c21dafc6bb78ba34fa54cc77ff6f6060814039c36e97bb69cfcd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:28 GMT
content-encoding: gzip
via: 1.1 d3a2886dcf7e47b1e56baf628c69dc24.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P2
age: 5458
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 26 Jun 2024 21:50:51 GMT
server: cloudflare
etag: W/"235a063695e9c2ae54d1cdf44776580d"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8a32a9b5bd5d42b8-EWR
x-amz-cf-id: atfnkq1r2QVSoa8rExO8I-8RUeaHHY6mI-EW_wtY9tN1ueQeibZ_Yg==
expires: Sun, 14 Jul 2024 19:49:28 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720972168768
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720972168768

609 B
1 KB

92ms
92ms

XHR
application/json

34.239.196.49
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720972168768

Requested by

Protocol

Server

34.239.196.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-239-196-49.compute-1.amazonaws.com

Software

Resource Hash

471d6534e987028a4c979a1fcdfa49ab63b9286ebdda0f98da52c218e373f5b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

dcs: dcs-prod-va6-1-v061-04a376012.edge-va6.demdex.com 3 ms
pragma: no-cache
date: Sun, 14 Jul 2024 15:49:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: LhuXdNbNTM4=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 443
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-va6-2-v061-039fe58e1.edge-va6.demdex.com 0 ms
pragma: no-cache
date: Sun, 14 Jul 2024 15:49:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: 1iT3F6HyQGA=
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720972168768
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 508ms
111ms Script
application/javascript 13.32.206.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.206.192 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-206-192.iad66.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:05 GMT
content-encoding: br
via: 1.1 7c246f3a389d2701a9bf150d0e576cd0.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: IAD66-C1
age: 25
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: YS82a-KtXFjIxjCgOWw8Onp9pwKcRTmeg2W0AbuVhEkOktUJFsnvhg==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 282 KB
96 KB 442ms
121ms Script
application/javascript 2607:f8b0:400d:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0b::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

529d2b4d60d18da5290bb2ddae32997159928b464146843298f44a0544eb1fd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 98196
x-xss-protection: 0
last-modified: Sun, 14 Jul 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 14 Jul 2024 15:49:29 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 318 KB
104 KB 101ms
100ms Script
application/javascript 2607:f8b0:400d:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0b::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

875be6f7f5b6b5e46cbb6d282d453270131f56de12039f4893ceb48ed85ef503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 106367
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 14 Jul 2024 15:49:29 GMT

GET
H2

200

nsjs Show response
action.media6degrees.com/orbserv/
Redirect Chain

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]

5 B
631 B

131ms
129ms

Script
text/html

2606:4700:4400::6812:2412
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Server: 2606:4700:4400::6812:2412 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 14 Jul 2024 15:49:30 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=ISO-8859-1
content-language: en-US
access-control-allow-origin: *
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
cf-ray: 8a32a9bebcb26992-PHL

Redirect headers

location: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
access-control-allow-origin: *
date: Sun, 14 Jul 2024 15:49:29 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8a32a9bdbba06992-PHL
content-type: text/html; charset=iso-8859-1

GET
H3

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:4ld0kml&fmt=3
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NzI5ZWFjZTItNDAzYS00ODhmLThmYzQtOTM4ZTdiMGM5Y2Q4&gdpr=0&gdpr_consent=&ttd_tdid=729eace2-403a-488f-8fc4-938e7...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=NzI5ZWFjZTItNDAzYS00ODhmLThmYzQtOTM4ZTdiMGM5Y2Q4&gdpr=0&gdpr_consent=&ttd_tdid=729eace2-403a-488f-8fc4-938...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=729eace2-403a-488f-8fc4-938e7b0c9cd8&google_gid=CAESEKVo5LMB30kCK1_5riBfHaw&google_cver=1
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=729eace2-403a-488f-8fc4-938e7b0c9cd8
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D729eace2-403a-488f-8fc4-938e7b0c9cd8
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1933191573267914905&ttd_tdid=729eace2-403a-488f-8fc4-938e7b0c9cd8
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=729eace2-403a-488f-8fc4-938e7b0c9cd8&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=729eace2-403a-488f-8fc4-938e7b0c9cd8&expiration=1723564172&gdpr=0&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=729eace2-403a-488f-8fc4-938e7b0c9cd8&expiration=1723564172&gdpr=0&gdpr_consent=&C=1

43 B
740 B

107ms
107ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=729eace2-403a-488f-8fc4-938e7b0c9cd8&expiration=1723564172&gdpr=0&gdpr_consent=&C=1
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 14 Jul 2024 15:49:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rpkpJyv%2BuQ51%2F0CzSIvRY%2BiqLiiMQtrYkw%2BjrMIYnx4Ulqgs7S5EfVpTDXQdXrlXaIuaYqtyxvnFf9C%2FZxB1rXchUoyfaTepVjMGMK1fLyKFuuxlUJNJ7lpfUGTkV0tBs%2Fewsw04HhIuuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8a32a9cec95d5e6a-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 14 Jul 2024 15:49:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jz7xtbKjRZi288tWMKr4hmLgbMf2ET3CGzvYz2RS990MBjvrmbO8i%2BnWyBZlH%2BW812BoKOcR2dZhTUubX%2BThhQP4eA5SP92kS9R6%2Ftb6FxWFtzcx0SKZKLfwQNjQDbYxL7bmN00Cm04p9g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=39&external_user_id=729eace2-403a-488f-8fc4-938e7b0c9cd8&expiration=1723564172&gdpr=0&gdpr_consent=&C=1
cache-control: no-cache
cf-ray: 8a32a9ce18765e6a-EWR
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 dest5.html
quicken.demdex.net/ Frame 42B0 0
0 497ms
140ms Document
text/html 44.199.30.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.199.30.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-199-30-155.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Sun, 14 Jul 2024 15:49:29 GMT
dcs: dcs-prod-va6-2-v061-05380a920.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Fri, 12 Jul 2024 08:47:01 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: CSaaR+3gTbc=

GET
H2 200 id Show response
somni.rocketmortgage.com/ 48 B
471 B 570ms
164ms XHR
application/x-javascript 63.140.38.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.rocketmortgage.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=89333612295401018891039707723391236976&ts=1720972169434

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.138 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-138.data.adobedc.net

Software

jag /

Resource Hash

a1bb3b43e5d97a224100cd1db6d015fb6d55bed6beeae3e2f666336922bc7cfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 14 Jul 2024 15:49:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

POST
H2 204 collect Show response
analytics.google.com/g/ 0
253 B 531ms
172ms Fetch
text/plain 2607:f8b0:400d:c0b::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je4790v9169491831z89137104487za200zb9137104487&_p=1720972168786&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=169837959.1720972170&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1720972169&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D724780ecbdbe4c57869b5b60d47c1f49%26pkey%3D6d2b3f1796d143a388f3f563fc3be441%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D724780ecbdbe4c57869b5b60d47c1f49%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=20446&_z=fetch
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c0b::66 Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 14 Jul 2024 15:49:29 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
262 B 561ms
173ms Ping
text/plain 2607:f8b0:400d:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-RXLL9Z7XBK&cid=169837959.1720972170&gtm=45je4790v9169491831z89137104487za200zb9137104487&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c0c::9d Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 14 Jul 2024 15:49:30 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect Show response
analytics.google.com/g/ 0
55 B 514ms
174ms Fetch
text/plain 2607:f8b0:400d:c0b::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je4790v9169491831z89137104487za200zb9137104487&_p=1720972168786&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=169837959.1720972170&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1720972169&sct=1&seg=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D724780ecbdbe4c57869b5b60d47c1f49%26pkey%3D6d2b3f1796d143a388f3f563fc3be441%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D724780ecbdbe4c57869b5b60d47c1f49%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_et=3&tfd=20465&_z=fetch
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c0b::66 Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 14 Jul 2024 15:49:29 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hub
api.pushnami.com/scripts/v1/ Frame D360 0
0 413ms
106ms Document
text/html 18.238.4.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/5fa1b4cbe02a560012bcbdf7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.4.44 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-4-44.phl51.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 2121
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Sun, 14 Jul 2024 15:14:12 GMT
vary: accept-encoding
via: 1.1 155cf052093c04a91231ce0752765784.cloudfront.net (CloudFront)
x-amz-cf-id: sy19oPCPm1IT2m6uOKMzBPuIa3unj69c4woQfdvf2wlgs6upWHyydg==
x-amz-cf-pop: PHL51-P1
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
179 B 172ms
170ms XHR
text/plain 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Sun, 14 Jul 2024 15:49:32 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8a32a9cfac711a28-EWR

GET
H2 200 favicon.ico
refinance.quickenloans.com/ 114 KB
23 KB 107ms
106ms Other
text/html 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/favicon.ico

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

6712b74785b67ec15497648a85314e3a0429275066fb79d9059c74ab5bf9d898

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=724780ecbdbe4c57869b5b60d47c1f49&pkey=6d2b3f1796d143a388f3f563fc3be441&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=724780ecbdbe4c57869b5b60d47c1f49&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sun, 14 Jul 2024 15:49:33 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
age: 108
x-powered-by: Express
x-xss-protection: 1; mode=block
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 8a32a9d2ff4e1a28-EWR
expires: Sun, 14 Jul 2024 19:49:33 GMT

OPTIONS psp
psp.pushnami.com/api/ Frame 0
0

POST psp
psp.pushnami.com/api/ 0
0

POST track
trc.pushnami.com/api/push/ 0
0

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 514ms
146ms Preflight 174.129.180.120

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.129.180.120 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Sun, 14 Jul 2024 15:49:34 GMT

POST track
trc.pushnami.com/api/push/ 0
0

OPTIONS track
trc.pushnami.com/api/push/ Frame 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cs-cdn.deviceatlas.com
URL: https://cs-cdn.deviceatlas.com/dacs.js

Domain: psp.pushnami.com
URL: https://psp.pushnami.com/api/psp

Domain: psp.pushnami.com
URL: https://psp.pushnami.com/api/psp

Domain: trc.pushnami.com
URL: https://trc.pushnami.com/api/push/track

Domain: trc.pushnami.com
URL: https://trc.pushnami.com/api/push/track

Domain: trc.pushnami.com
URL: https://trc.pushnami.com/api/push/track

Verdicts & Comments Add Verdict or Comment

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

36 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.npvnt7trk.com/	1970-01-20 22:04:40	Name: uniqueClick_79C6G4 Value: e1781659-e735-40c3-96dc-dc00bf669efb:1720972150
www.npvnt7trk.com/	1970-01-21 00:12:28	Name: transaction_id Value: 6d2b3f1796d143a388f3f563fc3be441
www.lmbahsj2.com/	1970-01-20 22:04:18	Name: uniqueClick_FGXLG Value: feb70144-1539-4ca9-a85a-ccb618913ca1:1720972150
www.lmbahsj2.com/	1970-01-21 00:12:28	Name: transaction_id Value: 724780ecbdbe4c57869b5b60d47c1f49
.quickenloans.com/	1970-01-21 06:48:28	Name: visitorId Value: b8439332-d3f4-410c-a84c-dee9936106d6
refinance.quickenloans.com/	1970-01-21 06:48:28	Name: visitorId Value: b8439332-d3f4-410c-a84c-dee9936106d6
refinance.quickenloans.com/	1970-01-20 22:12:56	Name: contentTarget Value: %7B%22sourceId%22%3A%22affl_everflow_ql-lre_9_809%22%7D
.refinance.quickenloans.com/	1970-01-20 22:02:53	Name: __cf_bm Value: 2ZHz6pVPew1gc8mJZa2OuvrFiCThWqN1klEEify19ao-1720972151-1.0.1.1-ss0WcVeF2N0yOM7lkuQgBFd9YO1OiBg45KGqvUcbI9gl00iyacON_VlvG8cQ7oGZSRFbr1IIosRyYrQoyJBMig
.lowermybills.com/	1970-01-20 22:02:53	Name: __cf_bm Value: ovoZ_HTxHArTtesSqR3D4vxJEue2OPaMZWiCibjMvUs-1720972168-1.0.1.1-zUJKzS8MyX1oS78ZJcpn3W9lBKef068ent_lZRDw9QYhVQn.hjiyjCQsgqU_4MrVJM5oLdYw_xx24ynsdRp27g
.demdex.net/	1970-01-21 02:22:04	Name: demdex Value: 89140718745835468251018166713508741048
.quickenloans.com/	1970-01-21 00:12:28	Name: _gcl_au Value: 1.1.1806587792.1720972169
refinance.quickenloans.com/	1970-01-20 22:02:53	Name: _dd_s Value: rum=0&expire=1720973069414
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
.quickenloans.com/	1970-01-21 07:38:52	Name: _ga Value: GA1.1.169837959.1720972170
.quickenloans.com/	1970-01-21 07:38:52	Name: _ga_RXLL9Z7XBK Value: GS1.1.1720972169.1.1.1720972169.60.0.0
.adsrvr.org/	1970-01-21 06:48:28	Name: TDID Value: 729eace2-403a-488f-8fc4-938e7b0c9cd8
.quickenloans.com/	1970-01-21 07:38:52	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 179643557%7CMCIDTS%7C19919%7CMCMID%7C89333612295401018891039707723391236976%7CMCAAMLH-1721576969%7C7%7CMCAAMB-1721576969%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1720979370s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.5.0
.demdex.net/	1970-01-21 02:22:04	Name: dextp Value: 21-1-1720972169955\|771-1-1720972170056
.media6degrees.com/	1970-01-21 02:22:04	Name: clid Value: 2sgmemi01170e9emg8dgs0gu000000015g010t01701
.media6degrees.com/	1970-01-21 02:22:04	Name: sglst Value: 44xw008s01np3k7ze
.media6degrees.com/	1970-01-21 02:22:04	Name: acs Value: 014020i0j0k1sgmemixzt10xzt10xzt10
.doubleclick.net/	1970-01-21 07:38:52	Name: IDE Value: AHWqTUloaGW2oNJvhiJnqG1WfC0Yx5s8jf4lq297Igl_GEJKsqzPC4dP970tXRiBHZY
.agkn.com/	1970-01-21 06:48:28	Name: ab Value: 0001%3AS2P0RFsRyJRdwP2G60embBdvPu1MGZZz
.doubleclick.net/	1970-01-20 22:02:53	Name: test_cookie Value: CheckForPermission
.dpm.demdex.net/	1970-01-21 02:22:04	Name: dpm Value: 89140718745835468251018166713508741048
.adnxs.com/	1970-01-21 00:12:28	Name: XANDR_PANID Value: iEEP5LHs341EdovDz7dH0j3D46SMRQeJbA-TJIV63zypi3LamyIitQ20h_O-nvjS0JvB3830vvN8o7zdRsI3U516tV4ulAD_ahBHFtcwDOk.
.adnxs.com/	1970-01-21 07:38:52	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 00:12:28	Name: uuid2 Value: 1933191573267914905
.rubiconproject.com/	1970-01-21 06:48:28	Name: audit_p Value: 1\|5fO7FiXrazF8x7qIoAuXGACnp/wOORs9Z5fDCNr0XTnCWWOn7PymVisyldx+IG5d89cTFz4m+J+M1KxoLazIt9i2Wk5FrGos0XY24Ec+XLvnN2DwqVkjxiiJb+CyqVvZ8GOl1rXit8bg0ir/9GbVbVIyJxcSUXWi5jPYX1GOk3NbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.rubiconproject.com/	1970-01-21 06:48:28	Name: khaos Value: LYLQEAHH-18-KX8
.rubiconproject.com/	1970-01-21 06:48:28	Name: khaos_p Value: LYLQEAHH-18-KX8
.rubiconproject.com/	1970-01-21 06:48:28	Name: audit Value: 1\|5fO7FiXrazF8x7qIoAuXGACnp/wOORs9Z5fDCNr0XTnCWWOn7PymVisyldx+IG5d89cTFz4m+J+M1KxoLazIt9i2Wk5FrGos0XY24Ec+XLvnN2DwqVkjxiiJb+CyqVvZ8GOl1rXit8bg0ir/9GbVbVIyJxcSUXWi5jPYX1GOk3NbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.adsrvr.org/	1970-01-21 06:48:28	Name: TDCPM Value: CAESFQoGZ29vZ2xlEgsIlOGmz9KJkj0QBRIXCghhcHBuZXh1cxILCPjQndbSiZI9EAUSFgoHcnViaWNvbhILCNDwndbSiZI9EAUSFQoGY2FzYWxlEgsIsvXi3dKJkj0QBRgFIAMoATILCNbVz_ToiZI9EAVCDyINCAESCQoFdGllcjIQAVoHZ3I0MGEzemABcgZjYXNhbGU.
.casalemedia.com/	1970-01-21 06:48:28	Name: CMID Value: ZpPzjNHM5yYAAF9SACVNGwAA
.casalemedia.com/	1970-01-21 00:12:28	Name: CMPS Value: 1347
.casalemedia.com/	1970-01-21 00:12:28	Name: CMPRO Value: 1347

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cs-cdn.deviceatlas.com/dacs.js Message: Failed to load resource: net::ERR_CONNECTION_CLOSED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

action.dstillery.com
action.media6degrees.com
analytics.google.com
api.pushnami.com
assets.adobedtm.com
cm.g.doubleclick.net
content.lowermybills.com
cs-cdn.deviceatlas.com
dpm.demdex.net
dsum-sec.casalemedia.com
fonts.cdnfonts.com
fonts.googleapis.com
ib.adnxs.com
insight.adsrvr.org
match.adsrvr.org
pixel.rubiconproject.com
psp.pushnami.com
quicken.demdex.net
quickenloansrefi.com
refinance.quickenloans.com
somni.rocketmortgage.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
stats.g.doubleclick.net
trackpixel.refinance.quickenloans.com
trc.pushnami.com
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.googletagmanager.com
www.lmbahsj2.com
www.npvnt7trk.com
cs-cdn.deviceatlas.com
psp.pushnami.com
trc.pushnami.com
104.18.36.155
13.32.206.192
174.129.180.120
18.238.4.44
18.238.4.94
2600:141b:f000:c0a6::1e80
2606:4700:3033::6815:487c
2606:4700:4400::6812:2412
2606:4700::6810:5049
2606:4700::6812:1ff5
2606:4700::6812:c2b
2606:4700::6812:d2b
2607:f8b0:400d:c04::5f
2607:f8b0:400d:c0b::61
2607:f8b0:400d:c0b::66
2607:f8b0:400d:c0c::9d
3.162.125.20
34.239.196.49
34.36.162.171
35.201.76.131
44.199.30.155
52.223.40.198
63.140.38.138
66.29.132.28
68.67.179.153
69.173.151.100
74.125.192.156
02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9
2ebc3cd1d0af023685181ad52ed67b334bad44ea95407db09b40c2de15fcc165
42b33a83f133036dadd5e7cdaedcb4f66b8a6696ddd8fa2b1ebc2f610359f43e
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
471d6534e987028a4c979a1fcdfa49ab63b9286ebdda0f98da52c218e373f5b6
4d2816f1f714364675a3a4ff25db96f2a5677b6cce94e150e61250bfdde4d258
4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b
529d2b4d60d18da5290bb2ddae32997159928b464146843298f44a0544eb1fd9
592f244a454b1fabb9420ddc74002f325b0ebfc4d912815f45a4585b0685da8f
63c06c381b72584bd7a3bd4d24e7cfeae8c3be981caba35e8f86b3734cd286e8
6712b74785b67ec15497648a85314e3a0429275066fb79d9059c74ab5bf9d898
71ca1526b583a6283752d155fada0ed1a64f1ea43cf17d88f4d39cfc315cc7d9
76b65310895e8341f3804e1f3d436a0910928874964daf20f6e2d7a8a69553f4
7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3
875be6f7f5b6b5e46cbb6d282d453270131f56de12039f4893ceb48ed85ef503
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
971b2673f92ee01c1b6e98372fdefdd4f0a83714167783eba0671fa0d966f9f7
a1bb3b43e5d97a224100cd1db6d015fb6d55bed6beeae3e2f666336922bc7cfd
a2ceae1969bbea48adbdd6768a156dac3975e2c5d37a4634dc086ba327eb510d
afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
cd35d03cc363c21dafc6bb78ba34fa54cc77ff6f6060814039c36e97bb69cfcd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
efc6ca568cdf9d36f57664a37cceeab3585bb68a764e331c7c81e240e8d18137
fef95b324850099ff32808fb88cbf0af034d69cc4558110ea65e3b323fc17d0e

refinance.quickenloans.com Open in urlscan Pro 2606:4700::6812:c2b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

37 Requests

76 %HTTPS

41 %IPv6

24 Domains

31 Subdomains

21 IPs

2 Countries

728 kBTransfer

3072 kBSize

36 Cookies

0 Outgoing links

Page URL History

Redirected requests

37 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:c2b Public Scan

Screenshot
Live screenshot

Full Image

37
Requests

76 %
HTTPS

41 %
IPv6

24
Domains

31
Subdomains

21
IPs

2
Countries

728 kB
Transfer

3072 kB
Size

36
Cookies

37 HTTP transactions
0 data transactions