auth.savings.workingadvantage.com Open in urlscan Pro
104.18.36.113  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Page URL
2. https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	503	sign-in Show response auth.savings.workingadvantage.com/vystarcu/	10 KB 11 KB	71ms 27ms	Document text/html	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a3e2baa1a6cbdf15a266f8259ce4fd9c2fdab32deabd360e0b13a2f658a34c54 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7645e8722e30905e-FRA content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy same-origin date Thu, 03 Nov 2022 14:47:56 GMT expires Thu, 01 Jan 1970 00:00:01 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin server cloudflare strict-transport-security max-age=5184000; includeSubDomains vary Accept-Encoding x-content-type-options nosniff x-frame-options SAMEORIGIN
GET H2	200	challenges.css auth.savings.workingadvantage.com/cdn-cgi/styles/	6 KB 3 KB	12ms 11ms	Stylesheet text/css	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/styles/challenges.css Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash faa67d3b2b2220dc526c921c1fc47df5b956559a293d5e07fbaf58a52462f6bd Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:47:56 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 28 Oct 2022 14:03:59 GMT server cloudflare etag W/"635be14f-1896" x-frame-options DENY vary Accept-Encoding content-type text/css cache-control max-age=7200, public cf-ray 7645e8727ed8905e-FRA expires Thu, 03 Nov 2022 16:47:56 GMT
GET H2	200	favicon.ico auth.savings.workingadvantage.com/	4 KB 4 KB	409ms 408ms	Image text/html	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://auth.savings.workingadvantage.com/favicon.ico Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:47:56 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff content-security-policy frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com last-modified Tue, 25 Oct 2022 01:24:22 GMT server cloudflare cf-cache-status DYNAMIC content-encoding br vary Accept-Encoding x-frame-options DENY content-type text/html; charset=utf-8 cf-ray 7645e8727ee3905e-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	v1 Show response auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/	53 KB 23 KB	28ms 27ms	Script application/javascript	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=7645e8722e30905e Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7be00f86e5f7d3929d014fb5de75ef9fb6fbd59e1c1bc75c5cb894b2bdc85d3 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email&__cf_chl_rt_tk=tuCwcgEabHr19wr8SlEII3bEuIkwhPly_feZd_u0POg-1667486876-0-gaNycGzNCGU User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:47:56 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff content-encoding br server cloudflare content-type application/javascript; charset=UTF-8 cache-control max-age=0, must-revalidate cf-ray 7645e8729f14905e-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	transparent.gif auth.savings.workingadvantage.com/cdn-cgi/images/trace/jsch/js/	42 B 129 B	27ms 27ms	Image image/gif	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://auth.savings.workingadvantage.com/cdn-cgi/images/trace/jsch/js/transparent.gif?ray=7645e8722e30905e Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email&__cf_chl_rt_tk=tuCwcgEabHr19wr8SlEII3bEuIkwhPly_feZd_u0POg-1667486876-0-gaNycGzNCGU Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email&__cf_chl_rt_tk=tuCwcgEabHr19wr8SlEII3bEuIkwhPly_feZd_u0POg-1667486876-0-gaNycGzNCGU User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:47:56 GMT x-content-type-options nosniff last-modified Fri, 28 Oct 2022 14:03:59 GMT server cloudflare etag "635be14f-2a" x-frame-options DENY vary Accept-Encoding content-type image/gif cache-control max-age=7200, public accept-ranges bytes cf-ray 7645e8729f21905e-FRA content-length 42 expires Thu, 03 Nov 2022 16:47:56 GMT
GET DATA	200 OK	truncated /	586 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/png
POST H3	200	c9460914e38b1b2 Show response auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7564061700056129:1667485439:7ayVbq0P5wVHqn4eAn51RDFoNAkon5JpDBg7eXwbTSE/7645e8722e30905e/	125 KB 62 KB	117ms 115ms	XHR text/plain	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7564061700056129:1667485439:7ayVbq0P5wVHqn4eAn51RDFoNAkon5JpDBg7eXwbTSE/7645e8722e30905e/c9460914e38b1b2 Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=7645e8722e30905e Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 69dbc2b085027bcf304b17b1472e019ce51189031ac000371d96088ecd0357ae Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 CF-Challenge c9460914e38b1b2 Content-type application/x-www-form-urlencoded Response headers date Thu, 03 Nov 2022 14:47:56 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff cf_chl_gen H6DyfIrG5u4bkWSnbLsS55gfz5VUOOIUEHcpQR97AVRLyh+5s2hGORC0u9D6jtMdHaGfVcYyfZjoWd49Q+nRkknEeQ5u0w9k3F754ti9/h335CY6zjEn5LNHvDX+vSRle5h4wlpX0Uxed+bgo1Ro52ZdZUJLJk1nibkZrh4ekzXZhVCaJgPf8dr8FhE37Gv9hUHfcURcvnZfso8m3UGG+zd244/7ZwOI7H+XkDiYZbQali5wF26cwmD+Ou81O5/kXQPeuuT2BCLNi09575Wi68BlxlxFUwNaw/8YDZnu8tEWaycztDBYcm3S1yYN2yzszxOIk4J3nUUapTeAZKga1zVwreL8q3w1kFCytiNBiMo=$Ms4UJzEMxXo7wI2nQqbmqQ== content-encoding br server cloudflare content-type text/plain; charset=UTF-8 cf-ray 7645e873a81d9b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	401	ah6g4GzbsNK4FvX Show response auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/pat/7645e8722e30905e/1667486876765/bb6348dedb3fd7ca77d994132af003b4d5b2b7e9e4718ecd770a5cc7dced66ec/	1 B 686 B	25ms 24ms	Fetch text/plain	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/pat/7645e8722e30905e/1667486876765/bb6348dedb3fd7ca77d994132af003b4d5b2b7e9e4718ecd770a5cc7dced66ec/ah6g4GzbsNK4FvX Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:47:56 GMT strict-transport-security max-age=5184000; includeSubDomains www-authenticate PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gu2NI3ts_18p32ZQTKvADtNWyt-nkcY7Ndwpcx9ztZuwAIWF1dGguc2F2aW5ncy53b3JraW5nYWR2YW50YWdlLmNvbQ==, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEA6IBJrV72Jez65WmLraZfhk2MHBiVZa71Aj-jzrZ6nETzJSDQ01W-j9yYMLX15nX3Ps7oeTVUHNemizgqdlty2CmVfI4yNdAJuXgwdyaFePc7jEml6b5Iyy9SXoOTDSL5sr2WRLaR17hpvxQ6pOuuJ6EssK1vQ48CGVGce7YMlo_3CExqjxmsXqlHCWn3k-C9gAwMksjn4OU0GaDYXb75TlOWQitxV45hV3ULxfrMGytNkBrfKcENbwlx8XTPYpyWwGrafQltMX6vkF-UsxpHFBbBUyhso5m2_tJVNzGMGdxwmuIYb3AzZ0p-UBh0TJxfpDAk9-gyERUrZ7trPapTQQIDAQAB, max-age=15 x-content-type-options nosniff server cloudflare content-type text/plain; charset=UTF-8 cf-ray 7645e874ba7d9b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	Vpodi179jKAGNRP auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/img/7645e8722e30905e/1667486876770/	61 B 196 B	25ms 24ms	Image image/png	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/img/7645e8722e30905e/1667486876770/Vpodi179jKAGNRP Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 600cc11dba314e330d8eb78747f8f0ac608c184f32de34cb96a9bc282a557560 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:47:57 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff server cloudflare cf-ray 7645e87849f29b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-type image/png
POST H3	200	c9460914e38b1b2 Show response auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7564061700056129:1667485439:7ayVbq0P5wVHqn4eAn51RDFoNAkon5JpDBg7eXwbTSE/7645e8722e30905e/	1 KB 2 KB	76ms 75ms	XHR text/html	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7564061700056129:1667485439:7ayVbq0P5wVHqn4eAn51RDFoNAkon5JpDBg7eXwbTSE/7645e8722e30905e/c9460914e38b1b2 Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=7645e8722e30905e Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 11e22bed8ed6da4c20008f72839d0d23ea360f115d91f2b179ad4f3a0335296c Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 CF-Challenge c9460914e38b1b2 Content-type application/x-www-form-urlencoded Response headers date Thu, 03 Nov 2022 14:47:57 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff content-encoding br server cloudflare cf_chl_out vBo2BeLWZ/KWqiyAlewO05KkTnJtVR0XV5E7jgZmNFwpzMgS1RMDsq+gHOgivnsWRi7F3tVu7jeyO1YyBrQwlg==$YK3gO/jWn20k2rYFVm/tYw== content-type text/html; charset=UTF-8 cf_chl_out_s d7p9sjc0Cd+Qe/EFthvipQKotZFktCoUC3p9VdTOxRSkxhpA32ckjQLyEFCx8+jZuNJ5WlM5LHfQnkrs+yJb9a09VZqtX4tiDYp7maO712ch3+mrkLn+mmv9WKr0yyGwnlk0f3+SivSYSJRt90LW57f/a2NYC1LbR5Q3jbGcmPx0thesrICmDCOtsp5vc777WHB7RDPhNv9QXBFDq0kSKk4U1KF0NEl3lzwDQZHHqoU/aNtuznNSzZkcgftudpI0R26OInKmNfcuj834XCuAR1yIBbaD32tUIIYkkVDUgcHcJVzerIwIc5qD+sf12v82T4P/x0bbL5YyV/92d5JazXVQRuFwHACYj8f79eH7e3/T8Luqr76AEIJHAGkdbj47sivuohBHnI+B/v6oGV/YTWLBEZHUhZMzxVU0XbpXM68=$Pg3wVW0WEcFAATW4cZ8Gzg== cf-ray 7645e87a6e129b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	503	Primary Request sign-in Show response auth.savings.workingadvantage.com/vystarcu/	10 KB 11 KB	19ms 18ms	Document text/html	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5e55dd496968c3934f2867ce2c1a450472fdbb881fbd3abce2d1f98242cf5c80 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7645e88b5aba9b28-FRA content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy same-origin date Thu, 03 Nov 2022 14:48:00 GMT expires Thu, 01 Jan 1970 00:00:01 GMT permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin server cloudflare strict-transport-security max-age=5184000; includeSubDomains vary Accept-Encoding x-content-type-options nosniff x-frame-options SAMEORIGIN
GET H3	200	challenges.css auth.savings.workingadvantage.com/cdn-cgi/styles/	6 KB 3 KB	18ms 17ms	Stylesheet text/css	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/styles/challenges.css Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash faa67d3b2b2220dc526c921c1fc47df5b956559a293d5e07fbaf58a52462f6bd Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:48:00 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 28 Oct 2022 14:03:59 GMT server cloudflare etag W/"635be14f-1896" x-frame-options DENY vary Accept-Encoding content-type text/css cache-control max-age=7200, public cf-ray 7645e88b7af49b28-FRA expires Thu, 03 Nov 2022 16:48:00 GMT
GET H3	200	favicon.ico auth.savings.workingadvantage.com/	4 KB 4 KB	137ms 137ms	Image text/html	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://auth.savings.workingadvantage.com/favicon.ico Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:48:00 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff content-security-policy frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com last-modified Tue, 25 Oct 2022 01:24:22 GMT server cloudflare cf-cache-status DYNAMIC content-encoding br vary Accept-Encoding x-frame-options DENY content-type text/html; charset=utf-8 cf-ray 7645e88b7af99b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	v1 Show response auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/	55 KB 24 KB	109ms 108ms	Script application/javascript	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=7645e88b5aba9b28 Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash aa9f5e77fa36784eb84605bc619102761ca7c7931c957f57c522935f2de2b7f6 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email&__cf_chl_rt_tk=ZS.SVU9h9Z..S.5xyMXRLjwwqqLgzbF7k0hr33Rf3ZM-1667486880-0-gaNycGzNCCU User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:48:00 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff content-encoding br server cloudflare content-type application/javascript; charset=UTF-8 cache-control max-age=0, must-revalidate cf-ray 7645e88b9b5b9b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	transparent.gif auth.savings.workingadvantage.com/cdn-cgi/images/trace/jsch/js/	42 B 222 B	18ms 17ms	Image image/gif	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://auth.savings.workingadvantage.com/cdn-cgi/images/trace/jsch/js/transparent.gif?ray=7645e88b5aba9b28 Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email&__cf_chl_rt_tk=ZS.SVU9h9Z..S.5xyMXRLjwwqqLgzbF7k0hr33Rf3ZM-1667486880-0-gaNycGzNCCU Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email&__cf_chl_rt_tk=ZS.SVU9h9Z..S.5xyMXRLjwwqqLgzbF7k0hr33Rf3ZM-1667486880-0-gaNycGzNCCU User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:48:00 GMT x-content-type-options nosniff last-modified Fri, 28 Oct 2022 14:03:59 GMT server cloudflare etag "635be14f-2a" x-frame-options DENY vary Accept-Encoding content-type image/gif cache-control max-age=7200, public accept-ranges bytes cf-ray 7645e88b9b669b28-FRA content-length 42 expires Thu, 03 Nov 2022 16:48:00 GMT
GET DATA	200 OK	truncated /	586 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/png
POST H3	200	c0414fa044e858c Show response auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7845570469572233:1667485458:13S-Oc8P6vZORz9NkpGaoM0GdObOou_RWXgab6Tg358/7645e88b5aba9b28/	108 KB 62 KB	111ms 111ms	XHR text/plain	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7845570469572233:1667485458:13S-Oc8P6vZORz9NkpGaoM0GdObOou_RWXgab6Tg358/7645e88b5aba9b28/c0414fa044e858c Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=7645e88b5aba9b28 Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 66cb11a1a832076536cd027482609d42efe0db7c22ac87f59b7d5cd7853835b6 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 CF-Challenge c0414fa044e858c Content-type application/x-www-form-urlencoded Response headers date Thu, 03 Nov 2022 14:48:00 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff cf_chl_gen eNzjpB29lNfwnC7xP9eBcsVU6DyOzCKQJQ8EF79Z6ry93CyUa2H39mS6KB9rGelACnt5lOT8gxhm+laGegxUOR5Dl8rHpzQ19NKGWY2T15JGkAFk+eJWXCDi1Qpu8n/Fnm3Cf8sduMNf33ONShWBgi31+suoRDRwDn4fbtHF8jMDaJJjzx5gp8E6OUfd426kpJXEJnDgE/5iDOwSHIr1sl92euLzsXQmQunHd8k0sGN+5LrhKsdRCoiZchlMKvi0z4WrvV4P8m1scNhKFY224FaDkC+CYRkmcMU3iwlqQLbYVyGFtXUuoEQJ++VWDGMvoVVXy//be/wtWCkEn+spkKB+K9ZoCT4LSlkUuRfqx5VDlMe085ETeEwhLJVkTdXeUJXjOhFBMh90mVJelMdE0cE0G1Xy7N1smJVpyOQgoZez0m/gBmdfuTf8E04PyZHQ$6QURzsXvmlNbvep/8lkz3Q== content-encoding br server cloudflare content-type text/plain; charset=UTF-8 cf-ray 7645e88d1e939b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	401	okcmqJ3S3GO7Isp Show response auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/pat/7645e88b5aba9b28/1667486880841/c7939e654e3717b0f10b8c761d89197221850d90f2a8cd74e7ee801ef5c6e269/	1 B 1 KB	29ms 29ms	Fetch text/plain	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/pat/7645e88b5aba9b28/1667486880841/c7939e654e3717b0f10b8c761d89197221850d90f2a8cd74e7ee801ef5c6e269/okcmqJ3S3GO7Isp Requested by Host: auth.savings.workingadvantage.com URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:48:00 GMT strict-transport-security max-age=5184000; includeSubDomains www-authenticate PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gx5OeZU43F7DxC4x2HYkZciGFDZDyqM105-6AHvXG4mkAIWF1dGguc2F2aW5ncy53b3JraW5nYWR2YW50YWdlLmNvbQ==, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEA6IBJrV72Jez65WmLraZfhk2MHBiVZa71Aj-jzrZ6nETzJSDQ01W-j9yYMLX15nX3Ps7oeTVUHNemizgqdlty2CmVfI4yNdAJuXgwdyaFePc7jEml6b5Iyy9SXoOTDSL5sr2WRLaR17hpvxQ6pOuuJ6EssK1vQ48CGVGce7YMlo_3CExqjxmsXqlHCWn3k-C9gAwMksjn4OU0GaDYXb75TlOWQitxV45hV3ULxfrMGytNkBrfKcENbwlx8XTPYpyWwGrafQltMX6vkF-UsxpHFBbBUyhso5m2_tJVNzGMGdxwmuIYb3AzZ0p-UBh0TJxfpDAk9-gyERUrZ7trPapTQQIDAQAB, max-age=15 x-content-type-options nosniff server cloudflare content-security-policy-report-only script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=lXzyShC3QZfZkAxukJvp7ZXXy_F_yKNlcKcUnOtNFA0-1667486880-0-AZHZmWtFG4yo_QefXbIC9pTEl6XGaoeNHnLLEr3J6m9ULAQvZOloxaACh_5PCq9MrwZuvTbDbB4ZwOauJf3wCGFD5-f9ppi9RlUbe1CnSxzoFhaNIFfFKMzZ24GO6jgdXw; report-to cf-csp-endpoint report-to {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=lXzyShC3QZfZkAxukJvp7ZXXy_F_yKNlcKcUnOtNFA0-1667486880-0-AZHZmWtFG4yo_QefXbIC9pTEl6XGaoeNHnLLEr3J6m9ULAQvZOloxaACh_5PCq9MrwZuvTbDbB4ZwOauJf3wCGFD5-f9ppi9RlUbe1CnSxzoFhaNIFfFKMzZ24GO6jgdXw"}],"group":"cf-csp-endpoint","max_age":86400} content-type text/plain; charset=UTF-8 cf-ray 7645e88df89b9b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	IuL44ht0KSkcwhG auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/img/7645e88b5aba9b28/1667486880842/	61 B 195 B	29ms 28ms	Image image/png	104.18.36.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/img/7645e88b5aba9b28/1667486880842/IuL44ht0KSkcwhG Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.36.113 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 964b67f1c6b6209f9d10326c3a6971b7edb8a6d446cc73cc8a04dfe7490520e4 Security Headers Name Value Strict-Transport-Security max-age=5184000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 14:48:01 GMT strict-transport-security max-age=5184000; includeSubDomains x-content-type-options nosniff server cloudflare cf-ray 7645e88e29109b28-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-type image/png
GET DATA	200 OK	truncated /	68 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/png

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _cf_chl_opt function| sendRequest function| _cf_chl_enter boolean| _cf_chl_done_ran function| _cf_chl_done function| SHA256 object| _cf_chl_ctx string| prefix object| _

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.workingadvantage.com/	1970-01-20 07:11:28	Name: __cf_bm Value: 0oJadecPRWNrWY3OOWeTVVYGSNFTEReivPHPbVP3pGY-1667486876-0-AcmXPXA5Wp40w7L3/TlFN7OgHq4hWojsoResCCRG1c5Ktvu2txgPRZi0CWdkTLLynl58b9NcXj3KpWkKdDKxhks=
			auth.savings.workingadvantage.com/	1970-01-20 07:11:30	Name: cf_chl_rc_ni Value: 1
			auth.savings.workingadvantage.com/	1970-01-20 07:11:30	Name: cf_chl_2 Value: c0414fa044e858c
			auth.savings.workingadvantage.com/	1970-01-20 07:11:30	Name: cf_chl_prog Value: e

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/pat/7645e8722e30905e/1667486876765/bb6348dedb3fd7ca77d994132af003b4d5b2b7e9e4718ecd770a5cc7dced66ec/ah6g4GzbsNK4FvX Message: Failed to load resource: the server responded with a status of 401 ()
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://auth.savings.workingadvantage.com/vystarcu/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=November-3-2022-LasikPlus&utm_campaign=LasikPlus&redirect_uri=https://vystarcu.savings.workingadvantage.com/home?off_guid=1GwzuJem0qHPp2RsdCF5zt&utm_campaign=LasikPlus&utm_medium=November-3-2022-LasikPlus&utm_source=email Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/pat/7645e88b5aba9b28/1667486880841/c7939e654e3717b0f10b8c761d89197221850d90f2a8cd74e7ee801ef5c6e269/okcmqJ3S3GO7Isp Message: Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.savings.workingadvantage.com
104.18.36.113
11e22bed8ed6da4c20008f72839d0d23ea360f115d91f2b179ad4f3a0335296c
5e55dd496968c3934f2867ce2c1a450472fdbb881fbd3abce2d1f98242cf5c80
600cc11dba314e330d8eb78747f8f0ac608c184f32de34cb96a9bc282a557560
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
66cb11a1a832076536cd027482609d42efe0db7c22ac87f59b7d5cd7853835b6
69dbc2b085027bcf304b17b1472e019ce51189031ac000371d96088ecd0357ae
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
964b67f1c6b6209f9d10326c3a6971b7edb8a6d446cc73cc8a04dfe7490520e4
a3e2baa1a6cbdf15a266f8259ce4fd9c2fdab32deabd360e0b13a2f658a34c54
aa9f5e77fa36784eb84605bc619102761ca7c7931c957f57c522935f2de2b7f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7be00f86e5f7d3929d014fb5de75ef9fb6fbd59e1c1bc75c5cb894b2bdc85d3
faa67d3b2b2220dc526c921c1fc47df5b956559a293d5e07fbaf58a52462f6bd
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa