hotelequities.savings.workingadvantage.com Open in urlscan Pro
172.64.148.145 Public Scan

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 297 KB
100 KB 34ms
32ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1757a853f8c0a38f8eac334c0b306ac6430e6005c1287fd968be8baf7e3cd15c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 101878
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Apr 2024 16:25:31 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 61ms
8ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 01 Apr 2024 15:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2243
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 01 Apr 2024 17:48:08 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
241 B 16ms
14ms XHR
text/plain 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1154269116&t=pageview&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dhotelequities&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=YEBAAEABAAAAACAAI~&jid=1505693863&gjid=595921022&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&_r=1&_slc=1&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=766604899

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1da6ad9dfce9466037ec92e1f7699158c9a9347c669333c724f5cf6f3a7c0634

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
273 B 41ms
15ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je43r0v9112553684z878847533za200&_p=1711988730783&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1510506513.1711988731&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.86%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.86&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1711988731&sct=1&seg=0&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dhotelequities&dt=Beneplace%20Team%20Discounts&en=page_view&_fv=1&_ss=1&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dhotelequities&up.pb_site_name=hotelequities&up.page_path=%2Frelay&up.user_id_value=&up.zip_code=NaN&tfd=1830
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
365 B 66ms
19ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-2876877-9&cid=1510506513.1711988731&jid=1505693863&gjid=595921022&_gid=1089542927.1711988731&npa=1&_u=YEBAAEAAAAAAACAAI~&z=263057899

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 01 Apr 2024 16:25:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 278 KB
94 KB 31ms
30ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2f1e39291b8fa0b668c40fd8f5930b4967ed97e21ebcfef6c2bed3e2a1900b4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96361
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Apr 2024 16:25:31 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 17ms
12ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je43r0v9126564266za200&_p=1711988730783&gcd=13l3l3l2l3&npa=1&dma_cps=sypham&dma=1&ul=en-us&sr=800x600&cid=1510506513.1711988731&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.86%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.86&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dhotelequities&dt=Beneplace%20Team%20Discounts&sid=1711988731&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1958
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
hotelequities.savings.workingadvantage.com/api/ 7 KB
3 KB 149ms
148ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/info

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5135e9aa12b8c268a983c90564c8f04d5c728ecdd72be2c8cc6616135e00b6b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-ba7793b2b62835e7----1711988732026
traceparent: 00-d427142b8b9bae3cbbbf6edd272fed00-ba7793b2b62835e7-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImJhNzc5M2IyYjYyODM1ZTciLCJ0ciI6ImQ0MjcxNDJiOGI5YmFlM2NiYmJmNmVkZDI3MmZlZDAwIiwidGkiOjE3MTE5ODg3MzIwMjYsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequities
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1c36-Id1VpO9Duiq7sfvVCntSUGhL4uY"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef873b3a972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:31 GMT

GET
H3 200 marketplace-styles.css Show response
hotelequities.savings.workingadvantage.com/api/hotelequities/ 26 KB
5 KB 544ms
544ms XHR
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/hotelequities/marketplace-styles.css

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a9c612a43db8ce1ddd6c4390e88a171f25ec1fb2509277e3a2a4a89f83a03ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-ea661edc6e2b846b----1711988732028
traceparent: 00-f597d5f15fcee8a6d87da8069c450100-ea661edc6e2b846b-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImVhNjYxZWRjNmUyYjg0NmIiLCJ0ciI6ImY1OTdkNWYxNWZjZWU4YTZkODdkYTgwNjljNDUwMTAwIiwidGkiOjE3MTE5ODg3MzIwMjgsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequities
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"6994-cu8SGYV1/ZHj6aoSEgLeO8eW1gE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef873b3d972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:31 GMT

GET
H3 200 colors.css Show response
hotelequities.savings.workingadvantage.com/api/hotelequities/ 3 KB
845 B 156ms
155ms XHR
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/hotelequities/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ffc500f08853c8edb93a47f974b48dd180ff898f8f75829434b383e6802ddbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-7d007c3154146926----1711988732029
traceparent: 00-c90edaf3cc9d00c526ce0411d66e1d00-7d007c3154146926-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjdkMDA3YzMxNTQxNDY5MjYiLCJ0ciI6ImM5MGVkYWYzY2M5ZDAwYzUyNmNlMDQxMWQ2NmUxZDAwIiwidGkiOjE3MTE5ODg3MzIwMjksInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequities
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"ae6-ySrgfhpGMk2tmkej9cvI4pwFJ9Y"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef873b40972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:31 GMT

GET
H3

200

main.js Show response
hotelequities.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/ Frame 700D
Redirect Chain

https://hotelequities.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://hotelequities.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js

8 KB
4 KB

16ms
16ms

Script
application/javascript

172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js

Protocol

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

677071ee89d4b085fcd4a39fddb7c60dcd2f1f91b5409b5431866c0e1a141d48

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 86d9ef876b91972c-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/dc6b543c1346/main.js
cache-control: max-age=300, public
cf-ray: 86d9ef874b50972c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
26 KB 46ms
7ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=300
x-amz-request-id: FVBEBWHYA3TXWDVZ
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: vq90Yd8kIp02IXj9Xt1ADcXpETqOzEX6pI9HpqtmbZfhzIgjdM5dx+uEblGwqLnF/exxLg97dfo=
x-served-by: cache-fra-eddf8230123-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 1186

GET
H3 200 favicon.ico
hotelequities.savings.workingadvantage.com/ 9 KB
3 KB 123ms
122ms Other
text/html 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10c88766a47b9634a273135dfd7ab6abf02897e94262b2282b42ef7c0554cf63

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequities
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:03:09 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 86d9ef874b62972c-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 86d9ef7e1eef972c Show response
hotelequities.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 700D 0
349 B 39ms
38ms XHR
text/plain 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/jsd/r/86d9ef7e1eef972c

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 86d9ef887cee972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 hotelequities Show response
hotelequities.savings.workingadvantage.com/api/controls/ 997 B
912 B 151ms
150ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/controls/hotelequities

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-fcd071f0f75ff48b----1711988732237
traceparent: 00-b294b9feba5794670bd0bc70cb6ad100-fcd071f0f75ff48b-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImZjZDA3MWYwZjc1ZmY0OGIiLCJ0ciI6ImIyOTRiOWZlYmE1Nzk0NjcwYmQwYmM3MGNiNmFkMTAwIiwidGkiOjE3MTE5ODg3MzIyMzcsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequities
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef888d08972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:31 GMT

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/1/ 0
0

GET
H3 200 872.887569a6810827dc.js
hotelequities.savings.workingadvantage.com/ 4 KB
2 KB 113ms
112ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/872.887569a6810827dc.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequities
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-119e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9ef8ad8be972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 205ms
161ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: MISS
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9ef8b2d4b39ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET authorize
auth.savings.workingadvantage.com/auth/ Frame 1914 0
0

GET
H3 401 ebg-query-params
hotelequities.savings.workingadvantage.com/api/ 182 B
520 B 144ms
142ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/ebg-query-params

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-60664c497af10051----1711988732732
traceparent: 00-f7774e76cce9c44d73471bda98c34100-60664c497af10051-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjYwNjY0YzQ5N2FmMTAwNTEiLCJ0ciI6ImY3Nzc0ZTc2Y2NlOWM0NGQ3MzQ3MWJkYTk4YzM0MTAwIiwidGkiOjE3MTE5ODg3MzI3MzIsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequities
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by
etag: W/"b6-lGFIUF59ZyAYAhOl/ILN9N2OvBU"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cf-ray: 86d9ef8b99b0972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
content-length: 182
alt-svc: h3=":443"; ma=86400

GET
H3 200 info
hotelequities.savings.workingadvantage.com/api/ 9 KB
3 KB 156ms
155ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/info?authInfo=true

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-926ac6e769e564e8----1711988732736
traceparent: 00-bf16f8b2c16b8e617e2770b717f18500-926ac6e769e564e8-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjkyNmFjNmU3NjllNTY0ZTgiLCJ0ciI6ImJmMTZmOGIyYzE2YjhlNjE3ZTI3NzBiNzE3ZjE4NTAwIiwidGkiOjE3MTE5ODg3MzI3MzYsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequities
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"221b-TkuC+Gjqz2AU6MTXm+wZ97SIvKI"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef8ba9b4972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:31 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1154269116&t=pageview&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Hotel%20Equities%20Savings%20Marketplace&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=aEDAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=1846056542

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 31 Mar 2024 21:20:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68694
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 89ms
88ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:32 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
age: 0
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9ef8bde0939ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET default-ebg-query-params
hotelequities.savings.workingadvantage.com/api/ 0
0

GET
H3

200

sign-in Show response
auth.savings.workingadvantage.com/hotelequities/
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=hotelequities&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantag...
https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fd...

10 KB
3 KB

133ms
133ms

Document
text/html

172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/main.c0717f9185012ccf.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8751c433f7afa98d7533d4f21fe81fb2dcf925f1bbd675a6e844b801a647de74

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://hotelequities.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86d9ef8d7bf3972c-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:33 GMT
last-modified: Thu, 28 Mar 2024 11:05:58 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 86d9ef8caae2972c-FRA
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:33 GMT
expires: Mon, 01 Apr 2024 16:25:31 GMT
location: /hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 671 KB
157 KB 17ms
10ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2f855a4a78e268b4de064c218ef8713df55fea72b531438953dd78fa4bd930a5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: gzip
last-modified: Mon, 25 Mar 2024 02:25:21 GMT
server: AkamaiNetStorage
etag: "54bb1d1f7dd020b0f66a449dfa441cf2:1711333521.419901"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 160357
expires: Mon, 01 Apr 2024 17:25:33 GMT

GET
H3 200 new-relic-integration.js Show response
auth.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 123ms
120ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:05:57 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054f15-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 86d9ef8e8d55972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
29 KB 44ms
41ms Stylesheet
text/css 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1644756
x-jsd-version: 5.2.3
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230122-FRA, cache-lga21962-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hXuRGjQEao3%2FlkreHz6WHkYL2vfm7O6ImXNH4bp5bOfgBoL%2FlLbHRqw12XTat2gQ%2BGQKulDObPbzn2LqPVKSGNb6bf5dtm4WQ5kTKMVYKod12ELACp2SFujSBZDY2QoD%2FzU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 86d9ef8e8cc63600-FRA

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 229 KB
75 KB 52ms
42ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

9230025c0e5babe6c4b7fc6ecd081d3956994db31276d93ea791bdfa9894d221

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76796
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 21ms
19ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1635814
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oUUC5%2F9v3qv6GLNda5Rp%2BLOp7t2WRAOwKKjScZ9sBBspWpUxrMpnHn%2BYVqQibBQ4Xd37ThSVmAEJCN9h0czRxDne4FdZzOfy4efGdG0QIuVKrnJatgna1f4fF009Aw8ygI4%2BDPkA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86d9ef8e8ebb1cbf-FRA
expires: Sat, 22 Mar 2025 16:25:33 GMT

GET
H3 200 runtime.13338c5d9c83d0b6.js Show response
auth.savings.workingadvantage.com/ 1 KB
1 KB 115ms
113ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/runtime.13338c5d9c83d0b6.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

779700103eaa215226d17491070dd24cc4e6ae6533a0f3a4071140805119b45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:05:52 GMT
server: cloudflare
content-encoding: br
etag: W/"66054f10-488"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9ef8e8d5c972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.19b1fd6561b196c7.js Show response
auth.savings.workingadvantage.com/ 122 KB
44 KB 131ms
128ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/polyfills.19b1fd6561b196c7.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72fdee575c7361fb1e3af2d4b89d044f7a91dc59668a75d661c394f7f6e111b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:05:52 GMT
server: cloudflare
content-encoding: br
etag: W/"66054f10-1e936"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9ef8e8d5f972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.7a1741d36aa82235.js Show response
auth.savings.workingadvantage.com/ 163 KB
56 KB 134ms
116ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/scripts.7a1741d36aa82235.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5135057d3089a6b70e2655bb8474152f126ba812de365a75f09263cac572412

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:05:52 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054f10-28d5e"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 86d9ef8fef82972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.a3c21383563587a0.js Show response
auth.savings.workingadvantage.com/ 2 MB
416 KB 122ms
120ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/main.a3c21383563587a0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61a1f474d21d18036f7a502d196600816b1bf53971c63b431940d31236dcdb11

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:05:52 GMT
server: cloudflare
content-encoding: br
etag: W/"66054f10-1a1a4a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9ef8e8d61972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 251 KB
84 KB 48ms
30ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

62b56782c9c5a375406b055ec44127b747d0880d8c1ffc5d794c7b38f45138a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86283
x-xss-protection: 0
last-modified: Mon, 01 Apr 2024 16:05:10 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 01 Apr 2024 16:25:33 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 36ms
6ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 01 Apr 2024 17:25:33 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 37ms
7ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 01 Apr 2024 17:25:33 GMT

GET
H3 200 styles.3c3b0dbcefac353a.css
auth.savings.workingadvantage.com/ 39 KB
8 KB 109ms
109ms Stylesheet
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/styles.3c3b0dbcefac353a.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

635fa3eea46f798b9cf571a332c73586c56a8138a00e93123b9e1e0e5262ef3c

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:05:52 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054f10-9c36"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 86d9ef904feb972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 9ms
7ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 30 Mar 2024 06:46:33 GMT
x-content-type-options: nosniff
age: 207540
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Mar 2025 06:46:33 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 19ms
18ms XHR
application/json 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 297 KB
100 KB 24ms
24ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f3cc0ebef402ec11732c95dd8266286d94b98662649e199cffbcff71a00a0d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 101878
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Apr 2024 16:25:33 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 8ms
7ms Script
text/javascript 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 01 Apr 2024 15:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2245
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 01 Apr 2024 17:48:08 GMT

GET
H3 200 system-wide
hotelequities.savings.beneplace.com/api/notifications/ 2 B
608 B 874ms
835ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.beneplace.com/api/notifications/system-wide

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef926db23a85-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:33 GMT

GET
H3 200 info
hotelequities.savings.beneplace.com/api/ 9 KB
3 KB 472ms
435ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"221b-TkuC+Gjqz2AU6MTXm+wZ97SIvKI"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef926db13a85-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:33 GMT

GET
H3 200 info Show response
hotelequities.savings.beneplace.com/api/ 9 KB
3 KB 210ms
173ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4314ad6e508ab275b05e2d83b3527dfa62fdf7b63b2fea8870fd80a0348dff4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"221b-TkuC+Gjqz2AU6MTXm+wZ97SIvKI"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef926db33a85-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:32 GMT

GET
H3 200 hotelequities
hotelequities.savings.beneplace.com/api/controls/ 997 B
1 KB 833ms
797ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.beneplace.com/api/controls/hotelequities

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef926db43a85-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:33 GMT

GET
H3 200 marketplace-styles.css Show response
hotelequities.savings.beneplace.com/api/hotelequities/ 26 KB
5 KB 290ms
255ms XHR
text/css 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.beneplace.com/api/hotelequities/marketplace-styles.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a9c612a43db8ce1ddd6c4390e88a171f25ec1fb2509277e3a2a4a89f83a03ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"6994-cu8SGYV1/ZHj6aoSEgLeO8eW1gE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef926dac3a85-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:33 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 14ms
14ms XHR
text/plain 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=889584715&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fhotelequities%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Fhotelequities.savings.workingadvantage.com%252Frelay%253Fdlk%253D2puk4qihza69iehtx6kpos1kj%2526corpRedirectUri%253Dhttps%25253A%25252F%25252Fstore.workingadvantage.com%25252Faccount.php%25253Fsub%25253Dfunlife_how-it-works%252526utm_source%25253Demail%252526utm_medium%25253DWelcome-Series-FunLife-Rewards-WAG3%252526utm_campaign%25253DFunlife-Rewards-hero-cta%2526subdomain%253DhotelequitiescorpRedirectUri%253D%255Bhttps%25253A%25252F%25252Fstore.workingadvantage.com%25252Faccount.php%25253Fsub%25253Dfunlife_how-it-works%252526utm_source%25253Demail%252526utm_medium%25253DWelcome-Series-FunLife-Rewards-WAG3%252526utm_campaign%25253DFunlife-Rewards-hero-cta%255Dcorp&dr=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&_slc=1&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=1279346439

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 278 KB
94 KB 24ms
24ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

911a0da68344c5601d44f3d7bf8769de5c0d0084a93896f1a5573692cf60c413

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96357
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Apr 2024 16:25:33 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 15ms
15ms Ping
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je43r0v9112553684z878847533za200&_p=1711988733208&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1510506513.1711988731&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.86%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.86&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1711988731&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fhotelequities%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Fhotelequities.savings.workingadvantage.com%252Frelay%253Fdlk%253D2puk4qihza69iehtx6kpos1kj%2526corpRedirectUri%253Dhttps%25253A%25252F%25252Fstore.workingadvantage.com%25252Faccount.php%25253Fsub%25253Dfunlife_how-it-works%252526utm_source%25253Demail%252526utm_medium%25253DWelcome-Series-FunLife-Rewards-WAG3%252526utm_campaign%25253DFunlife-Rewards-hero-cta%2526subdomain%253DhotelequitiescorpRedirectUri%253D%255Bhttps%25253A%25252F%25252Fstore.workingadvantage.com%25252Faccount.php%25253Fsub%25253Dfunlife_how-it-works%252526utm_source%25253Demail%252526utm_medium%25253DWelcome-Series-FunLife-Rewards-WAG3%252526utm_campaign%25253DFunlife-Rewards-hero-cta%255Dcorp&dr=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&tfd=991
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
25 KB 7ms
7ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 01 Apr 2024 16:25:33 GMT
strict-transport-security: max-age=300
x-amz-request-id: FVBEBWHYA3TXWDVZ
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: vq90Yd8kIp02IXj9Xt1ADcXpETqOzEX6pI9HpqtmbZfhzIgjdM5dx+uEblGwqLnF/exxLg97dfo=
x-served-by: cache-fra-eddf8230123-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 1187

GET
H3 200 favicon.ico
auth.savings.workingadvantage.com/ 10 KB
3 KB 118ms
118ms Other
text/html 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8751c433f7afa98d7533d4f21fe81fb2dcf925f1bbd675a6e844b801a647de74

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:05:58 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 86d9ef935bd0972c-FRA
alt-svc: h3=":443"; ma=86400

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/1/ 128 B
767 B 627ms
626ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1089&ck=0&s=a106ba41c2c4d183&ref=https://auth.savings.workingadvantage.com/hotelequities/sign-in&af=err,xhr,stn,ins,spa&be=266&fe=804&dc=626&perf=%7B%22timing%22:%7B%22of%22:1711988732896,%22n%22:0,%22r%22:4,%22re%22:132,%22f%22:132,%22dn%22:132,%22dne%22:132,%22c%22:132,%22s%22:132,%22ce%22:132,%22rq%22:133,%22rp%22:266,%22rpe%22:272,%22di%22:608,%22ds%22:888,%22de%22:891,%22dc%22:1067,%22l%22:1067,%22le%22:1069%7D,%22navigation%22:%7B%22rc%22:1%7D%7D
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 01 Apr 2024 16:25:34 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 3
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: Date
access-control-allow-credentials: true
CF-Ray: 86d9ef93681d9b4b-FRA
timing-allow-origin: https://auth.savings.workingadvantage.com

GET
H3 200 auth
hotelequities.savings.beneplace.com/api/navigation/hotelequities/auth_footer/US/ 959 B
997 B 160ms
158ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.beneplace.com/api/navigation/hotelequities/auth_footer/US/auth

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3bf-GIZgHybzmfj3d8rGD0L3UFFjORw"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef95294f3a85-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:33 GMT

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 24 B
455 B 234ms
233ms XHR
image/gif 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1735&ck=0&s=a106ba41c2c4d183&ref=https://auth.savings.workingadvantage.com/hotelequities/sign-in
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 01 Apr 2024 16:25:34 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
Connection: keep-alive
CF-Ray: 86d9ef977d0f9b4b-FRA
Content-Length: 24

GET
H3 200 onetrust
hotelequities.savings.beneplace.com/api/platform/options/ 505 B
935 B 131ms
131ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.beneplace.com/api/platform/options/onetrust

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f9-Kr7PpbVfhwU6XhszSqAL/52koPg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef97bc933a85-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:33 GMT

POST
H3 200 known
auth.savings.workingadvantage.com/auth/ 550 B
1 KB 186ms
184ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/auth/known?subdomain=hotelequities

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-558e1c1853314349----1711988734713
traceparent: 00-f45a5b51d561bb0871ac148e39158300-558e1c1853314349-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjU1OGUxYzE4NTMzMTQzNDkiLCJ0ciI6ImY0NWE1YjUxZDU2MWJiMDg3MWFjMTQ4ZTM5MTU4MzAwIiwidGkiOjE3MTE5ODg3MzQ3MTMsInRrIjoiODg4MzEifX0=
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/hotelequities/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https:%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"226-DvxNSnMl6JQO3QXpdORuYS3QH5M"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef97f9d2972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:33 GMT

GET
H3 200 info
hotelequities.savings.beneplace.com/api/ 9 KB
3 KB 202ms
200ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"221b-TkuC+Gjqz2AU6MTXm+wZ97SIvKI"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef980ce23a85-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:33 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=889584715&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fhotelequities%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%3A%252F%252Fhotelequities.savings.workingadvantage.com%252Frelay%253Fdlk%253D2puk4qihza69iehtx6kpos1kj%2526corpRedirectUri%253Dhttps%25253A%25252F%25252Fstore.workingadvantage.com%25252Faccount.php%25253Fsub%25253Dfunlife_how-it-works%252526utm_source%25253Demail%252526utm_medium%25253DWelcome-Series-FunLife-Rewards-WAG3%252526utm_campaign%25253DFunlife-Rewards-hero-cta%2526subdomain%253DhotelequitiescorpRedirectUri%253D%255Bhttps%25253A%25252F%25252Fstore.workingadvantage.com%25252Faccount.php%25253Fsub%25253Dfunlife_how-it-works%252526utm_source%25253Demail%252526utm_medium%25253DWelcome-Series-FunLife-Rewards-WAG3%252526utm_campaign%25253DFunlife-Rewards-hero-cta%255Dcorp&dr=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Hotel%20Equities%20Savings%20Marketplace&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=2004403531

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 31 Mar 2024 21:20:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68696
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 24ms
23ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
age: 2
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9ef980d5939ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 24ms
23ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
age: 2
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9ef985db639ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET
H2 200 otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 43ms
25ms Script
application/javascript 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Apr 2024 16:25:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Pg1MHDpg+UGdovxhidM4Kg==
age: 3143
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6839
x-ms-lease-status: unlocked
last-modified: Thu, 28 Mar 2024 19:49:45 GMT
server: cloudflare
etag: 0x8DC4F60381E70DD
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 931b46e0-301e-008d-05f3-810e51000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 86d9ef98ba1b8f3c-FRA

GET
H2 200 9cb309ca-4688-401d-8c24-f640db524ba7.json
cdn.cookielaw.org/consent/9cb309ca-4688-401d-8c24-f640db524ba7/ 5 KB
2 KB 60ms
42ms XHR
application/x-javascript 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/9cb309ca-4688-401d-8c24-f640db524ba7/9cb309ca-4688-401d-8c24-f640db524ba7.json

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Apr 2024 16:25:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 19689
content-md5: 9JDz6sLcyFtV6gLnahCAhQ==
content-length: 1759
x-ms-lease-status: unlocked
last-modified: Tue, 26 Mar 2024 12:14:20 GMT
server: cloudflare
etag: 0x8DC4D8E44052F23
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 36a95744-401e-00a8-2a77-7fa72d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 86d9ef990c181e4c-FRA
expires: Tue, 02 Apr 2024 16:25:34 GMT

GET
H3 200 relay Show response
hotelequities.savings.workingadvantage.com/ 9 KB
3 KB 135ms
134ms Document
text/html 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/main.a3c21383563587a0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10c88766a47b9634a273135dfd7ab6abf02897e94262b2282b42ef7c0554cf63

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86d9ef993b60972c-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:35 GMT
last-modified: Thu, 28 Mar 2024 11:03:09 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2 200 location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
315 B 49ms
24ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept: application/json
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 86d9ef996ebe9740-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202403.1.0/ 442 KB
107 KB 48ms
48ms Script
application/javascript 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: s7qm2vbmUNglr6Jt5k9KHA==
age: 80713
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 109676
x-ms-lease-status: unlocked
last-modified: Thu, 21 Mar 2024 07:04:35 GMT
server: cloudflare
etag: 0x8DC49752A75EB01
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f463857b-001e-005d-3a08-7c3307000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 86d9ef999b478f3c-FRA

GET en.json
cdn.cookielaw.org/consent/9cb309ca-4688-401d-8c24-f640db524ba7/018e7240-e394-7508-bd58-7ca1ecf69c8a/ 0
0

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 671 KB
157 KB 13ms
6ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2f855a4a78e268b4de064c218ef8713df55fea72b531438953dd78fa4bd930a5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: gzip
last-modified: Mon, 25 Mar 2024 02:25:21 GMT
server: AkamaiNetStorage
etag: "54bb1d1f7dd020b0f66a449dfa441cf2:1711333521.419901"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 160357
expires: Mon, 01 Apr 2024 17:25:35 GMT

GET
H3 200 new-relic-integration.js Show response
hotelequities.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 124ms
122ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:03:08 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054e6c-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 86d9ef9a3cb0972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
29 KB 26ms
23ms Stylesheet
text/css 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1644758
x-jsd-version: 5.2.3
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230122-FRA, cache-lga21962-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=up7hqRfxBqMe9nwgW%2FH4xLmazpTGTvSe5BN27T400ciFuCvroBOatgXn5XyPLPfXpaRyFDP8n3MJFLfkBTsL1OxYXCBGpx70rLm4qTLYzs79um4%2B1b28khb8SWdRDHoE6H0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 86d9ef9a3adf3600-FRA

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 229 KB
75 KB 43ms
42ms Script
text/javascript 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

9230025c0e5babe6c4b7fc6ecd081d3956994db31276d93ea791bdfa9894d221

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76796
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 20ms
17ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1635816
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FljCfXTb2%2B1A50%2FtdzBNVjqMA%2BXt%2FPosbl%2BOCUW%2FJwXmYu0aX%2BFi5I67suyxcHDd0IKUhtdtIAjrlnHZOV8CNCUPPl0MQNu7OQPhRewWMH3DEVS9tBCBWu3ZAiSVWk7Sh8Z4Cbzh"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86d9ef9a3d6b1cbf-FRA
expires: Sat, 22 Mar 2025 16:25:35 GMT

GET
H3 200 runtime.1411455c7cfc7898.js Show response
hotelequities.savings.workingadvantage.com/ 4 KB
2 KB 140ms
137ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/runtime.1411455c7cfc7898.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a80e5c43f618ad56ecc518c996f74c7a5db2ca4aabbb9d07223daef1d930bad

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-e7e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9ef9a3cb1972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.b3ca5e0491f9957c.js Show response
hotelequities.savings.workingadvantage.com/ 142 KB
49 KB 123ms
120ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/polyfills.b3ca5e0491f9957c.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f38141aa44e94f18b8a6169d2dace200f71c72f822456b2c8fa2d7d80c5fbaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-2386c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9ef9a3cb4972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.7a1741d36aa82235.js Show response
hotelequities.savings.workingadvantage.com/ 163 KB
56 KB 126ms
125ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/scripts.7a1741d36aa82235.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5135057d3089a6b70e2655bb8474152f126ba812de365a75f09263cac572412

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054e62-28d5e"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 86d9ef9b1dcf972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.c0717f9185012ccf.js Show response
hotelequities.savings.workingadvantage.com/ 5 MB
1020 KB 163ms
161ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/main.c0717f9185012ccf.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62153c528b69cd86f50f2327c0c396f14d13ddd896e683db34076d9d015cff53

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-4cff4e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9ef9a3cb6972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 251 KB
84 KB 38ms
36ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b6296115ef2784b73315f85dfbdf901a25617c918bc7f875959d65ea00eac7a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86409
x-xss-protection: 0
last-modified: Mon, 01 Apr 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 01 Apr 2024 16:25:35 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 11ms
9ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 01 Apr 2024 17:25:35 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 11ms
10ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 01 Apr 2024 17:25:35 GMT

GET
H3 200 styles.2f9eec52fac66f86.css
hotelequities.savings.workingadvantage.com/ 96 KB
17 KB 130ms
129ms Stylesheet
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/styles.2f9eec52fac66f86.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9cb704eda10ca4f51c3277f182cf25f68ead8e02dc52e17136287e728caeca7

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054e62-17f61"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 86d9ef9b1dd2972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 12ms
12ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 30 Mar 2024 06:46:33 GMT
x-content-type-options: nosniff
age: 207542
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Mar 2025 06:46:33 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 27ms
27ms XHR
application/json 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 297 KB
100 KB 28ms
28ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

60e54d3ca5e5c26f90fbc76ba1c863bd47d10be83285e4d4badb7ac7c04e7d38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 101851
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Apr 2024 16:25:35 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 7ms
7ms Script
text/javascript 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 01 Apr 2024 15:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2247
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 01 Apr 2024 17:48:08 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 14ms
14ms XHR
text/plain 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1522987686&t=pageview&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp%26known_email%3DROBIN%254033DEGREES.CO%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D2puk4qihza69iehtx6kpos1kj%26known_email_contact%3DROBIN%254033DEGREES.CO&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&_slc=1&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=1410262781

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 278 KB
94 KB 31ms
30ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bc4303570aa52cfd50983df3a884e59abcc04b5c59b889555961be401389b384

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96357
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Apr 2024 16:25:35 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 19ms
19ms Ping
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je43r0v9112553684z878847533za200&_p=1711988735076&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1510506513.1711988731&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.86%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.86&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1711988731&sct=1&seg=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%3D%5Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp%26known_email%3DROBIN%254033DEGREES.CO%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D2puk4qihza69iehtx6kpos1kj%26known_email_contact%3DROBIN%254033DEGREES.CO&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&tfd=558
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:35 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
hotelequities.savings.workingadvantage.com/api/ 7 KB
2 KB 1619ms
1618ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/info

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5135e9aa12b8c268a983c90564c8f04d5c728ecdd72be2c8cc6616135e00b6b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-1dbf1fbb7b10ff75----1711988735697
traceparent: 00-c7d7f6e7f357e1b1ef948adeface0700-1dbf1fbb7b10ff75-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjFkYmYxZmJiN2IxMGZmNzUiLCJ0ciI6ImM3ZDdmNmU3ZjM1N2UxYjFlZjk0OGFkZWZhY2UwNzAwIiwidGkiOjE3MTE5ODg3MzU2OTcsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:37 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1c36-Id1VpO9Duiq7sfvVCntSUGhL4uY"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef9e29dd972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:36 GMT

GET
H3 200 marketplace-styles.css Show response
hotelequities.savings.workingadvantage.com/api/hotelequities/ 26 KB
5 KB 321ms
321ms XHR
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/hotelequities/marketplace-styles.css

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a9c612a43db8ce1ddd6c4390e88a171f25ec1fb2509277e3a2a4a89f83a03ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-81580ab1417237c4----1711988735698
traceparent: 00-0bf5a7424a37657181a17ef1b6102600-81580ab1417237c4-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjgxNTgwYWIxNDE3MjM3YzQiLCJ0ciI6IjBiZjVhNzQyNGEzNzY1NzE4MWExN2VmMWI2MTAyNjAwIiwidGkiOjE3MTE5ODg3MzU2OTgsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:36 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"6994-cu8SGYV1/ZHj6aoSEgLeO8eW1gE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef9e29e0972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:34 GMT

GET
H3 200 colors.css Show response
hotelequities.savings.workingadvantage.com/api/hotelequities/ 3 KB
845 B 194ms
193ms XHR
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/hotelequities/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ffc500f08853c8edb93a47f974b48dd180ff898f8f75829434b383e6802ddbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-8e6c99934e2d1f21----1711988735699
traceparent: 00-77e8560459648e4aae704caa49455a00-8e6c99934e2d1f21-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjhlNmM5OTkzNGUyZDFmMjEiLCJ0ciI6Ijc3ZTg1NjA0NTk2NDhlNGFhZTcwNGNhYTQ5NDU1YTAwIiwidGkiOjE3MTE5ODg3MzU2OTksInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"ae6-ySrgfhpGMk2tmkej9cvI4pwFJ9Y"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9ef9e29e3972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:34 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
25 KB 7ms
6ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=300
x-amz-request-id: FVBEBWHYA3TXWDVZ
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: vq90Yd8kIp02IXj9Xt1ADcXpETqOzEX6pI9HpqtmbZfhzIgjdM5dx+uEblGwqLnF/exxLg97dfo=
x-served-by: cache-fra-eddf8230123-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 1188

GET
H3 200 favicon.ico
hotelequities.savings.workingadvantage.com/ 9 KB
3 KB 113ms
112ms Other
text/html 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10c88766a47b9634a273135dfd7ab6abf02897e94262b2282b42ef7c0554cf63

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:35 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:03:09 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 86d9ef9e39f0972c-FRA
alt-svc: h3=":443"; ma=86400

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 128 B
790 B 126ms
126ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=817&ck=0&s=9a0e3abe5592732a&ref=https://hotelequities.savings.workingadvantage.com/relay&af=err,xhr,stn,ins,spa&be=139&fe=662&dc=660&perf=%7B%22timing%22:%7B%22of%22:1711988734903,%22n%22:0,%22f%22:3,%22dn%22:3,%22dne%22:3,%22c%22:3,%22s%22:3,%22ce%22:3,%22rq%22:5,%22rp%22:139,%22rpe%22:140,%22di%22:359,%22ds%22:797,%22de%22:799,%22dc%22:800,%22l%22:800,%22le%22:801%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd428c1650b018507a3316fadbefed93cdfa3758a1689e6bc13e109ea90a6287

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 01 Apr 2024 16:25:35 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 1
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://hotelequities.savings.workingadvantage.com
access-control-expose-headers: Date
access-control-allow-credentials: true
CF-Ray: 86d9ef9e4cb6974d-FRA
timing-allow-origin: https://hotelequities.savings.workingadvantage.com

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
464 B 122ms
116ms XHR
image/gif 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=957&ck=0&s=9a0e3abe5592732a&ref=https://hotelequities.savings.workingadvantage.com/relay
Requested by: Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 01 Apr 2024 16:25:35 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
Connection: keep-alive
CF-Ray: 86d9ef9f3db6974d-FRA
Content-Length: 24

GET
H3 200 hotelequities Show response
hotelequities.savings.workingadvantage.com/api/controls/ 997 B
912 B 448ms
446ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/controls/hotelequities

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-d992232c3eb2f611----1711988737331
traceparent: 00-59236b405fefcc576e6184ae9d838900-d992232c3eb2f611-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImQ5OTIyMzJjM2ViMmY2MTEiLCJ0ciI6IjU5MjM2YjQwNWZlZmNjNTc2ZTYxODRhZTlkODM4OTAwIiwidGkiOjE3MTE5ODg3MzczMzEsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:37 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efa85e70972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:36 GMT

GET
H3 200 872.887569a6810827dc.js Show response
hotelequities.savings.workingadvantage.com/ 4 KB
2 KB 124ms
123ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/872.887569a6810827dc.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72103ba970756916708c34a2ba28517184d8df91282309feb265f7b81b669197

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri=[https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta]corp&known_email=ROBIN%4033DEGREES.CO&known_user_type=known_set_confirmed&known_user=true&known_user_guid=2puk4qihza69iehtx6kpos1kj&known_email_contact=ROBIN%4033DEGREES.CO
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:37 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-119e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efab3a53972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 23ms
22ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d359b70036b7b74e8425af331666979245eb3c0b04b9601e43fc55841610cb93

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:37 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
age: 5
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9efab3d7d39ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET
H3

200

silent-refresh.html Show response
hotelequities.savings.workingadvantage.com/ Frame 663C
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=hotelequities&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantag...
https://hotelequities.savings.workingadvantage.com/silent-refresh.html

166 B
674 B

145ms
143ms

Document
text/html

172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/silent-refresh.html

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ae7551c1dad076a1247530f47a56c155b4d14d2203996366aae22b5b8e4f4b3

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://hotelequities.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86d9efac3bf5972c-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:38 GMT
last-modified: Thu, 28 Mar 2024 11:03:07 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 86d9efab5a83972c-FRA
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:37 GMT
expires: Mon, 01 Apr 2024 16:25:36 GMT
location: https://hotelequities.savings.workingadvantage.com/silent-refresh.html#grant_type=authorization_code&code=0ur8BmptHZMQuIeqgJkvPT&subdomain=hotelequities&client_id=9ezalirn45mF43imJTdf53&user_guid=2puk4qihza69iehtx6kpos1kj&token_refreshed=true
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H3 401 ebg-query-params
hotelequities.savings.workingadvantage.com/api/ 182 B
520 B 514ms
513ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/ebg-query-params

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-22b142334595a965----1711988737979
traceparent: 00-aa9f9cac527ee65bc2bd596db7c8e200-22b142334595a965-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjIyYjE0MjMzNDU5NWE5NjUiLCJ0ciI6ImFhOWY5Y2FjNTI3ZWU2NWJjMmJkNTk2ZGI3YzhlMjAwIiwidGkiOjE3MTE5ODg3Mzc5NzksInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by
etag: W/"b6-lGFIUF59ZyAYAhOl/ILN9N2OvBU"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cf-ray: 86d9efac6c53972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
content-length: 182
alt-svc: h3=":443"; ma=86400

GET
H3 200 info
hotelequities.savings.workingadvantage.com/api/ 9 KB
3 KB 403ms
402ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/info?authInfo=true

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-519a1f1ef0e063ba----1711988737982
traceparent: 00-9897636643564e7d26a16fd1858bbd00-519a1f1ef0e063ba-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjUxOWExZjFlZjBlMDYzYmEiLCJ0ciI6Ijk4OTc2MzY2NDM1NjRlN2QyNmExNmZkMTg1OGJiZDAwIiwidGkiOjE3MTE5ODg3Mzc5ODIsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"221b-TkuC+Gjqz2AU6MTXm+wZ97SIvKI"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efac6c56972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:37 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 27ms
26ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1522987686&t=pageview&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%3A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%253D%255Bhttps%3A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255Dcorp&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Hotel%20Equities%20Savings%20Marketplace&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=1539245974

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 31 Mar 2024 21:20:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68700
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 25ms
24ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1522987686&t=pageview&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2F&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Hotel%20Equities%20Savings%20Marketplace&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=790660085

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 31 Mar 2024 21:20:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68700
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 23ms
23ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d359b70036b7b74e8425af331666979245eb3c0b04b9601e43fc55841610cb93

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
age: 6
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9efacbf6939ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 33ms
21ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d359b70036b7b74e8425af331666979245eb3c0b04b9601e43fc55841610cb93

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
age: 6
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9efacdfa339ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET
H3 200 token
hotelequities.savings.workingadvantage.com/auth/ 778 B
1 KB 199ms
198ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/auth/token?grant_type=authorization_code&client_id=9ezalirn45mF43imJTdf53&code=0ur8BmptHZMQuIeqgJkvPT&user_guid=2puk4qihza69iehtx6kpos1kj

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-bbb265de67a0fb7e----1711988738109
traceparent: 00-300d9cfb7223204eea78a275df6d0500-bbb265de67a0fb7e-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImJiYjI2NWRlNjdhMGZiN2UiLCJ0ciI6IjMwMGQ5Y2ZiNzIyMzIwNGVlYTc4YTI3NWRmNmQwNTAwIiwidGkiOjE3MTE5ODg3MzgxMDksInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"30a-Mnxqt7i5BPRDup1+q0My4//N21I"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efad3d7c972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:37 GMT

GET
H3

200

Primary Request relay Show response
hotelequities.savings.workingadvantage.com/
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=hotelequities&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantag...
https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_sour...

9 KB
3 KB

120ms
120ms

Document
text/html

172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/main.c0717f9185012ccf.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10c88766a47b9634a273135dfd7ab6abf02897e94262b2282b42ef7c0554cf63

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://hotelequities.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86d9efafe922972c-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:38 GMT
last-modified: Thu, 28 Mar 2024 11:03:09 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 86d9efaefff2972c-FRA
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:38 GMT
expires: Mon, 01 Apr 2024 16:25:37 GMT
location: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp#grant_type=authorization_code&code=6gHIKzVbB2PVklETLOjiCZ&subdomain=hotelequities&client_id=9ezalirn45mF43imJTdf53&user_guid=2puk4qihza69iehtx6kpos1kj&token_refreshed=true
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET info
hotelequities.savings.workingadvantage.com/api/ 0
0

GET
H3 200 default-ebg-query-params
hotelequities.savings.workingadvantage.com/api/ 47 B
459 B 138ms
137ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/default-ebg-query-params

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-29e6986cdf4d4235----1711988738500
traceparent: 00-6bc7afb0c6d76d31a583a67523ef2700-29e6986cdf4d4235-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjI5ZTY5ODZjZGY0ZDQyMzUiLCJ0ciI6IjZiYzdhZmIwYzZkNzZkMzFhNTgzYTY3NTIzZWYyNzAwIiwidGkiOjE3MTE5ODg3Mzg1MDAsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 47
server: cloudflare
etag: W/"2f-qGnGwDYSwWhoRwu9MgYP0wYzOC0"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efafa8df972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:37 GMT

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 671 KB
157 KB 10ms
7ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2f855a4a78e268b4de064c218ef8713df55fea72b531438953dd78fa4bd930a5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
content-encoding: gzip
last-modified: Mon, 25 Mar 2024 02:25:21 GMT
server: AkamaiNetStorage
etag: "54bb1d1f7dd020b0f66a449dfa441cf2:1711333521.419901"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 160357
expires: Mon, 01 Apr 2024 17:25:38 GMT

GET
H3 200 new-relic-integration.js Show response
hotelequities.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 121ms
119ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:03:08 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054e6c-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 86d9efb0ca6d972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
29 KB 30ms
28ms Stylesheet
text/css 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1644761
x-jsd-version: 5.2.3
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230122-FRA, cache-lga21962-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HTlJ8JEoWE%2FEsc17net5%2FnSVBY0KParCdBVRv%2B4lt1Xg%2B%2Bd7YRK9jsOq97nExO2Tm%2BlCWYxD8nF4ReGa2040wEmMiR%2BpnuO9aWteX0ao%2BiJu4bQxqvmV1xjd0x2qbhVFvHo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 86d9efb0c82b3600-FRA

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 229 KB
75 KB 41ms
39ms Script
text/javascript 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

9230025c0e5babe6c4b7fc6ecd081d3956994db31276d93ea791bdfa9894d221

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76796
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 28ms
27ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1635819
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FNOjla9%2B5bBDdsVJS5ph7F857aZNCagLuQCmfbbdewgMIQIaT7eVsFYswGR2BLqFiDFQTzJ8rLA20t8v6He0Vec7hnZLH4kMpnuur4MPQsSWe05fGHc2Ghf%2B%2Fmotp1y87YlylxZJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86d9efb0ca831cbf-FRA
expires: Sat, 22 Mar 2025 16:25:38 GMT

GET
H3 200 runtime.1411455c7cfc7898.js Show response
hotelequities.savings.workingadvantage.com/ 4 KB
2 KB 143ms
141ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/runtime.1411455c7cfc7898.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a80e5c43f618ad56ecc518c996f74c7a5db2ca4aabbb9d07223daef1d930bad

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-e7e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efb0ca6f972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.b3ca5e0491f9957c.js Show response
hotelequities.savings.workingadvantage.com/ 142 KB
49 KB 143ms
142ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/polyfills.b3ca5e0491f9957c.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f38141aa44e94f18b8a6169d2dace200f71c72f822456b2c8fa2d7d80c5fbaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-2386c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efb0ca71972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.7a1741d36aa82235.js Show response
hotelequities.savings.workingadvantage.com/ 163 KB
56 KB 156ms
152ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/scripts.7a1741d36aa82235.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5135057d3089a6b70e2655bb8474152f126ba812de365a75f09263cac572412

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054e62-28d5e"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 86d9efb1cc40972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.c0717f9185012ccf.js Show response
hotelequities.savings.workingadvantage.com/ 5 MB
1020 KB 151ms
150ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/main.c0717f9185012ccf.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62153c528b69cd86f50f2327c0c396f14d13ddd896e683db34076d9d015cff53

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-4cff4e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efb0ca73972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 251 KB
84 KB 43ms
39ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fa08f690f6e8596e2ea15f47772bed17c193fc2bbb9a8cad41ea6f8b034194b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86278
x-xss-protection: 0
last-modified: Mon, 01 Apr 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 01 Apr 2024 16:25:38 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 17ms
7ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 01 Apr 2024 17:25:38 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 16ms
7ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 01 Apr 2024 17:25:38 GMT

GET
H3 200 styles.2f9eec52fac66f86.css
hotelequities.savings.workingadvantage.com/ 96 KB
17 KB 118ms
115ms Stylesheet
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/styles.2f9eec52fac66f86.css

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9cb704eda10ca4f51c3277f182cf25f68ead8e02dc52e17136287e728caeca7

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"66054e62-17f61"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 86d9efb1cc42972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 14ms
10ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 30 Mar 2024 06:46:33 GMT
x-content-type-options: nosniff
age: 207545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Mar 2025 06:46:33 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 22ms
21ms XHR
application/json 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 297 KB
100 KB 25ms
25ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e1bd08c61c656596bc4c0f407a6f2e8d399eb2617e84e81fd3fb19e0fdb82c1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:38 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 101916
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Apr 2024 16:25:38 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 8ms
8ms Script
text/javascript 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 01 Apr 2024 15:48:08 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2250
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 01 Apr 2024 17:48:08 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 16ms
16ms XHR
text/plain 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1794941530&t=pageview&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%253D%255Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255DcorpcorpRedirectUri%253D%255Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255Dcorp&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&_slc=1&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=1573738106

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 278 KB
94 KB 54ms
53ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

911a0da68344c5601d44f3d7bf8769de5c0d0084a93896f1a5573692cf60c413

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:39 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96357
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 01 Apr 2024 16:25:39 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 17ms
17ms Ping
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je43r0v9112553684z878847533za200&_p=1711988738684&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=1510506513.1711988731&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.86%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.86&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1711988731&sct=1&seg=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%253D%255Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255DcorpcorpRedirectUri%253D%255Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255Dcorp&dr=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&tfd=748
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 01 Apr 2024 16:25:39 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
hotelequities.savings.workingadvantage.com/api/ 7 KB
2 KB 183ms
182ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/info

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5135e9aa12b8c268a983c90564c8f04d5c728ecdd72be2c8cc6616135e00b6b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-9ab5ad0df66be1c6----1711988739451
traceparent: 00-8ff42c8a0a913b072aa4f80a18a6c100-9ab5ad0df66be1c6-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjlhYjVhZDBkZjY2YmUxYzYiLCJ0ciI6IjhmZjQyYzhhMGE5MTNiMDcyYWE0ZjgwYTE4YTZjMTAwIiwidGkiOjE3MTE5ODg3Mzk0NTEsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:39 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1c36-Id1VpO9Duiq7sfvVCntSUGhL4uY"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efb5990f972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:38 GMT

GET
H3 200 marketplace-styles.css Show response
hotelequities.savings.workingadvantage.com/api/hotelequities/ 26 KB
5 KB 375ms
374ms XHR
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/hotelequities/marketplace-styles.css

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a9c612a43db8ce1ddd6c4390e88a171f25ec1fb2509277e3a2a4a89f83a03ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-f93f05fb2303502d----1711988739452
traceparent: 00-bc5c530a2c138c2ee5b43e2a69774500-f93f05fb2303502d-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImY5M2YwNWZiMjMwMzUwMmQiLCJ0ciI6ImJjNWM1MzBhMmMxMzhjMmVlNWI0M2UyYTY5Nzc0NTAwIiwidGkiOjE3MTE5ODg3Mzk0NTIsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:39 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"6994-cu8SGYV1/ZHj6aoSEgLeO8eW1gE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efb59911972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:38 GMT

GET
H3 200 colors.css Show response
hotelequities.savings.workingadvantage.com/api/hotelequities/ 3 KB
845 B 132ms
132ms XHR
text/css 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/hotelequities/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ffc500f08853c8edb93a47f974b48dd180ff898f8f75829434b383e6802ddbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-e6a8736e7a06803c----1711988739452
traceparent: 00-f6a67ff98876f850c58978f86b766b00-e6a8736e7a06803c-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImU2YTg3MzZlN2EwNjgwM2MiLCJ0ciI6ImY2YTY3ZmY5ODg3NmY4NTBjNTg5NzhmODZiNzY2YjAwIiwidGkiOjE3MTE5ODg3Mzk0NTIsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:39 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"ae6-ySrgfhpGMk2tmkej9cvI4pwFJ9Y"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efb59913972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:38 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
25 KB 7ms
7ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 01 Apr 2024 16:25:39 GMT
strict-transport-security: max-age=300
x-amz-request-id: FVBEBWHYA3TXWDVZ
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: vq90Yd8kIp02IXj9Xt1ADcXpETqOzEX6pI9HpqtmbZfhzIgjdM5dx+uEblGwqLnF/exxLg97dfo=
x-served-by: cache-fra-eddf8230123-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 1189

GET
H3 200 favicon.ico
hotelequities.savings.workingadvantage.com/ 9 KB
3 KB 119ms
118ms Other
text/html 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10c88766a47b9634a273135dfd7ab6abf02897e94262b2282b42ef7c0554cf63

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:39 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:03:09 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 86d9efb5b936972c-FRA
alt-svc: h3=":443"; ma=86400

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 128 B
785 B 139ms
138ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1093&ck=0&s=9a0e3abe5592732a&ref=https://hotelequities.savings.workingadvantage.com/relay&af=err,xhr,stn,ins,spa&be=269&fe=808&dc=799&perf=%7B%22timing%22:%7B%22of%22:1711988738389,%22n%22:0,%22f%22:147,%22dn%22:147,%22dne%22:147,%22c%22:147,%22s%22:147,%22ce%22:147,%22rq%22:149,%22rp%22:269,%22rpe%22:270,%22di%22:450,%22ds%22:1065,%22de%22:1068,%22dc%22:1074,%22l%22:1075,%22le%22:1076%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd428c1650b018507a3316fadbefed93cdfa3758a1689e6bc13e109ea90a6287

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 01 Apr 2024 16:25:39 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 2
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://hotelequities.savings.workingadvantage.com
access-control-expose-headers: Date
access-control-allow-credentials: true
CF-Ray: 86d9efb5db304dcc-FRA
timing-allow-origin: https://hotelequities.savings.workingadvantage.com

GET
H3 200 hotelequities Show response
hotelequities.savings.workingadvantage.com/api/controls/ 997 B
912 B 149ms
148ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/controls/hotelequities

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-859bfcaa88e3add9----1711988739644
traceparent: 00-75b9dfded2d6bfabfac87dc1ddbe9d00-859bfcaa88e3add9-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6Ijg1OWJmY2FhODhlM2FkZDkiLCJ0ciI6Ijc1YjlkZmRlZDJkNmJmYWJmYWM4N2RjMWRkYmU5ZDAwIiwidGkiOjE3MTE5ODg3Mzk2NDQsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:39 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efb6cad5972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:38 GMT

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
464 B 119ms
118ms XHR
image/gif 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1260&ck=0&s=9a0e3abe5592732a&ref=https://hotelequities.savings.workingadvantage.com/relay
Requested by: Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Mon, 01 Apr 2024 16:25:39 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
Connection: keep-alive
CF-Ray: 86d9efb6dc684dcc-FRA
Content-Length: 24

GET
H3 200 872.887569a6810827dc.js Show response
hotelequities.savings.workingadvantage.com/ 4 KB
2 KB 408ms
407ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/872.887569a6810827dc.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72103ba970756916708c34a2ba28517184d8df91282309feb265f7b81b669197

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-119e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efb80c4b972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 22ms
22ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d359b70036b7b74e8425af331666979245eb3c0b04b9601e43fc55841610cb93

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:39 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
age: 7
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9efb80a4739ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET
H3

200

silent-refresh.html Show response
hotelequities.savings.workingadvantage.com/ Frame 6E8D
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=hotelequities&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fhotelequities.savings.workingadvantag...
https://hotelequities.savings.workingadvantage.com/silent-refresh.html

166 B
674 B

141ms
140ms

Document
text/html

172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/silent-refresh.html

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ae7551c1dad076a1247530f47a56c155b4d14d2203996366aae22b5b8e4f4b3

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://hotelequities.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 86d9efba5fbd972c-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:40 GMT
last-modified: Thu, 28 Mar 2024 11:03:07 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 86d9efb81c5a972c-FRA
content-type: text/html; charset=utf-8
date: Mon, 01 Apr 2024 16:25:40 GMT
expires: Mon, 01 Apr 2024 16:25:39 GMT
location: https://hotelequities.savings.workingadvantage.com/silent-refresh.html#grant_type=authorization_code&code=5BuNMXO6nWabto137aSshI&subdomain=hotelequities&client_id=9ezalirn45mF43imJTdf53&user_guid=2puk4qihza69iehtx6kpos1kj&token_refreshed=true
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H3 200 token Show response
hotelequities.savings.workingadvantage.com/auth/ 778 B
1 KB 177ms
177ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/auth/token?grant_type=authorization_code&client_id=9ezalirn45mF43imJTdf53&code=6gHIKzVbB2PVklETLOjiCZ&user_guid=2puk4qihza69iehtx6kpos1kj

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56f7a0478a947dd0a2ed7d9133f1fe92bed7cd0f32c2bf78e595df1359789552

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
tracestate: 88831@nr=0-1-2647367-1120218725-8525fb37abecbd5a----1711988739967
traceparent: 00-2214a7bdc4d811f8d778afe58677d200-8525fb37abecbd5a-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6Ijg1MjVmYjM3YWJlY2JkNWEiLCJ0ciI6IjIyMTRhN2JkYzRkODExZjhkNzc4YWZlNTg2NzdkMjAwIiwidGkiOjE3MTE5ODg3Mzk5NjcsInRrIjoiODg4MzEifX0=
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"30a-yaeGQemsacqJPfTuSbx0HiTFvBU"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efb8dd5e972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:39 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
7ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1794941530&t=pageview&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%253D%255Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255DcorpcorpRedirectUri%253D%255Bhttps%253A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255Dcorp&ul=en-us&de=UTF-8&dt=Hotel%20Equities%20Savings%20Marketplace&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=467809814

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 31 Mar 2024 21:20:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68702
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hotelequities_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
2 KB 20ms
18ms Other
image/png 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/hotelequities_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d359b70036b7b74e8425af331666979245eb3c0b04b9601e43fc55841610cb93

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 09 Nov 2021 13:53:44 GMT
server: cloudflare
age: 8
etag: "618a7d68-604"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 86d9efba4d4e39ce-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1540

GET
H3 200 ebg-query-params Show response
hotelequities.savings.workingadvantage.com/api/ 400 B
746 B 407ms
406ms XHR
application/json 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/api/ebg-query-params

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6758d98e4b4b392108bbe906488df4623a0e1213b3aab7b04598c1ec23197c5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiZW82Y2t4aGY1Nm43OGw2bTE3NzBicGM0ZiIsImlhdCI6MTcxMTk4ODc0MCwiZXhwIjoxNzExOTkyMzQwfQ.lPp05RSP2PYMrCWHt_z6TsX7Ex3WJ10kwLesyAm3CNA
tracestate: 88831@nr=0-1-2647367-1120218725-8e32562a711e3ad3----1711988740251
traceparent: 00-87c811544fd3fd6facbafef0f926a800-8e32562a711e3ad3-01
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjYxOGMxNDE1MGFlMWIyYTE3OTY0ZmRlMSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjJwdWs0cWloemE2OWllaHR4Nmtwb3Mxa2oiLCJpYXQiOjE3MTE5ODg3MzgsImV4cCI6MTcxMTk5MjMzOH0.bLJwwvs34-PyBIfP5dtLfD6ioverEkvL-fpCW5v_Agw
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjhlMzI1NjJhNzExZTNhZDMiLCJ0ciI6Ijg3YzgxMTU0NGZkM2ZkNmZhY2JhZmVmMGY5MjZhODAwIiwidGkiOjE3MTE5ODg3NDAyNTEsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps%3A%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"190-m3duFyvxqUaMS3RBGMmiYk9stc0"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://hotelequities.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 86d9efba9838972c-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 01 Apr 2024 16:25:39 GMT

GET
H3 200 415.bdba069eb102cc38.js Show response
hotelequities.savings.workingadvantage.com/ 55 KB
12 KB 131ms
130ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/415.bdba069eb102cc38.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a6154c4d3c1bb32ff866db9366459d826f49f174e411328c39ef9e2766877e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-db73"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbae8ab972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 common.003b9656b817a615.js Show response
hotelequities.savings.workingadvantage.com/ 12 KB
4 KB 116ms
115ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/common.003b9656b817a615.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2cd3aa422f2ccbd0413d661bea7fe6b754484def6d36728f5454870672a269c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-2fcb"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbae8b0972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 765.70ae05c5cc2ccaa7.js Show response
hotelequities.savings.workingadvantage.com/ 77 KB
14 KB 500ms
499ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/765.70ae05c5cc2ccaa7.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6dd044bb30825335006cee6c6543bc20de22fa54f531e746b04728cd067c7d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-13594"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbae8b7972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 811.ad61b9896147fca0.js Show response
hotelequities.savings.workingadvantage.com/ 14 KB
4 KB 124ms
122ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/811.ad61b9896147fca0.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a98219dd04ad4328597d1eee66397eed51c8700524d70e2e86f4de77ed35bbc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-3664"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8c2972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 182.ba37fbe71596ae80.js Show response
hotelequities.savings.workingadvantage.com/ 9 KB
3 KB 135ms
133ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/182.ba37fbe71596ae80.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa06fa2c3489c8cd38111ded1d4d00e49acd0fd2db8cb8fd256ab9feee59f988

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-236d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8c4972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 439.f325f09fdf411047.js Show response
hotelequities.savings.workingadvantage.com/ 2 KB
1 KB 157ms
156ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/439.f325f09fdf411047.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07338585cdd3231289646e764e10047d14121da5404a4fe969dbc2b923264aa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-72e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8c5972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 380.f0e063b179e5e157.js Show response
hotelequities.savings.workingadvantage.com/ 26 KB
7 KB 125ms
124ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/380.f0e063b179e5e157.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c6cbd93e9778a068675681b109f8c43e9ff36ec1952a1a45e8cb71e584332cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-69db"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8c8972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 488.ccb9906f39adcd09.js Show response
hotelequities.savings.workingadvantage.com/ 53 KB
18 KB 212ms
210ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/488.ccb9906f39adcd09.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

772272ba7dcd3a653dfcf535e7f87905ad44c9cc7ebb61655ad0388531e6390a

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-d4d8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8cb972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 521.baeacbc0c4c828ac.js Show response
hotelequities.savings.workingadvantage.com/ 18 KB
5 KB 108ms
107ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/521.baeacbc0c4c828ac.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a89bbc7a76af4d09e73f1773dff26fffac875765f7df54190cd732cecfcfbb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-464c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8d2972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 286.c226fd1ab34e9fb8.js Show response
hotelequities.savings.workingadvantage.com/ 19 KB
6 KB 152ms
151ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/286.c226fd1ab34e9fb8.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

26a2c87094771745db114bee8214d969d8f482f8f5fdba7c3797c42c2fe69dd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-4a97"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8d4972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 320.880fa35fea16e2f8.js Show response
hotelequities.savings.workingadvantage.com/ 45 KB
10 KB 128ms
126ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/320.880fa35fea16e2f8.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f37423894506463a3c264118bfe7666e4497e73053cfb362e7dd29fe45489f93

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-b209"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8d6972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 889.46255f9a2091f0b8.js Show response
hotelequities.savings.workingadvantage.com/ 3 KB
1 KB 137ms
136ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/889.46255f9a2091f0b8.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

411462a0adf4908b5f3416f8da0c6dd4c740eb753505a48dba455c375496dbcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-b5b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbaf8d7972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 436.3a91802a004413f3.js Show response
hotelequities.savings.workingadvantage.com/ 173 KB
27 KB 151ms
151ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/436.3a91802a004413f3.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0df26d537bc0320508d054005523dca66dfe23197a29eeab25c7feed3d62ebad

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-2b378"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbb08da972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 125.2f1009ccbab97272.js Show response
hotelequities.savings.workingadvantage.com/ 215 KB
42 KB 489ms
488ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/125.2f1009ccbab97272.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed655d0c38755c0e86904ac45ce283c8dcca64cf8f439e1678b892141aacc583

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-35dd2"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbb08dc972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 417.5894afbd544c8664.js Show response
hotelequities.savings.workingadvantage.com/ 237 KB
46 KB 136ms
135ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/417.5894afbd544c8664.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c3eccbdeaf8695f573aa903d83898b0fe1472a07f4fdec4cdb2b439caab39a61

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-3b3af"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbb08e1972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 341.489d09706832cbaf.js Show response
hotelequities.savings.workingadvantage.com/ 8 KB
3 KB 143ms
143ms Script
application/javascript 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hotelequities.savings.workingadvantage.com/341.489d09706832cbaf.js

Requested by

Host: hotelequities.savings.workingadvantage.com
URL: https://hotelequities.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c3160e08cc837278b33ff9219c49056837c1b7523d5554e766bc69565129d33

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 28 Mar 2024 11:02:58 GMT
server: cloudflare
content-encoding: br
etag: W/"66054e62-1f37"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://hotelequities.savings.workingadvantage.com, https://hotelequities.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 86d9efbb08e3972c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
10ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1794941530&t=pageview&_s=1&dl=https%3A%2F%2Fhotelequities.savings.workingadvantage.com%2Frelay%3Fdlk%3D2puk4qihza69iehtx6kpos1kj%26corpRedirectUri%3Dhttps%3A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DhotelequitiescorpRedirectUri%253D%255Bhttps%3A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255DcorpcorpRedirectUri%253D%255Bhttps%3A%252F%252Fstore.workingadvantage.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DWelcome-Series-FunLife-Rewards-WAG3%2526utm_campaign%253DFunlife-Rewards-hero-cta%255Dcorp&ul=en-us&de=UTF-8&dt=Hotel%20Equities%20Savings%20Marketplace&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1510506513.1711988731&tid=UA-2876877-9&_gid=1089542927.1711988731&gtm=45He43r0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=335321599

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Sun, 31 Mar 2024 21:20:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68702
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Drone_WA_primary_color.gif
hotelequities.savings.workingadvantage.com/assets/relay/ 2 MB
2 MB 225ms
222ms Image
image/gif 172.64.148.145
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hotelequities.savings.workingadvantage.com/assets/relay/Drone_WA_primary_color.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.148.145 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a89c66670bfdfc2e5a899a820d21a9f667d8c4f459b526abe8b166244eb9ede

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/relay?dlk=2puk4qihza69iehtx6kpos1kj&corpRedirectUri=https:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=hotelequitiescorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5DcorpcorpRedirectUri%3D%5Bhttps:%2F%2Fstore.workingadvantage.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DWelcome-Series-FunLife-Rewards-WAG3%26utm_campaign%3DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 16:25:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 28 Mar 2024 11:03:08 GMT
server: cloudflare
cf-cache-status: DYNAMIC
etag: "66054e6c-1b2cae"
x-frame-options: DENY
content-type: image/gif
accept-ranges: bytes
cf-ray: 86d9efbb18f6972c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1780910

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 11ms
8ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a7ce1a34f3e9944fe88fc61abbc93b6db383afa2b90815fd7ccea456fbce4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://hotelequities.savings.workingadvantage.com/
Origin: https://hotelequities.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 25 Mar 2024 21:16:47 GMT
x-content-type-options: nosniff
age: 587333
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14168
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:29:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 Mar 2025 21:16:47 GMT

GET
H3 200 S6u9w4BMUTPHh7USSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 10ms
7ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ3q5d0.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS