refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::6812:2021 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://echo4.bluehornet.com/ct/101869977:Tk2JNeVnN:m:1:3501463017:E3F25CD1D6A7D2E49925D9AD70CFBDF0:r
Effective URL:
https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&c...
Submission: On February 03 via manual (February 3rd 2023, 4:49:04 pm UTC) from PH — Scanned from US

Summary HTTP 158 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 53 IPs in 2 countries across 45 domains to perform 158 HTTP transactions. The main IP is 2606:4700:4400::6812:2021, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 606258.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 21st 2023. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.89.136.182 52.89.136.182	16509 (AMAZON-02) (AMAZON-02)
1 1	35.162.23.149 35.162.23.149	16509 (AMAZON-02) (AMAZON-02)
1 3	35.201.76.131 35.201.76.131	15169 (GOOGLE) (GOOGLE)
5	2606:4700:440... 2606:4700:4400::6812:2021	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2606:4700:440... 2606:4700:4400::ac40:9bdf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.225.214.12 13.225.214.12	16509 (AMAZON-02) (AMAZON-02)
4	2600:1400:d:5... 2600:1400:d:5a5::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:440... 2606:4700:4400::6812:246e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	18.161.21.58 18.161.21.58	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4006:81c::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3865	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 6	54.85.168.187 54.85.168.187	14618 (AMAZON-AES) (AMAZON-AES)
1	13.225.224.171 13.225.224.171	16509 (AMAZON-02) (AMAZON-02)
19	2607:f8b0:400... 2607:f8b0:4006:820::2008	15169 (GOOGLE) (GOOGLE)
1	52.5.63.122 52.5.63.122	14618 (AMAZON-AES) (AMAZON-AES)
2	63.140.36.121 63.140.36.121	16509 (AMAZON-02) (AMAZON-02)
8 8	44.210.217.65 44.210.217.65	14618 (AMAZON-AES) (AMAZON-AES)
1	34.233.25.80 34.233.25.80	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4860:480... 2001:4860:4802:36::15	15169 (GOOGLE) (GOOGLE)
6 13	34.193.165.73 34.193.165.73	14618 (AMAZON-AES) (AMAZON-AES)
1 3	52.46.143.56 52.46.143.56	16509 (AMAZON-02) (AMAZON-02)
1 3	142.251.40.226 142.251.40.226	15169 (GOOGLE) (GOOGLE)
3 14	2607:f8b0:400... 2607:f8b0:4006:80d::2002	15169 (GOOGLE) (GOOGLE)
14	2607:f8b0:400... 2607:f8b0:4006:81c::2004	15169 (GOOGLE) (GOOGLE)
1 1	18.161.34.83 18.161.34.83	16509 (AMAZON-02) (AMAZON-02)
5	2600:1f18:24e... 2600:1f18:24e6:b901:fb77:f01:241a:594c	14618 (AMAZON-AES) (AMAZON-AES)
2	2607:f8b0:400... 2607:f8b0:4006:807::2003	15169 (GOOGLE) (GOOGLE)
8 9	142.250.65.162 142.250.65.162	15169 (GOOGLE) (GOOGLE)
4 4	142.250.65.166 142.250.65.166	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:816::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:80f::200e	15169 (GOOGLE) (GOOGLE)
2	2600:141b:700... 2600:141b:7000:692::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	74.217.31.245 74.217.31.245	10912 (INTERNAP-BLK) (INTERNAP-BLK)
1	2600:9000:23c... 2600:9000:23cb:5a00:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
10	151.101.1.44 151.101.1.44	54113 (FASTLY) (FASTLY)
1	2606:4700:440... 2606:4700:4400::ac40:98bb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2001:4998:1c:... 2001:4998:1c:800::1000	14779 (YAHOO) (YAHOO)
1	2a04:4e42:600... 2a04:4e42:600::396	54113 (FASTLY) (FASTLY)
1	108.138.113.246 108.138.113.246	16509 (AMAZON-02) (AMAZON-02)
4	23.200.196.208 23.200.196.208	16625 (AKAMAI-AS) (AKAMAI-AS)
2	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
1	2600:9000:24e... 2600:9000:24eb:3600:a:8e7d:9900:93a1	16509 (AMAZON-02) (AMAZON-02)
2	135.148.150.48 135.148.150.48	16276 (OVH) (OVH)
1	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
2	3.216.213.114 3.216.213.114	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2600:1f18:730... 2600:1f18:730:b140:7681:9678:781c:27c9	14618 (AMAZON-AES) (AMAZON-AES)
1	34.193.23.165 34.193.23.165	14618 (AMAZON-AES) (AMAZON-AES)
8 8	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
1	76.13.32.146 76.13.32.146	26101 (YAHOO-BF1) (YAHOO-BF1)
2	23.197.32.188 23.197.32.188	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	8.43.72.98 8.43.72.98	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	192.40.39.223 192.40.39.223	27381 (CASALE-MEDIA) (CASALE-MEDIA)
1 2	68.67.160.137 68.67.160.137	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	162.248.18.37 162.248.18.37	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	192.35.249.138 192.35.249.138	11742 (SPOTX-IAD) (SPOTX-IAD)
2	34.230.132.105 34.230.132.105	14618 (AMAZON-AES) (AMAZON-AES)
158	53

1 52.89.136.182 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-89-136-182.us-west-2.compute.amazonaws.com

echo4.bluehornet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.162.23.149 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-162-23-149.us-west-2.compute.amazonaws.com

tr4ckme.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.76.131 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:4400::6812:2021 (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:4400::ac40:9bdf (United States)

ASN13335 (CLOUDFLARENET, US)

static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.214.12 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-12.ewr50.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:1400:d:5a5::1e80 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:246e (United States)

ASN13335 (CLOUDFLARENET, US)

content.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.161.21.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-161-21-58.bos50.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:81c::200a (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.85.168.187 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-168-187.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.224.171 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-224-171.jfk51.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2607:f8b0:4006:820::2008 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.5.63.122 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-63-122.compute-1.amazonaws.com

quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.36.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-36-121.data.adobedc.net

somni.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 44.210.217.65 (Ashburn, United States) 8 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-210-217-65.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.233.25.80 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-233-25-80.compute-1.amazonaws.com

quickenloans.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:36::15 (United States)

ASN15169 (GOOGLE, US)

sgtm.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 34.193.165.73 (Ashburn, United States) 6 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-165-73.compute-1.amazonaws.com

pixel1083.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.46.143.56 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.40.226 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2607:f8b0:4006:80d::2002 (Nutley, United States) 3 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2607:f8b0:4006:81c::2004 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.161.34.83 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-161-34-83.bos50.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:1f18:24e6:b901:fb77:f01:241a:594c (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

rum-http-intake.logs.datadoghq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:807::2003 (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.65.162 (Glen Cove, United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.65.166 (Glen Cove, United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:816::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80f::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:7000:692::1931 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.217.31.245 (Secaucus, United States)

ASN10912 (INTERNAP-BLK, US)

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23cb:5a00:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.1.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:98bb (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mortgage.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4998:1c:800::1000 (United States)

ASN14779 (YAHOO, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.113.246 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-113-246.jfk50.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.200.196.208 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-200-196-208.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

cdn1.decide.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn1.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:24eb:3600:a:8e7d:9900:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.pmsrv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 135.148.150.48 (Warrenton, United States)

ASN16276 (OVH, FR)
PTR: ext.svh222.incmdb.net

pix.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.216.213.114 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-216-213-114.compute-1.amazonaws.com

psp.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b140:7681:9678:781c:27c9 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.193.23.165 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-23-165.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.130.49 (United States) 8 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.13.32.146 (Lockport, United States)

ASN26101 (YAHOO-BF1, US)
PTR: spdc.pbp.vip.bf1.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.197.32.188 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-197-32-188.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.43.72.98 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.40.39.223 (Canada) 1 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.137 (New York, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.248.18.37 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.35.249.138 (Ashburn, United States) 1 redirects

ASN11742 (SPOTX-IAD, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.230.132.105 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-132-105.compute-1.amazonaws.com

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	everesttech.net 22 redirects cm.everesttech.net — Cisco Umbrella Rank: 1000 pixel1083.everesttech.net — Cisco Umbrella Rank: 618252 pixel.everesttech.net — Cisco Umbrella Rank: 4359 sync-tm.everesttech.net — Cisco Umbrella Rank: 556	11 KB
27	doubleclick.net 15 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 29 cm.g.doubleclick.net — Cisco Umbrella Rank: 211 ad.doubleclick.net — Cisco Umbrella Rank: 184	16 KB
19	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	1 MB
17	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 606258 static-msql-prod.refinance.quickenloans.com — Cisco Umbrella Rank: 772813 trackpixel.refinance.quickenloans.com — Cisco Umbrella Rank: 782140 somni.quickenloans.com — Cisco Umbrella Rank: 254792 content.refinance.quickenloans.com — Cisco Umbrella Rank: 824509 cdn.mortgage.quickenloans.com	301 KB
16	google.com www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 70	2 KB
10	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 886 trc.taboola.com — Cisco Umbrella Rank: 639	19 KB
7	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 197 quicken.demdex.net — Cisco Umbrella Rank: 76973	11 KB
6	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 4501 psp.pushnami.com — Cisco Umbrella Rank: 19640 trc.pushnami.com — Cisco Umbrella Rank: 4729	20 KB
5	datadoghq.com rum-http-intake.logs.datadoghq.com — Cisco Umbrella Rank: 3875
4	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 975	4 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	3 KB
4	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 475	119 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 2573 rp.liadm.com — Cisco Umbrella Rank: 1488 rp4.liadm.com — Cisco Umbrella Rank: 6738	13 KB
3	revjet.com ads.revjet.com — Cisco Umbrella Rank: 4083 pix.revjet.com — Cisco Umbrella Rank: 4795	9 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	91 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 21	20 KB
3	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 167	18 KB
3	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 271	3 KB
3	lmbahsj2.com 1 redirects www.lmbahsj2.com — Cisco Umbrella Rank: 728621	19 KB
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 660	902 B
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 417	500 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 203	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 524	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	873 B
2	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 779	1 KB
2	yahoo.com ads.yahoo.com — Cisco Umbrella Rank: 2562 sp.analytics.yahoo.com — Cisco Umbrella Rank: 1195	679 B
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 471	7 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 724	21 KB
2	gstatic.com fonts.gstatic.com	46 KB
2	lowermybills.com content.lowermybills.com — Cisco Umbrella Rank: 662590 sgtm.lowermybills.com — Cisco Umbrella Rank: 720446	4 KB
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 872	453 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 308	753 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1512	157 B
1	lockerdomecdn.com cdn1.lockerdomecdn.com — Cisco Umbrella Rank: 14734	1 KB
1	pmsrv.co c.pmsrv.co — Cisco Umbrella Rank: 52675	4 KB
1	decide.dev cdn1.decide.dev — Cisco Umbrella Rank: 19039	917 B
1	sc-static.net sc-static.net — Cisco Umbrella Rank: 903	13 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1394	8 KB
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 457	637 B
1	omtrdc.net quickenloans.tt.omtrdc.net — Cisco Umbrella Rank: 77178	723 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1787	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 958	6 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 4766	6 KB
1	tr4ckme.com 1 redirects tr4ckme.com	731 B
1	bluehornet.com 1 redirects echo4.bluehornet.com — Cisco Umbrella Rank: 340701	788 B
158	45

	Domain	Requested by
19	www.googletagmanager.com	refinance.quickenloans.com www.googletagmanager.com assets.adobedtm.com trackpixel.refinance.quickenloans.com
14	www.google.com	refinance.quickenloans.com
14	googleads.g.doubleclick.net	3 redirects www.googletagmanager.com
12	pixel.everesttech.net	6 redirects refinance.quickenloans.com
9	trc.taboola.com	cdn.taboola.com
9	cm.g.doubleclick.net	8 redirects
8	sync-tm.everesttech.net	8 redirects
8	cm.everesttech.net	8 redirects
6	dpm.demdex.net	1 redirects refinance.quickenloans.com www.datadoghq-browser-agent.com
5	content.refinance.quickenloans.com	refinance.quickenloans.com static-msql-prod.refinance.quickenloans.com
5	rum-http-intake.logs.datadoghq.com	www.datadoghq-browser-agent.com
5	refinance.quickenloans.com	www.datadoghq-browser-agent.com
4	pixel.mathtag.com	trackpixel.refinance.quickenloans.com pixel.mathtag.com refinance.quickenloans.com
4	ad.doubleclick.net	4 redirects
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
4	assets.adobedtm.com	refinance.quickenloans.com assets.adobedtm.com
3	connect.facebook.net	refinance.quickenloans.com connect.facebook.net
3	www.google-analytics.com	www.googletagmanager.com www.datadoghq-browser-agent.com
3	www.googleadservices.com	1 redirects www.googletagmanager.com trackpixel.refinance.quickenloans.com
3	s.amazon-adsystem.com	1 redirects refinance.quickenloans.com
3	www.lmbahsj2.com	1 redirects trackpixel.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	trc.pushnami.com	www.datadoghq-browser-agent.com
2	sync.search.spotxchange.com	1 redirects
2	us-u.openx.net	1 redirects
2	ib.adnxs.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	www.facebook.com	refinance.quickenloans.com
2	ct.pinterest.com	s.pinimg.com refinance.quickenloans.com
2	psp.pushnami.com	www.datadoghq-browser-agent.com
2	pix.revjet.com	ads.revjet.com
2	s.yimg.com	refinance.quickenloans.com www.datadoghq-browser-agent.com
2	s.pinimg.com	refinance.quickenloans.com s.pinimg.com
2	adservice.google.com	refinance.quickenloans.com
2	fonts.gstatic.com	fonts.googleapis.com
2	somni.quickenloans.com	www.datadoghq-browser-agent.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
1	image2.pubmatic.com
1	pixel.rubiconproject.com
1	sp.analytics.yahoo.com
1	rp4.liadm.com	refinance.quickenloans.com
1	rp.liadm.com	1 redirects
1	ads.yahoo.com
1	alb.reddit.com
1	cdn1.lockerdomecdn.com	trackpixel.refinance.quickenloans.com
1	c.pmsrv.co	trackpixel.refinance.quickenloans.com
1	cdn1.decide.dev	trackpixel.refinance.quickenloans.com
1	sc-static.net	refinance.quickenloans.com
1	www.redditstatic.com	refinance.quickenloans.com
1	cdn.mortgage.quickenloans.com	trackpixel.refinance.quickenloans.com
1	cdn.taboola.com	refinance.quickenloans.com
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	refinance.quickenloans.com
1	aa.agkn.com	1 redirects
1	pixel1083.everesttech.net	refinance.quickenloans.com
1	sgtm.lowermybills.com	www.datadoghq-browser-agent.com
1	quickenloans.tt.omtrdc.net	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	content.lowermybills.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
1	tr4ckme.com	1 redirects
1	echo4.bluehornet.com	1 redirects
158	65

This site contains links to these domains. Also see Links.

Domain
mortgage.quickenloans.com
privacyportal-cdn.onetrust.com
www.fhfa.gov
capitalmarkets.freddiemac.com
www.nmlsconsumeraccess.org
www.rocketmortgage.com
www.remodelingcalculator.org
www.nytimes.com
www.lendingtree.com
marketing.lowermybills.com

Subject Issuer	Validity	Valid
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2023-01-21` - `2024-01-21`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M02	`2023-02-02` - `2024-03-02`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
lowermybills.com Cloudflare Inc ECC CA-3	`2022-11-10` - `2023-11-10`	a year	crt.sh
*.pushnami.com Amazon	`2022-04-03` - `2023-05-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-11` - `2023-05-10`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-14` - `2024-01-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
somni.quickenloans.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-12` - `2023-04-12`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
sgtm.lowermybills.com GTS CA 1D4	`2023-01-09` - `2023-04-09`	3 months	crt.sh
*.tmogul.com Amazon	`2022-06-15` - `2023-07-14`	a year	crt.sh
*.logs.datadoghq.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-26` - `2023-04-26`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-08-08`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-11-13` - `2023-02-11`	3 months	crt.sh
*.revjet.com Sectigo RSA Domain Validation Secure Server CA	`2022-03-14` - `2023-04-11`	a year	crt.sh
*.liadm.com Amazon	`2023-01-01` - `2024-01-30`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2022-12-08` - `2023-12-31`	a year	crt.sh
mortgage.quickenloans.com Cloudflare Inc ECC CA-3	`2022-11-10` - `2023-11-10`	a year	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-01-19` - `2023-03-08`	2 months	crt.sh
www.redditstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-16` - `2023-05-15`	6 months	crt.sh
sc-static.net Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
pixel.mathtag.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-05` - `2023-07-05`	a year	crt.sh
cdn1.decide.dev R3	`2023-01-06` - `2023-04-06`	3 months	crt.sh
pmsrv.co Amazon	`2022-10-16` - `2023-11-14`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2022-05-13` - `2023-05-13`	a year	crt.sh
cdn1.lockerdomecdn.com R3	`2023-01-06` - `2023-04-06`	3 months	crt.sh
s.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-21`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-16` - `2023-05-14`	6 months	crt.sh
*.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-01-03` - `2023-06-28`	6 months	crt.sh

This page contains 5 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Frame ID: F95CD41AC9DC89D2C6112E9A18FA51D2
Requests: 103 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: 1E96D9C2BB5CC3B9956B15CC1838C9F0
Requests: 19 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: 40D1F6F24AF43CD92E6F9B7B7122D7D0
Requests: 31 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: D73F6BE0A7534D201279FE2E22B47312
Requests: 1 HTTP requests in this frame

Frame: https://pixel.mathtag.com/sync/iframe?mt_uuid=c81363dd-3afa-4900-8776-fdfdf83ee6c1&no_iframe=1&mt_adid=245296&source=mathtag
Frame ID: 3ED0D68154D86F315F3B0FEC389B3254
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

QuickenLoans

Page URL History Show full URLs

http://echo4.bluehornet.com/ct/101869977:Tk2JNeVnN:m:1:3501463017:E3F25CD1D6A7D2E49925D9AD70CFBDF0:r HTTP 302
https://tr4ckme.com/?a=44&c=202&s1=A3D HTTP 302
https://www.lmbahsj2.com/25QRCXX/FGXLG/?source_id=703&sub1=44&sub2=3005340 HTTP 302
https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-5486... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

158
Requests

83 %
HTTPS

39 %
IPv6

45
Domains

65
Subdomains

53
IPs

2
Countries

1887 kB
Transfer

5294 kB
Size

68
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://mortgage.quickenloans.com/legal/MSQL_stateprivacy.php
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: http://capitalmarkets.freddiemac.com/debt/pdf/guide_gse_debtsecurities.pdf
Title: http://capitalmarkets.freddiemac.com/debt/pdf/guide_gse_debtsecurities.pdf

Search URL Search Domain Scan URL

URL: https://www.nmlsconsumeraccess.org/
Title: www.NMLSConsumerAccess.org

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/email-policy
Title: E-Mail Policy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/security-privacy
Title: Security and Privacy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/disclosures-licenses
Title: Disclosures and Licenses

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/opt-out?show=email
Title: Communication Opt-Out

Search URL Search Domain Scan URL

URL: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/
Title: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates
Title: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates

Search URL Search Domain Scan URL

URL: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/
Title: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/MSQL_terms.php
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/MSQL_privacy.php
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/licenses.php
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/ad-targeting.php
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://marketing.lowermybills.com/api/marketing/redirect?uid=214966&prd=MS
Title: Go To LowerMyBills

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://echo4.bluehornet.com/ct/101869977:Tk2JNeVnN:m:1:3501463017:E3F25CD1D6A7D2E49925D9AD70CFBDF0:r HTTP 302
https://tr4ckme.com/?a=44&c=202&s1=A3D HTTP 302
https://www.lmbahsj2.com/25QRCXX/FGXLG/?source_id=703&sub1=44&sub2=3005340 HTTP 302
https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675442936918 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675442936918

Request Chain 23

https://cm.everesttech.net/cm/dd?d_uuid=07357087537178398120383481460527332906 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y906_QAAAFtsEAN-

Request Chain 33

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894 HTTP 302
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Request Chain 34

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=-TrdY6TRGc-eoPMPyY-TuAQ&random=1904612523&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1904612523&sscte=1&crd=&is_vtc=1&ocp_id=-TrdY6TRGc-eoPMPyY-TuAQ&random=3136907504

Request Chain 35

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=07357087537178398120383481460527332906 HTTP 302
https://dpm.demdex.net/ibs:dpid=21&dpuuid=213900604416009637048

Request Chain 46

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MDczNTcwODc1MzcxNzgzOTgxMjAzODM0ODE0NjA1MjczMzI5MDY= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MDczNTcwODc1MzcxNzgzOTgxMjAzODM0ODE0NjA1MjczMzI5MDY=&google_tc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESELPH5WTsU0TiunTq8YfVhEY&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 48

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=1059571899.1675442938;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CK_Ikqnn-fwCFbg0rQYdisAGqg;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=1059571899.1675442938;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CK_Ikqnn-fwCFbg0rQYdisAGqg;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4

Request Chain 51

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=1059571899.1675442938;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CJ3Okqnn-fwCFX3JwgQdnZcPUQ;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=1059571899.1675442938;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CJ3Okqnn-fwCFX3JwgQdnZcPUQ;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4

Request Chain 53

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEEUWMsxISDu9mOwfSnIDpfY&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 55

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=623350842&cv=11&fst=1675442937634&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&value=1&currency_code=USD&gtm_ee=1&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=-TrdY9OnKI3f_gTaz4DgDg&sscte=1&crd=&pscrd=Ek9DaEVJZ1A3eW5nWVF2NkxzeGZ2TXNvalVBUkltQU9Vd0ZnVkZnRTI3blBpZVB3Y2w1UC1GU1NsV0dTOGVkYXFaZ2lEaS02RTlfZE9MSGRnGlpDaEVJZ1A3eW5nWVFxSzZ2NG9YTGt0LXlBUkl1QUFoR3ZXLXBKR2loTU5SQm9fT2tZMTcwYWhKcEhyS1Z3bEMwV1h1TlhUYTZkMXBZaTA2QmJrSEFBLWI3NFE HTTP 302
https://www.google.com/pagead/1p-conversion/1062919768/?random=623350842&cv=11&fst=1675442937634&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&value=1&currency_code=USD&gtm_ee=1&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ1A3eW5nWVF2NkxzeGZ2TXNvalVBUkltQU9Vd0ZnVkZnRTI3blBpZVB3Y2w1UC1GU1NsV0dTOGVkYXFaZ2lEaS02RTlfZE9MSGRnGlpDaEVJZ1A3eW5nWVFxSzZ2NG9YTGt0LXlBUkl1QUFoR3ZXLXBKR2loTU5SQm9fT2tZMTcwYWhKcEhyS1Z3bEMwV1h1TlhUYTZkMXBZaTA2QmJrSEFBLWI3NFE&is_vtc=1&ocp_id=-TrdY9OnKI3f_gTaz4DgDg&cid=CAQSKQDUE5ym7LZe_WEp2jMmq8B4qzlNEQq8vLdqHL7Fw6iIh3F7giiOYX_0&random=3034669389

Request Chain 57

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEEUWMsxISDu9mOwfSnIDpfY&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 58

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935 HTTP 302
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=564723811

Request Chain 59

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESEEUWMsxISDu9mOwfSnIDpfY&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 60

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESEEUWMsxISDu9mOwfSnIDpfY&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 94

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEEUWMsxISDu9mOwfSnIDpfY&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 100

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEEUWMsxISDu9mOwfSnIDpfY&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 116

https://cm.everesttech.net/cm/yh HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y906&sigv=1&esig=1~56af7dc3985bf580ec80e7e09ed0bf9113c87b73

Request Chain 124

https://rp.liadm.com/j?dtstmp=1675442938682&aid=a-06d7&se=e30&duid=ddc3c751f117--01grc2wrma76ds8ph7mkdyfykn&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&ext_s_ecid=MCMID%7C07547164962540101240368995872409369314&wpn=lc-bundle HTTP 302
https://rp4.liadm.com/j?dtstmp=1675442938682&aid=a-06d7&se=e30&duid=ddc3c751f117--01grc2wrma76ds8ph7mkdyfykn&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&ext_s_ecid=MCMID%7C07547164962540101240368995872409369314&wpn=lc-bundle&i6=MjYwMjpmZmM4OjI6MTA0Ojo0&n3pc=true

Request Chain 128

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTkwNkBRQUFBUTF5RzE2YQ==

Request Chain 142

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y906@QAAAQ1yG16a&expires=90

Request Chain 143

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y906@QAAAQ1yG16a HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y906@QAAAQ1yG16a&C=1

Request Chain 144

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=Y906@QAAAQ1yG16a HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY906%40QAAAQ1yG16a

Request Chain 145

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y906@QAAAQ1yG16a HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=Y906@QAAAQ1yG16a

Request Chain 146

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y906@QAAAQ1yG16a

Request Chain 147

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y906@QAAAQ1yG16a&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y906@QAAAQ1yG16a&img=1&__user_check__=1&sync_id=a8011055-a3e2-11ed-9b40-19b3ac430103

Request Chain 148

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y906@QAAAQ1yG16a&t=2592000&o=0

158 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
refinance.quickenloans.com/
Redirect Chain

http://echo4.bluehornet.com/ct/101869977:Tk2JNeVnN:m:1:3501463017:E3F25CD1D6A7D2E49925D9AD70CFBDF0:r
https://tr4ckme.com/?a=44&c=202&s1=A3D
https://www.lmbahsj2.com/25QRCXX/FGXLG/?source_id=703&sub1=44&sub2=3005340
https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db...

120 KB
23 KB

637ms
575ms

Document
text/html

2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

2d5373f1af87557cdcbe602281c46c66b59734e927716aaa33f6cd17aabed1c1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 793ca82dfa24d14f-BUF
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Fri, 03 Feb 2023 16:48:56 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 271
content-type: text/html; charset=utf-8
date: Fri, 03 Feb 2023 16:48:55 GMT
location: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: 93c9b813-244a-4f40-bb28-024abb6e6973

GET
H2 200 main.b4d3d5254949875ebdfb.css
static-msql-prod.refinance.quickenloans.com/ 66 KB
12 KB 139ms
82ms Stylesheet
text/css 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a6cf3b6daf39a9b2f236a2b3449bc004378762c6ddc1fc09c98673ad247a691

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
x-amz-version-id: bgWoTF6nOFJSd2LdMoXh6CzSOHrLR3yB
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 5d3699e517195152b2b0917312ab80b8.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P4
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Thu, 20 Oct 2022 17:38:42 GMT
server: cloudflare
etag: W/"bec2a4f40238e442b516b45d05a11752"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 793ca831f859d163-BUF
x-amz-cf-id: PLPoJXfkUXR6hDusyjR-DiJkrMJv-Dpu5ZXDAMvU0jk4Uq_02wFjtw==
expires: Fri, 03 Feb 2023 20:48:56 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 19 KB
6 KB 156ms
42ms Script
application/x-javascript 13.225.214.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.12 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-12.ewr50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f3496bc7c277d917d35553c46ed1597a86065494cac582e42a3a1d55aedef7fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 10:16:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
via: 1.1 7f59e30d6672b7ea91c10bca6108d29a.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
age: 23567
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6124
x-xss-protection: 1; mode=block
last-modified: Mon, 30 May 2022 14:38:02 GMT
server: AmazonS3
etag: "5add60196e5f96a414fb4b9586764e5d"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: c889ol7XHFdb8qq1TXmn2Z79v5sBa6meUv0x1-2PYTdLOMz8CPUqRw==

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
577 B 182ms
104ms Script
application/javascript 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0093220d4c1b5e63d15fb4e0086a3f1a5e352c183335c5ec2b26dc0397804b65

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-f9ce7dd407c990d717ff.js
date: Fri, 03 Feb 2023 16:48:56 GMT
via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: IAD12-P1
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 25 Jan 2023 05:07:22 GMT
server: cloudflare
etag: W/"ece8253d43bc7b407b5150bffe3e81a6"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 793ca8321862d163-BUF
x-amz-cf-id: 2wq2g5fyQRyoKcaas0dTJRoN-S7XXAznwZtGvLM9lVxcaUkW82ejWg==
expires: Fri, 03 Feb 2023 20:48:56 GMT

GET
H2 200 launch-ENac0456a305144bd1997bb2b709c90a1c.min.js Show response
assets.adobedtm.com/ 304 KB
96 KB 139ms
36ms Script
application/x-javascript 2600:1400:d:5a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a5::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4cd749cb1a66ca42afac2d38a803da602eef0619f6a9efba23a8ab454226575e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
last-modified: Tue, 04 Oct 2022 13:43:04 GMT
server: AkamaiNetStorage
etag: "0fb6aa3c4bf73f5d329f4861a8e0c874:1664890984.616336"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 97479
expires: Fri, 03 Feb 2023 17:48:56 GMT

GET
H2 200 deviceatlas-1.6.min.js Show response
content.lowermybills.com/deviceatlas-1.6/ 7 KB
3 KB 157ms
91ms Script
application/javascript 2606:4700:4400::6812:246e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://content.lowermybills.com/deviceatlas-1.6/deviceatlas-1.6.min.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:246e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d60aa838e099599b51126886e7fa0334ad2022c7b4f76977c86f45463b55bfe9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
via: 1.1 241db89625f6ef70a00b0e19e0cfc332.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 25 Jan 2023 22:43:09 GMT
server: cloudflare
etag: W/"67510dbcee1857a225b8f76bdc940c26"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 793ca8339891d15f-BUF
x-amz-cf-id: HCNkzv2rlV4lUkQM0mHCZnbhNpFlH6nkkvPkdisxXdZWZo240cygkA==
expires: Fri, 03 Feb 2023 18:48:56 GMT

GET
H2 200 623bac6703b37600138f67a3 Show response
api.pushnami.com/scripts/v1/push/ 87 KB
18 KB 134ms
41ms Script
application/javascript 18.161.21.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.161.21.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-161-21-58.bos50.r.cloudfront.net
Software: /
Resource Hash: ab8140419c7b5be781790bfc0835bebbe09c8ee3edeb6f1bda347bda8a457ecd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:45:33 GMT
content-encoding: gzip
via: 1.1 b4debb06a98b003776d85ccc4e8f26c0.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P1
age: 203
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: o00noiTbbZ5th5jhDr60i_m29JpG45bLOVg_AjlnRc4PlHqQFjHzjQ==

GET
H2 200 css2
fonts.googleapis.com/ 822 B
822 B 103ms
41ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4b01f9a7a6886d1fa34e50af146b0c0df3e7582547121f00f307afd7766b5d54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 16:42:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Feb 2023 16:48:56 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
775 B 104ms
42ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7a3bcc4ea246253c762bbf4df2af7be93a663ec62af9fea8188e9c8a7f8b8c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 16:47:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Feb 2023 16:48:56 GMT

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
781 B 106ms
44ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

19094c592aeeebae116447ed13c90636e41825350032b21a7c4e8eb202d448bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 16:42:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Feb 2023 16:48:56 GMT

GET
H2 200 css2
fonts.googleapis.com/ 403 B
390 B 107ms
45ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dbe0bf1b9db8912770e849b979650a616b44dc78930290df944591d75d292a08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 16:48:56 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Feb 2023 16:48:56 GMT

GET
H2 200 pixel-f9ce7dd407c990d717ff.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 175 KB
23 KB 73ms
73ms Script
application/javascript 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a541998b9c385a9e7c8aa59980b151070459d8fd8f1dc4a5f469cd1d57d43d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
via: 1.1 06ebe0ab523bf2d4fc9ffb022fd19e36.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: BOS50-P2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Nov 2022 16:36:05 GMT
server: cloudflare
etag: W/"f17f655e0dd528d1e5dcac0495fd9f58"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 793ca83328b9d163-BUF
x-amz-cf-id: 7GPbRgkoHsJi0StI3mOVVLOMP2r55zJJ_Le2W7a_pZZ1SDU3BxEj0g==
expires: Fri, 03 Feb 2023 20:48:56 GMT

GET
H2 200 main.b4d3d5254949875ebdfb.js Show response
static-msql-prod.refinance.quickenloans.com/ 502 KB
143 KB 70ms
70ms Script
application/javascript 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3e9287e2c3b20f9f8d9afb0c8117d6a3cec13f3b8587f362dc5476ed1eedaad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
x-amz-version-id: MMnA..uCDYi40sShNeTo5YQbb274gJAz
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 877f105eccbc5cf798a3a34d16fc0c74.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P3
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 06 Dec 2022 08:46:25 GMT
server: cloudflare
etag: W/"791cb2470b6581813f72f27d0aa68286"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 793ca83398d0d163-BUF
x-amz-cf-id: o6uxyFUMSmLg_XekOw20kyqRU8RfTZ1M9KAImHnkHNlwLFluB3Gm_g==
expires: Fri, 03 Feb 2023 20:48:56 GMT

GET
H2 200 vaafb692b2aea4879b33c060e79fe94621666317369993 Show response
static.cloudflareinsights.com/beacon.min.js/ 17 KB
6 KB 348ms
299ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: gzip
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
server: cloudflare
etag: W/2022.10.1
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 793ca8345e51d157-BUF

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675442936918
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675442936918

4 KB
2 KB

55ms
55ms

XHR
application/json

54.85.168.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675442936918

Requested by

Protocol

HTTP/1.1

Server

54.85.168.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-85-168-187.compute-1.amazonaws.com

Software

Resource Hash

cf4dde90e0a02ba859cc1d415fcb3d74dac6bc276ca9a1b7144873a75b18a6eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v044-0140d5195.edge-va6.demdex.com 7 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: TzwSOYsuSg8=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1255
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-va6-2-v044-06d7211ed.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: JKj6kv5MTVI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675442936918
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 34 KB
12 KB 30ms
29ms Script
application/x-javascript 2600:1400:d:5a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a5::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "dfdd9e1f988805f0c2fbb10cd6b8f034:1663863409.614694"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12384
expires: Fri, 03 Feb 2023 17:48:56 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 3 KB
2 KB 33ms
32ms Script
application/x-javascript 2600:1400:d:5a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a5::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "b89fcb8870ac40eecb6d3cc844d35389:1663863409.92483"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1598
expires: Fri, 03 Feb 2023 17:48:56 GMT

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 25 KB
9 KB 28ms
27ms Script
application/x-javascript 2600:1400:d:5a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a5::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:50 GMT
server: AkamaiNetStorage
etag: "d220d501715e0484d0dddeac614f902c:1663863410.217006"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8755
expires: Fri, 03 Feb 2023 17:48:56 GMT

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 101ms
32ms Script
application/javascript 13.225.224.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.224.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-224-171.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:05 GMT
content-encoding: br
via: 1.1 ab95c5a0dcf51f52101ed4d59d15a2a2.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK51-C1
age: 56
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: UFlKm0E-796eHbO6_AS_dXH4k8Z6cu1AgwrcToCMhtKs46RAsyet6A==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 99 KB
39 KB 103ms
43ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f32dd832efef60f0f67a8d4059f49370afa4c06e5ea1f02e12d020bc524f43d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39364
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
BLOB 200
OK 527d9666-03b5-4521-a889-27fc4709c6a4
https://refinance.quickenloans.com/ 26 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://refinance.quickenloans.com/527d9666-03b5-4521-a889-27fc4709c6a4
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Length: 26149
Content-Type

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 213 KB
75 KB 48ms
47ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-WQ7TGZQSWQ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bd657684891d2f2479201aeb49e84cb4e8b85df88a633fb66a83b8676d60b6db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76625
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H/1.1 200
OK dest5.html Show response
quicken.demdex.net/ Frame 1E96 7 KB
3 KB 157ms
32ms Document
text/html 52.5.63.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.5.63.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-5-63-122.compute-1.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-va6-1-v044-03f71dd4e.edge-va6.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: PTujUj/eTRw=
content-encoding: gzip
date: Fri, 3 Feb 2023 16:48:57 GMT
last-modified: Fri, 28 Oct 2022 11:05:19 GMT
vary: accept-encoding

GET
H2 200 id Show response
somni.quickenloans.com/ 48 B
469 B 392ms
107ms XHR
application/x-javascript 63.140.36.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=07547164962540101240368995872409369314&ts=1675442937133

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.121 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-36-121.data.adobedc.net

Software

jag /

Resource Hash

307fb73d0dba9ca102686fc6d891eea87e46371e03d6bf2aabfdb8bed4b68f8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Y906_QAAAFtsEAN-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=07357087537178398120383481460527332906
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y906_QAAAFtsEAN-

42 B
940 B

62ms
62ms

Image
image/gif

54.85.168.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y906_QAAAFtsEAN-

Requested by

Protocol

HTTP/1.1

Server

54.85.168.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-85-168-187.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v044-03e6a8af7.edge-va6.demdex.com 8 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Tjv0FnR4Tvg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y906_QAAAFtsEAN-
Date: Fri, 03 Feb 2023 16:48:57 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
quickenloans.tt.omtrdc.net/rest/v1/ 355 B
723 B 160ms
67ms XHR
application/json 34.233.25.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://quickenloans.tt.omtrdc.net/rest/v1/delivery?client=quickenloans&sessionId=a1d3ef55049f41d0831867d4dfe056de&version=2.10.0
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.25.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-25-80.compute-1.amazonaws.com
Software: /
Resource Hash: 0b914b8cf2f12a331cfbfc20fbf94c6017c707ba81e21dafdbefc92c94355d58

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: 3de8ded71aa1828766be78f8be12fdbf

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 5 KB
3 KB 162ms
162ms XHR
application/json 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

b04e372caa56937a9f6d8a956ab927b472e988513e727f33d67b6afb05906fe1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"1538-lDKAM39qEWM+RPlUOHAiOfCicuY"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 793ca8355cc9d14f-BUF
x-xss-protection: 1; mode=block

GET
H2 200 collect Show response
sgtm.lowermybills.com/g/ 65 B
540 B 294ms
205ms XHR
text/plain 2001:4860:4802:36::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.lowermybills.com/g/collect?v=2&tid=G-WQ7TGZQSWQ&gtm=45je3210&_p=1862655279&cid=157014318.1675442937&ul=en-us&sr=1600x1200&_fplc=0&uaW=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=US&_s=1&sid=1675442937&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&richsstsse

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::15 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 google
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 44ms
43ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-4641735&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e9a79241a4dac3cc8a78fe0208acf9ec9b02858f095f55f5538c06a9251dda16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44189
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
64 KB 73ms
72ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a2fc9d032af13dc22fedca605e9ff0c7617fd6c2a99d6f5e91c07d9362adaa5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65870
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 86ms
85ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9045885&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

91ae255b347f3c230cb350e9c018242056b4c0233a1128e85024641ded5ad6e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44194
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 50ms
49ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8bb2d616aa69bc3bdfdd1b2763a542d294f0f35a97fcf90295fcfdbc95230758

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43942
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 61ms
60ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

346b201c23d955268360c48581503142377f7dd45f922a9e4a13e304ef6b97e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43936
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H/1.1 200
OK p
pixel1083.everesttech.net/1083/ 128 B
796 B 293ms
31ms Image
image/png 34.193.165.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel1083.everesttech.net/1083/p?ev_transid=&ev_=%loanpurpose%&_lead=1
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.165.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-165-73.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:57 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

GET
H/1.1

200
OK

iui3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...

43 B
855 B

57ms
56ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Requested by

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 03 Feb 2023 16:48:57 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5F85PQJSM6N4GTCEWPN8
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 03 Feb 2023 16:48:57 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: VYVHKD589FJNA6KA8JYY
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/776757481/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=-TrdY6TRGc-eoP...
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1904612523&sscte=1&crd=&is_vtc=1&oc...

42 B
455 B

112ms
50ms

Image
image/gif

2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1904612523&sscte=1&crd=&is_vtc=1&ocp_id=-TrdY6TRGc-eoPMPyY-TuAQ&random=3136907504

Requested by

Protocol

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1904612523&sscte=1&crd=&is_vtc=1&ocp_id=-TrdY6TRGc-eoPMPyY-TuAQ&random=3136907504
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=21&dpuuid=213900604416009637048
dpm.demdex.net/ Frame 1E96
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=07357087537178398120383481460527332906
https://dpm.demdex.net/ibs:dpid=21&dpuuid=213900604416009637048

42 B
940 B

37ms
37ms

Image
image/gif

54.85.168.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=21&dpuuid=213900604416009637048

Requested by

Protocol

HTTP/1.1

Server

54.85.168.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-85-168-187.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v044-04cb76042.edge-va6.demdex.com 5 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: EjjNkdewSks=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
via: 1.1 fd55c103a391e84b5f31f2728b1a5514.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: BOS50-P2
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dpm.demdex.net/ibs:dpid=21&dpuuid=213900604416009637048
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
x-amz-cf-id: PyoDSZBFJWmfYGlJlHNS_BLi9-6wQBWvaEPOvM93TOAmazYInBPBYA==
expires: 0

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 241ms
99ms Ping
application/json 2600:1f18:24e6:b901:fb77:f01:241a:594c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20undefined&batch_time=1675442937336
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:fb77:f01:241a:594c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
765 B 67ms
55ms Image
image/png 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
via: 1.1 f141d4a0b9a72779a9dd3a57c2c25f52.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK51-C1
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Mon, 20 Jun 2022 18:44:27 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 793ca83689d8d163-BUF
x-amz-cf-id: UOz_gewq_rSI2ybbsC_rnVySo9-GIsltQKktmFJf2ToDq09SqajBHQ==
expires: Fri, 03 Feb 2023 20:48:57 GMT

GET
H2 200 overlay-close.svg
content.refinance.quickenloans.com/msql/EdisonOverlay/ 586 B
593 B 65ms
53ms Image
image/svg+xml 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/EdisonOverlay/overlay-close.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
via: 1.1 81dc2840587b5003ff52334e3af886a4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR52-C2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 20 Jun 2022 18:44:27 GMT
server: cloudflare
etag: W/"58887760fe01f3933d5ae2d7bcc3f373"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 793ca83689d5d163-BUF
x-amz-cf-id: KrVBvBHGAGDAp6kA3LUaxSjeGs_yx0paS2qEv06x2eytWJtrgNYyeA==
expires: Fri, 03 Feb 2023 20:48:57 GMT

GET
H2 200 qllogo.png
content.refinance.quickenloans.com/msql/ 4 KB
4 KB 70ms
59ms Image
image/png 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/qllogo.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
via: 1.1 329b0fc45cd0599e7f2c2cee0cf4ae8e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR52-C2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 3877
x-xss-protection: 1; mode=block
last-modified: Mon, 20 Jun 2022 18:44:27 GMT
server: cloudflare
etag: "277055237f3837abfae204219c13fa6c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 793ca83689d7d163-BUF
x-amz-cf-id: EqT5B5nArbTlQN-DfXasDNcrw9PVxml-ujrtvSHLRXBsHmUVlE4VFQ==
expires: Fri, 03 Feb 2023 20:48:57 GMT

GET
H2 200 redarrow1.png
content.refinance.quickenloans.com/msql/ 7 KB
7 KB 77ms
66ms Image
image/png 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/redarrow1.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
via: 1.1 81834769243dfd27a095a32cf5b86722.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR52-C2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 6656
x-xss-protection: 1; mode=block
last-modified: Wed, 08 Jun 2022 17:46:57 GMT
server: cloudflare
etag: "55eb59d4535de0b41be9b7465ec7d9c3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 793ca83689d6d163-BUF
x-amz-cf-id: 5VqQPxgYMccGMqNdPAmCjf_Ayv18NzX_i8vXv0y83PX35eJPHLit1A==
expires: Fri, 03 Feb 2023 20:48:57 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 94ms
26ms Font
font/woff2 2607:f8b0:4006:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 06:16:57 GMT
x-content-type-options: nosniff
age: 37920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Feb 2024 06:16:57 GMT

GET
H2 200 4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2
fonts.gstatic.com/s/shadowsintolighttwo/v13/ 15 KB
16 KB 121ms
54ms Font
font/woff2 2607:f8b0:4006:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/shadowsintolighttwo/v13/4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:07:43 GMT
x-content-type-options: nosniff
age: 2474
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15832
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:54:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 03 Feb 2024 16:07:43 GMT

POST
H2 200 ip Show response
refinance.quickenloans.com/api/geo/ 163 B
236 B 191ms
190ms XHR
application/json 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/geo/ip

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

ed49359dd841f7601fbe26fa64ecfbe97a4ad9468732cd9a0266527d610a8331

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"a3-/HmBCh/r+jGay3+JnT613b1OO1Y"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 793ca8373d73d14f-BUF
x-xss-protection: 1; mode=block

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
110 B 479ms
479ms XHR
text/plain 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 793ca8374d75d14f-BUF
content-length: 2
x-xss-protection: 1; mode=block

GET
H2 200 quicken_sprite_4_4_18.png
content.refinance.quickenloans.com/msql/ 75 KB
75 KB 51ms
51ms Image
image/png 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/quicken_sprite_4_4_18.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:57 GMT
via: 1.1 f912c5a5865a58aaaad9710240b6d2f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR52-C2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 76537
x-xss-protection: 1; mode=block
last-modified: Mon, 20 Jun 2022 18:44:27 GMT
server: cloudflare
etag: "1f80b3d1f05cc5648c262fba9d39b61a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 793ca83749fed163-BUF
x-amz-cf-id: hHGjXlhdC4XzdiS0fkUHpKOhCyvbWvzQN33ClN6WChChRxbkFg_bSA==
expires: Fri, 03 Feb 2023 20:48:57 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESELPH5WTsU0TiunTq8YfVhEY&google_cver=1
dpm.demdex.net/ Frame 1E96
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MDczNTcwODc1MzcxNzgzOTgxMjAzODM0ODE0NjA1MjczMzI5MDY=
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MDczNTcwODc1MzcxNzgzOTgxMjAzODM0ODE0NjA1MjczMzI5MDY=&google_tc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESELPH5WTsU0TiunTq8YfVhEY&google_cver=1?gdpr=0&gdpr_consent=

42 B
940 B

34ms
34ms

Image
image/gif

54.85.168.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESELPH5WTsU0TiunTq8YfVhEY&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

54.85.168.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-85-168-187.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v044-0336adf1b.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: FMWKVgM/TT4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESELPH5WTsU0TiunTq8YfVhEY&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 4 KB
2 KB 47ms
38ms XHR
application/json 54.85.168.187
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&d_mid=07547164962540101240368995872409369314&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=MCID%0107547164962540101240368995872409369314&ts=1675442937557

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.85.168.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-85-168-187.compute-1.amazonaws.com

Software

Resource Hash

b6a58f3f46a612b869fd36905173622fc8d2e556d26ea534da090e2ab269fbd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-va6-2-v044-082e2abdf.edge-va6.demdex.com 6 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: YxCEvvIcQsg=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1256
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

dc_pre=CK_Ikqnn-fwCFbg0rQYdisAGqg;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=1059571899.1675442938;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quicke...
https://ad.doubleclick.net/activity;dc_pre=CK_Ikqnn-fwCFbg0rQYdisAGqg;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=1059571899.1675442938;u3=;u14=%25qls.value%25;~o...
https://adservice.google.com/ddm/fls/z/dc_pre=CK_Ikqnn-fwCFbg0rQYdisAGqg;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2...

42 B
107 B

151ms
89ms

Image
image/gif

2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CK_Ikqnn-fwCFbg0rQYdisAGqg;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4

Requested by

Protocol

Server

2607:f8b0:4006:816::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CK_Ikqnn-fwCFbg0rQYdisAGqg;src=4641735;type=conve0;cat=cored0;ord=1;num=8588454597631;gtm=45fe3210;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 88ms
26ms Script
text/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 03 Feb 2023 16:07:52 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 2465
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Fri, 03 Feb 2023 18:07:52 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/1062919768/ 2 KB
1 KB 70ms
69ms Script
text/javascript 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1062919768/?random=1675442937634&cv=11&fst=1675442937634&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&value=1&currency_code=USD&gtm_ee=1&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f2.1e100.net

Software

cafe /

Resource Hash

0f9fa930b391cfbd4ed64d394a8d118e26d6180bf435e3bc162479f6025adec5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1312
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

dc_pre=CJ3Okqnn-fwCFX3JwgQdnZcPUQ;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.qui...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=1059571899.1675442938;u3=Date.now().toString();u14=%25qls.value%25;~oref=https...
https://ad.doubleclick.net/activity;dc_pre=CJ3Okqnn-fwCFX3JwgQdnZcPUQ;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=1059571899.1675442938;u3=Date.now().toString...
https://adservice.google.com/ddm/fls/z/dc_pre=CJ3Okqnn-fwCFX3JwgQdnZcPUQ;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=*;u3=Date.now().toString();u14=%25qls.val...

42 B
401 B

151ms
89ms

Image
image/gif

2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJ3Okqnn-fwCFX3JwgQdnZcPUQ;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4

Requested by

Protocol

Server

2607:f8b0:4006:816::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CJ3Okqnn-fwCFX3JwgQdnZcPUQ;src=9045885;type=conversi;cat=corethan;ord=1;num=8869592112733;gtm=45fe3210;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 s36478744651282 Show response
somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LCXS/ 4 KB
4 KB 172ms
172ms XHR
application/x-javascript 63.140.36.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LCXS/s36478744651282

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.121 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-36-121.data.adobedc.net

Software

jag /

Resource Hash

60f53fa9f3bd1e5f4dac4f0130c296dd932a57e909c0eac77ffb58746d476f33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-aam-tid: yVJhQ2qURBs=
date: Fri, 03 Feb 2023 16:48:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 4218
x-xss-protection: 1; mode=block
dcs: dcs-prod-va6-1-v044-09641ad5d.edge-va6.demdex.com 4 ms
pragma: no-cache
last-modified: Sat, 04 Feb 2023 16:48:57 GMT
server: jag
etag: 3597986311708442624-4619574272653974106
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Thu, 02 Feb 2023 16:48:57 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 1E96
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEEUWMsxISDu9mOwfSnIDpfY&google_cver=1
https://pixel.everesttech.net/1x1

128 B
691 B

37ms
33ms

Image
image/png

34.193.165.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.193.165.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-165-73.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 03 Feb 2023 16:48:58 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
214 B 41ms
40ms XHR
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1862655279&t=pageview&_s=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&ul=en-us&de=UTF-8&dt=QuickenLoans&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAQABAAAAACAAs~&jid=1980330913&gjid=58191523&cid=157014318.1675442937&uid=&tid=UA-3849768-74&_gid=772727732.1675442938&_r=1&_slc=1&gtm=457e3210&z=1019628222

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/1062919768/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=623350842&cv=11&fst=1675442937634&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr...
https://www.google.com/pagead/1p-conversion/1062919768/?random=623350842&cv=11&fst=1675442937634&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadse...

42 B
108 B

55ms
55ms

Image
image/gif

2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1062919768/?random=623350842&cv=11&fst=1675442937634&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&value=1&currency_code=USD&gtm_ee=1&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ1A3eW5nWVF2NkxzeGZ2TXNvalVBUkltQU9Vd0ZnVkZnRTI3blBpZVB3Y2w1UC1GU1NsV0dTOGVkYXFaZ2lEaS02RTlfZE9MSGRnGlpDaEVJZ1A3eW5nWVFxSzZ2NG9YTGt0LXlBUkl1QUFoR3ZXLXBKR2loTU5SQm9fT2tZMTcwYWhKcEhyS1Z3bEMwV1h1TlhUYTZkMXBZaTA2QmJrSEFBLWI3NFE&is_vtc=1&ocp_id=-TrdY9OnKI3f_gTaz4DgDg&cid=CAQSKQDUE5ym7LZe_WEp2jMmq8B4qzlNEQq8vLdqHL7Fw6iIh3F7giiOYX_0&random=3034669389

Requested by

Protocol

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/1062919768/?random=623350842&cv=11&fst=1675442937634&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&value=1&currency_code=USD&gtm_ee=1&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ1A3eW5nWVF2NkxzeGZ2TXNvalVBUkltQU9Vd0ZnVkZnRTI3blBpZVB3Y2w1UC1GU1NsV0dTOGVkYXFaZ2lEaS02RTlfZE9MSGRnGlpDaEVJZ1A3eW5nWVFxSzZ2NG9YTGt0LXlBUkl1QUFoR3ZXLXBKR2loTU5SQm9fT2tZMTcwYWhKcEhyS1Z3bEMwV1h1TlhUYTZkMXBZaTA2QmJrSEFBLWI3NFE&is_vtc=1&ocp_id=-TrdY9OnKI3f_gTaz4DgDg&cid=CAQSKQDUE5ym7LZe_WEp2jMmq8B4qzlNEQq8vLdqHL7Fw6iIh3F7giiOYX_0&random=3034669389
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 43ms
42ms Ping
application/json 2600:1f18:24e6:b901:fb77:f01:241a:594c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20undefined&batch_time=1675442937758
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:fb77:f01:241a:594c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 1E96
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEE...
https://pixel.everesttech.net/1x1

128 B
691 B

33ms
32ms

Image
image/png

34.193.165.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: HTTP/1.1
Server: 34.193.165.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-165-73.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 03 Feb 2023 16:48:57 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3

200

/
www.google.com/pagead/1p-user-list/5830051840/ Frame 1E96
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=564723811

42 B
64 B

45ms
44ms

Image
image/gif

2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=564723811

Requested by

Protocol

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:57 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=564723811
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 1E96
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
691 B

38ms
34ms

Image
image/png

34.193.165.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.193.165.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-165-73.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 03 Feb 2023 16:48:58 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 1E96
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

32ms
31ms

Image
image/png

34.193.165.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.193.165.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-165-73.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 03 Feb 2023 16:48:58 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 128 KB
50 KB 47ms
47ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0ad482ec4a0543bc2039f03bff3d56cf8ec7a6bb73b68ce920e6acdbceefe727

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50662
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ Frame 40D1 1 KB
1 KB 169ms
46ms Script
application/javascript 2600:141b:7000:692::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:7000:692::1931 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fdf85d7c2572c064d848fd3ee3be8d0c0aa6bb5afb9e39dbcf52c41a0147c7e7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

akamai-x-true-ttl: 7200
x-cdn: akamai
etag: "e86e91ccaebee6bf004dc862956ef25c"
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
content-length: 1146

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 59ms
58ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cbd776702975c01e9074609608a5734125e6e41e2f0061428ba8f2099ac537ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44182
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 40D1 106 KB
28 KB 102ms
6ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 03 Feb 2023 16:48:58 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27843
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: cNXCI4G56fWX/xwYB7ukLoWKRxCJxWTLzMqw4FYRbasudPSIDUNJJAnCE8C5mvQI6SG7gfgGiliQVPPZjKhtTQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1512268381
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
ads.revjet.com/ Frame 40D1 19 KB
8 KB 143ms
25ms Script
application/javascript 74.217.31.245
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 74.217.31.245 Secaucus, United States, ASN10912 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx /
Resource Hash: 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2022 13:57:40 GMT
server: nginx
etag: W/"6357eb54-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Fri, 03 Feb 2023 16:58:58 GMT

GET
H2 200 a-06d7.min.js Show response
b-code.liadm.com/ Frame 40D1 34 KB
12 KB 145ms
25ms Script
application/javascript 2600:9000:23cb:5a00:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23cb:5a00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: de9462e351a7c74cd76bf432a62faf0dbf0b068beeb7a16c83eac6728956b7f6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 07:29:17 GMT
content-encoding: gzip
via: 1.1 b0e346c8169b4f8b2ad260265d95ff1a.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
age: 33581
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: StlIwArnLBkCTx3tjAbtb2BmCh0OZgVpwAKijB3HYovrRA-ml6Q6Cw==

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 45 KB
16 KB 100ms
99ms Script
text/javascript 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f2.1e100.net

Software

cafe /

Resource Hash

68f274e5330a1431b6e07a6a979209097633d713576cf9620bee34a6bd898ad7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16815
x-xss-protection: 0
server: cafe
etag: 17544913231395580258
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
64 KB 60ms
58ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b12371694a492579998ee3e382e63bcf34680a0d9658541a01f1e5d005714b95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65984
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1390358/ Frame 40D1 58 KB
18 KB 148ms
40ms Script
application/javascript 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0716b77ae94ad392bc3fd022273e0ac439b06162405ca061e08d6da5b3eb1bba

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-amz-version-id: N6xYXvJhECjZxkECGN5I5T2IdHOi26lS
content-encoding: gzip
via: 1.1 varnish
date: Fri, 03 Feb 2023 16:48:58 GMT
x-amz-request-id: ZK2RF2MA34HYZR3R
age: 65
x-cache: HIT
x-amz-replication-status: PENDING
fastly-restarts: 1
x-amz-id-2: OP2S18kBBpsRt6fokGacsVcIfVtjvwbvd4mQ0z+rZ/bsR/nczapzxnr/u0dx/XTc/hYXspSQSes=
x-served-by: cache-ewr18145-EWR
content-length: 17940
last-modified: Thu, 02 Feb 2023 16:13:54 GMT
server: AmazonS3
x-timer: S1675442938.139865,VS0,VE22
etag: "fe540d556cb62799958b9963f0c3439d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 5
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 6857

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 59ms
58ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a469b0ce3a0aef7d2e834bdf52ddaf37f2f80ee043874da8701747f9e5d3e5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65947
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 68ms
68ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

23ec0f6fbb6ebcaa01534849617d1879be68ab1bb399c0689480369aa23983b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66017
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H2 200 deviceAtlasLmb.min.js Show response
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame 40D1 8 KB
3 KB 158ms
47ms Script
application/javascript 2606:4700:4400::ac40:98bb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:98bb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com
p3p: CP="NON DSP COR LAW CONi TELi OUR SAM IND CNT"
x-xss-protection: 1; mode=block
last-modified: Fri, 21 May 2021 02:42:28 GMT
server: cloudflare
etag: W/"20fc-5c2ce02c32fd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 793ca83b6f52d153-BUF
expires: Fri, 03 Feb 2023 20:48:58 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 128 KB
50 KB 55ms
54ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-966730890&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

048b68880387d7af19b7e60d4f151cb4f09f6e9954e0da8478b1d484e38449b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50657
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 130ms
24ms Script
application/javascript 2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:56 GMT
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
content-encoding: gzip
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
x-amz-request-id: GFVS45V07RN97G5G
age: 3
x-amz-server-side-encryption: AES256
x-amz-id-2: Eu48jFPjL5CtxzkyI/f646oGmaybNPTracbMHNOnGPnnFddEpuE/MN/mktvdnACkLF7WkIYql446O4uqDHqshm7EVjR/I5WOu3Jw5pbICho=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 134ms
24ms Script
application/javascript 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Mon, 23 Jan 2023 21:56:14 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "03d5db9dfd00a5719bb4c9261e6fa1bb"
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7356

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 183 KB
66 KB 97ms
96ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

86ffe14d6f7df5d0924cbee4edcee2b71078b000d46e1540a8fa9cca9a6817fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67491
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 89ms
89ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

625e7ba89e6ca1f0f26e68246e3ddc0d549392bac4a1da01d61e4e267d9adc7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66076
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 77ms
77ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4741eb8666b071a5713d221d02b247e3bc29270e1aad907a0bbae392ad9d2bef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66134
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame 40D1 30 KB
13 KB 153ms
51ms Script
application/javascript 108.138.113.246
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.113.246 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-113-246.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: fa42d02480f27fd0a8768e025d5033abf291c0df6391f25074faf80fa58c422c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: gzip
via: 1.1 410372c9ac35ccad4a4fd5dbf80c9f38.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: JFK50-P3
x-cache: LambdaGeneratedResponse from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 13270
x-amz-cf-id: 5KDueUaK9R1I8KRaSYepUFNNX0uSQyXutsfV3OWTD94uJU9xRzW9Lw==

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ Frame 40D1 1 KB
2 KB 137ms
46ms Script
text/javascript 23.200.196.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.200.196.208 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-196-208.deploy.static.akamaitechnologies.com
Software: MT3 441 9053ffc master iad-pixel-x2 config:1.0.0 /
Resource Hash: d1312d710a6a3874e823702a5fd44c5213a0a60cc166060c58d8326d34c9020e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Server: MT3 441 9053ffc master iad-pixel-x2 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: text/javascript
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 1439
Expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H2 200 quickenloans_lander.js Show response
cdn1.decide.dev/tracking/ Frame 40D1 737 B
917 B 90ms
21ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.decide.dev/tracking/quickenloans_lander.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: gzip
x-sp-metadata: HS256.CIqS9Z4GEocBCiQxNDE3YjllYS1iOGZjLTRlODItODdiMi00MmY0MGM0MTRjMmYQwLizor+z/AIaBgj69fSeBiIMOTYuOS4yNDYuMTk1KKyAAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkZjg5OGJlYjAtNmY2OS00ZGU4LWE5YTYtNTk5ODIzNzgwZGU3GJYDIhgIAhIUY2RzMjEzLnRyMi5od2Nkbi5uZXQ=.uv5nO9WBnGXP+wb7KtEKtUArRAzTCa4ey0xgkt4n/tk=
last-modified: Mon, 29 Mar 2021 18:57:30 GMT
etag: "a28f0deba4086540f82dc5d6b5e47753"
x-hw: 1675442938.cds205.tr2.hn,1675442938.cds213.tr2.c
content-type: application/javascript
cache-control: max-age=2013
accept-ranges: bytes
timing-allow-origin: https://decide.dev
content-length: 406

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 184 KB
66 KB 90ms
89ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

538031f84c7b144493c7d8e7d1e481225a772b76b5993f3f7e88f0470951f36e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67521
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H2 200 src Show response
c.pmsrv.co/v2/conversion/ Frame 40D1 3 KB
4 KB 407ms
299ms Script
text/javascript 2600:9000:24eb:3600:a:8e7d:9900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24eb:3600:a:8e7d:9900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash: 3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
via: 1.1 b4debb06a98b003776d85ccc4e8f26c0.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 3435
x-amz-cf-pop: BOS50-P1
x-amzn-requestid: 0dbaf3f1-56f0-4575-83a4-d03f362a546b
x-amzn-remapped-connection: close
x-powered-by: Express
x-cache: Miss from cloudfront
x-amz-apigw-id: fxYnKFpPyK4FkVg=
content-length: 3435
pragma: no-cache
etag: W/"d6b-sia6N7ids5ScRDuTaHkjdTsJcfc"
x-amzn-trace-id: Root=1-63dd3afa-60d0e02b4bed3ff22a947d6d;Sampled=0
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
x-amzn-remapped-date: Fri, 03 Feb 2023 16:48:58 GMT
x-amz-cf-id: w6CoGF6HgPu_4yq0eT3UI_qd_lHv45jU-QRg4NkYVDudbRSzxffasw==
expires: -1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
64 KB 93ms
92ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0418770bab41d98ca97ea53ee7fd49f55b8cab0cd52634340b9a15a2a06a94fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65934
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 58 KB
18 KB 61ms
60ms Script
text/javascript 35.201.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6eceb1f0125e55dc7051adfec1166348ae06593aefa875aa9f835c5eabe5fd34

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: 76e01c4e-8a28-46f8-bc96-905e4642461d
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 quickenloans_lander.js Show response
cdn1.lockerdomecdn.com/tracking/ Frame 40D1 737 B
1 KB 88ms
21ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.lockerdomecdn.com/tracking/quickenloans_lander.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: gzip
x-amz-version-id: b6Hbc7yn6rhHZ8LkuNIH.XEX.WaaPfs1
last-modified: Mon, 29 Mar 2021 18:57:30 GMT
server: AmazonS3
x-sp-metadata: HS256.CIqS9Z4GEocBCiRhMWE0ZWMwZi1iODNjLTQzNWEtYThiYS02MmRmZDliYmU5ZGEQkMK1or+z/AIaBgj69fSeBiIMOTYuOS4yNDYuMTk1KLCAAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGisIARIkNGIwNGUxNzgtODMxNy00MmVkLWE3OTItMzg2YjlhN2VhMjBhGJYDIhgIAhIUY2RzMDAzLnRyMi5od2Nkbi5uZXQ=.dXL9KSXQ7ThpIZdQNVe9ApwSPY7GurfnCHvD91gXKQA=
x-amz-request-id: R6ASCZ2ZBAJHD9G0
etag: "a28f0deba4086540f82dc5d6b5e47753"
x-hw: 1675442938.cds209.tr2.hn,1675442938.cds003.tr2.c
content-type: application/javascript
cache-control: max-age=2013
accept-ranges: bytes
timing-allow-origin: https://lockerdome.com
content-length: 406
x-amz-id-2: TVL9WhCNywQeFRm//2FdTwFNdYJTUDCxwOjoDz2XXDDORqLoywk+wMO7lWYYlwrKixVRjk0UGTw=

GET
H/1.1 200
OK iui3
s.amazon-adsystem.com/ Frame 40D1 43 B
855 B 44ms
43ms Image
image/gif 52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3D6acaf65c-54d3-788f-2e4f-971d4f6b7886%26type%3D4%26m%3D1&ex-fch=416613&ex-src=https://home.rocketmortgage.com&ex-hargs=v%3D1.0%3Bc%3D584239139431578754%3Bp%3D6ACAF65C-54D3-788F-2E4F-971D4F6B7886

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 03 Feb 2023 16:48:58 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ZYCSHJGZQYZY1XCD71XS
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 hub Show response
api.pushnami.com/scripts/v1/ Frame D73F 2 KB
1 KB 36ms
31ms Document
text/html 18.161.21.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.161.21.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-161-21-58.bos50.r.cloudfront.net

Software

Resource Hash

2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 3352
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Fri, 03 Feb 2023 15:53:06 GMT
vary: accept-encoding
via: 1.1 b4debb06a98b003776d85ccc4e8f26c0.cloudfront.net (CloudFront)
x-amz-cf-id: dUrLL-lN7c4DzG63cnm36vv5164RCcvwr3IHO3087y8dn6uWcbf5ZA==
x-amz-cf-pop: BOS50-P1
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
178 B 37ms
29ms XHR
text/plain 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
content-type: application/json

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 793ca83b0e90d14f-BUF

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 50ms
36ms Image
image/gif 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1862655279&t=timing&_s=2&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&ul=en-us&de=UTF-8&dt=QuickenLoans&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=3033&pdt=321&dns=23&rrt=951&srt=574&tcp=39&dit=2093&clt=2352&_gst=2625&_gbt=2728&_u=YAhAAQABAAAAACAAs~&jid=&gjid=&cid=157014318.1675442937&tid=UA-3849768-74&_gid=772727732.1675442938&gtm=457e3210&z=352791940

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 02:05:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 52982
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 2 KB
1 KB 136ms
118ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1675442938088&cv=11&fst=1675442938088&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=EVlnCPzHxqoBEIrJ_MwD&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&value=1&currency_code=USD&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e1ac89bc27498e96d508a6b08f21fbdca2b4105aa138506e0f476c62931e37b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1038
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 2 KB
993 B 182ms
173ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1675442938119&cv=11&fst=1675442938119&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1153dbbaba0a81114b0fe03ce2b1c4ee67b79536c2570b738d3ec4c42d257b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 969
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 128 KB
49 KB 54ms
48ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d623468cf1b8285b10c533f193be0c27ffbdb4feacd3256e488121fde7bb902f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50650
x-xss-protection: 0
last-modified: Fri, 03 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 1E96
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

128 B
691 B

31ms
30ms

Image
image/png

34.193.165.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.193.165.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-165-73.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 03 Feb 2023 16:48:58 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 122ms
121ms Ping
application/json 2600:1f18:24e6:b901:fb77:f01:241a:594c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20undefined&batch_time=1675442938167
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:fb77:f01:241a:594c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 2 KB
990 B 84ms
83ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1675442938221&cv=11&fst=1675442938221&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-700319321

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f20db67a81d317ed8300a06fc25097344fe99726b67db360c680b760ef02a2d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 966
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 2 KB
992 B 122ms
121ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1675442938248&cv=11&fst=1675442938248&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-813495030

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e7636bca175866a71beb0256f9b762ad9caec95e2c3e26c175386fa37aeaac2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 968
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/ 2 KB
993 B 141ms
141ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/?random=1675442938284&cv=11&fst=1675442938284&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-755089552

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4999dc924f15440930503fb99bc5fef53a2a317b173b033ee44aec3760717e9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 969
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1736491679707345 Show response
connect.facebook.net/signals/config/ Frame 40D1 150 KB
41 KB 28ms
27ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1736491679707345?v=2.9.95&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1b0d7b4d07edcf9646c37389987b88701d3c117ce6694a9ade4387eefe1c8241

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 03 Feb 2023 16:48:58 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 42334
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: DZVA+bj2zxasHhtD3EEjh+27ITcujZcMDkm6PCCo5hMOzPj6SAGHVGQ9fYfUhOwwUXaPCsPYdNxq2yT7Z8q83Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1512268381
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 1E96
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTkwNkBRQUFBUTF5RzE2YQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://pixel.everesttech.net/1x1

128 B
691 B

31ms
31ms

Image
image/png

34.193.165.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.193.165.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-165-73.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 03 Feb 2023 16:48:58 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 2 KB
992 B 255ms
254ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1675442938363&cv=11&fst=1675442938363&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-857412364

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

59d77d6ec839482406c58678ddf9a96bcad7d0c1953916670b01b21bc7d3f764

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 968
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 2 KB
994 B 85ms
85ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1675442938387&cv=11&fst=1675442938387&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-865435318

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d435b2ebd079098fab15da7103b567f361674ea89d070cdf6c006a4e6243b909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 970
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/ 2 KB
993 B 182ms
182ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/?random=1675442938413&cv=11&fst=1675442938413&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68067c289ecbd54461eb9d4774f4040628e6dfe6e09e4458de962540c316bd0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 969
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/ 2 KB
992 B 211ms
210ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/?random=1675442938444&cv=11&fst=1675442938444&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a51a0a22a2fe997b8453a36cd724a706d3ec1d77476ff8c2b247661caa78f865

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 968
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 2 KB
994 B 118ms
118ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1675442938469&cv=11&fst=1675442938469&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de1b34b4d5a451c2e53967cef8b5904da16872b52b61bad46b6c0ec769fcdcce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 970
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pd2259 Show response
pix.revjet.com/track/ Frame 40D1 46 B
224 B 138ms
35ms Script
text/javascript 135.148.150.48
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd2259?__noscript=false&__cbf=revjet.callbacks.cb1675442938482&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 135.148.150.48 Warrenton, United States, ASN16276 (OVH, FR),
Reverse DNS: ext.svh222.incmdb.net
Software: /
Resource Hash: e98aa993d60d3fc596be07347a1dd0b6f65aa00823ba761bfcadc72ca92b87e7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 pd3876 Show response
pix.revjet.com/track/ Frame 40D1 46 B
222 B 137ms
36ms Script
text/javascript 135.148.150.48
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd3876?__noscript=false&__cbf=revjet.callbacks.cb1675442938484&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 135.148.150.48 Warrenton, United States, ASN16276 (OVH, FR),
Reverse DNS: ext.svh222.incmdb.net
Software: /
Resource Hash: d238d36e878d9841bd0cb36cf028341e2007081c5df833549f47b4c4a4487ec6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 10182570.json Show response
s.yimg.com/wi/config/ 46 B
680 B 83ms
28ms XHR
application/json 2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10182570.json

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 02 Feb 2023 22:31:06 GMT
x-amz-version-id: LPMEJDD79ONPE78nruFm6Hgf4VOe0yiw
x-content-type-options: nosniff
strict-transport-security: max-age=15552000
x-amz-request-id: 20GDM046735HS1MT
age: 65873
x-amz-server-side-encryption: AES256
content-length: 46
x-amz-id-2: bfS+hRP+zDf0hnpKXzqhXEJ9Qmconmr0gXk8LZzd8lWTaRfoK9Zz7+hg4brOt/x6tAQKWss3XCQ=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sun, 28 May 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Fri, 22 Apr 2022 01:01:34 GMT
server: ATS
etag: "f31aca15ae5b24f87583e3de167c9828"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
157 B 108ms
41ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1675442938491&id=t2_1fj2owc9&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=5b98c3ba-0b9b-4ce5-82b4-188689e9a09d&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_65e23bc4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
via: 1.1 varnish
server: Varnish
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 40D1 0
181 B 111ms
100ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1675442938514&ref=null&cv=20230202-7-RELEASE&tos=2&ssd=1&scd=0&mrir=u&vi=1675442938509
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442939.542106,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 40D1 0
399 B 100ms
96ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1675442938523&ref=null&cv=20230202-7-RELEASE&tos=10&ssd=1&scd=0&mrir=u&vi=1675442938509
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442939.542080,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 40D1 0
184 B 97ms
97ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1675442938529&ref=null&cv=20230202-7-RELEASE&tos=18&ssd=1&scd=0&mrir=u&vi=1675442938509
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 68
pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442939.546710,VS0,VE68
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H/1.1 200
OK iframe Show response
pixel.mathtag.com/sync/ Frame 3ED0 677 B
1 KB 43ms
41ms Document
text/html 23.200.196.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=c81363dd-3afa-4900-8776-fdfdf83ee6c1&no_iframe=1&mt_adid=245296&source=mathtag
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.200.196.208 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-196-208.deploy.static.akamaitechnologies.com
Software: MT3 441 9053ffc master iad-pixel-x4 config:1.0.0 /
Resource Hash: 3ef64e4a0001cd55211fff6bd306290f29c7482a6006d070ee21e52484b7ef22

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 677
Content-Type: text/html
Date: Fri, 03 Feb 2023 16:48:58 GMT
Expires: Fri, 03 Feb 2023 16:48:57 GMT
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 441 9053ffc master iad-pixel-x4 config:1.0.0

GET
H2 200 main.73589e70.js Show response
s.pinimg.com/ct/lib/ Frame 40D1 56 KB
20 KB 54ms
53ms Script
application/javascript 2600:141b:7000:692::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.73589e70.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:7000:692::1931 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 33024d4c4fb42360df1d0518b959c8efbe9647c0b0fb798dc16066af2f8dfe5c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

akamai-x-true-ttl: 1209600
content-encoding: gzip
x-cdn: akamai
etag: "e2e6ae3a0d92146f974216e640b9f99a"
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 19691

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/ 2 KB
993 B 172ms
170ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/?random=1675442938567&cv=11&fst=1675442938567&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&auid=1059571899.1675442938&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75125501d9e16f957cb03fafafede95dea7c5e935aa48670938d6ac3776d20ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 969
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 1E96
Redirect Chain

https://cm.everesttech.net/cm/yh
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y906&sigv=1&esig=1~56af7dc3985bf580ec80e7e09ed0bf9113c87b73

0
47 B

137ms
26ms

Image
text/plain

2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y906&sigv=1&esig=1~56af7dc3985bf580ec80e7e09ed0bf9113c87b73

Protocol

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
strict-transport-security: max-age=15552000
cache-control: no-store
x-content-type-options: nosniff
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y906&sigv=1&esig=1~56af7dc3985bf580ec80e7e09ed0bf9113c87b73
Date: Fri, 03 Feb 2023 16:48:58 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 48ms
47ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1675442938088&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&label=EVlnCPzHxqoBEIrJ_MwD&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&value=1&currency_code=USD&data=event%3Dconversion&fmt=3&is_vtc=1&random=2476425035&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 40D1 0
479 B 41ms
40ms Image
image/gif 23.200.196.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.200.196.208 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-196-208.deploy.static.akamaitechnologies.com
Software: MT3 441 9053ffc master iad-pixel-x3 config:1.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Server: MT3 441 9053ffc master iad-pixel-x3 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 45ms
44ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1675442938119&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3468767951&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/700319321/ 42 B
64 B 48ms
46ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/700319321/?random=1675442938221&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=570306805&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 psp Show response
psp.pushnami.com/api/ 2 B
230 B 172ms
171ms Fetch
text/html 3.216.213.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.213.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-213-114.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://refinance.quickenloans.com
date: Fri, 03 Feb 2023 16:48:58 GMT
cache-control: no-cache
access-control-allow-credentials: true
content-encoding: gzip
vary: accept-encoding
content-type: text/html; charset=utf-8

OPTIONS
H2 200 psp
psp.pushnami.com/api/ Frame 0
0 111ms
37ms Preflight
application/json 3.216.213.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.213.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-213-114.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: key
access-control-allow-methods: POST
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: content-type, content-length, etag
access-control-max-age: 600
cache-control: no-cache
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 03 Feb 2023 16:48:58 GMT
vary: accept-encoding

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 71ms
70ms Ping
application/json 2600:1f18:24e6:b901:fb77:f01:241a:594c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20undefined&batch_time=1675442938681
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:fb77:f01:241a:594c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2

200

j Show response
rp4.liadm.com/ Frame 40D1
Redirect Chain

https://rp.liadm.com/j?dtstmp=1675442938682&aid=a-06d7&se=e30&duid=ddc3c751f117--01grc2wrma76ds8ph7mkdyfykn&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pk...
https://rp4.liadm.com/j?dtstmp=1675442938682&aid=a-06d7&se=e30&duid=ddc3c751f117--01grc2wrma76ds8ph7mkdyfykn&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26p...

13 B
553 B

111ms
32ms

XHR
application/json

34.193.23.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1675442938682&aid=a-06d7&se=e30&duid=ddc3c751f117--01grc2wrma76ds8ph7mkdyfykn&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&ext_s_ecid=MCMID%7C07547164962540101240368995872409369314&wpn=lc-bundle&i6=MjYwMjpmZmM4OjI6MTA0Ojo0&n3pc=true

Requested by

Protocol

Server

34.193.23.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-193-23-165.compute-1.amazonaws.com

Software

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
x-pixel-event-id: c21333e0-86e3-4389-9689-0fb17cbd7ca9
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: DENY
vary: Origin
content-type: application/json
request-time: 0
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: b50d2cdd7533b3ea
content-length: 13
x-xss-protection: 1; mode=block

Redirect headers

date: Fri, 03 Feb 2023 16:48:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
vary: Origin
location: https://rp4.liadm.com/j?dtstmp=1675442938682&aid=a-06d7&se=e30&duid=ddc3c751f117--01grc2wrma76ds8ph7mkdyfykn&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&ext_s_ecid=MCMID%7C07547164962540101240368995872409369314&wpn=lc-bundle&i6=MjYwMjpmZmM4OjI6MTA0Ojo0&n3pc=true
access-control-allow-origin: https://refinance.quickenloans.com
request-time: 0
access-control-allow-credentials: true
trace-id: a7c72cc49d709c31
content-length: 0
x-xss-protection: 1; mode=block

GET
H3 200 /
www.google.com/pagead/1p-user-list/813495030/ 42 B
64 B 47ms
46ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/813495030/?random=1675442938248&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3382115002&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 inferredevents.js Show response
connect.facebook.net/signals/plugins/ Frame 40D1 72 KB
22 KB 28ms
27ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/inferredevents.js?v=2.9.95

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5849e07d0d6cbb144829b98da75fda4a8eb3fc2b5749d48cc94bb170db54859a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 03 Feb 2023 16:48:58 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 21972
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: +qXC6h1R0OG6+jsvL+gMWJZE5e/3CwA84kKhAE3uxqvhgqOC70rXRQy28MOiUnl3Bd7t2oTcba/Tcb99f2K/lQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/755089552/ 42 B
64 B 44ms
44ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/755089552/?random=1675442938284&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=202058968&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1E96
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTkwNkBRQUFBUTF5RzE2YQ==

170 B
188 B

43ms
43ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTkwNkBRQUFBUTF5RzE2YQ==

Protocol

Server

142.250.65.162 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-ewr18142-EWR
pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1675442939.836035,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTkwNkBRQUFBUTF5RzE2YQ==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
632 B 103ms
32ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2003%20Feb%202023%2016%3A48%3A58%20GMT&n=0&b=QuickenLoans&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&enc=UTF-8&yv=1.13.0&tagmgr=gtm%2Cadobe

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Fri, 03 Feb 2023 16:48:58 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/865435318/ 42 B
64 B 44ms
43ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865435318/?random=1675442938387&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2370451196&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 click Show response
www.lmbahsj2.com/sdk/ 85 B
105 B 75ms
74ms Fetch
application/json 35.201.76.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/sdk/click?effp=12188b416eb8d64943f08936f6fed3f4&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4&oid=9&affid=722&__cc=&async=json
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ec5c91e9e19c7feb3b9697d1479972a1f316d01c0d11b926ea8b948ebf8eba5b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
via: 1.1 google
server: nginx
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
x-eflow-request-id: d7edc6d6-e168-46b3-bf00-c3bbc340d6b6
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 3ED0 0
480 B 41ms
40ms Image
image/gif 23.200.196.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=c81363dd-3afa-4900-8776-fdfdf83ee6c1&no_iframe=1&mt_adid=245296&source=mathtag
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.200.196.208 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-196-208.deploy.static.akamaitechnologies.com
Software: MT3 441 9053ffc master iad-pixel-x22 config:1.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.mathtag.com/sync/iframe?mt_uuid=c81363dd-3afa-4900-8776-fdfdf83ee6c1&no_iframe=1&mt_adid=245296&source=mathtag
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Fri, 03 Feb 2023 16:48:58 GMT
Server: MT3 441 9053ffc master iad-pixel-x22 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Fri, 03 Feb 2023 16:48:57 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866179376/ 42 B
64 B 44ms
44ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866179376/?random=1675442938469&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1181280924&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866176763/ 42 B
64 B 45ms
44ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866176763/?random=1675442938413&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=202008354&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/857412364/ 42 B
64 B 48ms
47ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/857412364/?random=1675442938363&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2372768126&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10910338944/ 42 B
64 B 44ms
44ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10910338944/?random=1675442938444&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1611914814&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ Frame 40D1 540 B
865 B 128ms
37ms XHR
application/json 23.197.32.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2620075802369&pd=%7B%22em%22%3A%22e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%22%7D&cb=1675442938787&dep=2%2CPAGE_LOAD

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.73589e70.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.197.32.188 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-197-32-188.deploy.static.akamaitechnologies.com

Software

Resource Hash

63b2f0b99fea462c96bdb35799e62b4cb534a14b09ee95c6632a7828959e63eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.1e112817.1675442938.1e73d64
x-envoy-upstream-service-time: 2
content-length: 377
x-pinterest-rid: 3585387124627121
pin-unauth: dWlkPVlUazNZVEZoT1dFdE56bG1NaTAwT1dJM0xUbGlZakF0WXpZeFkyTTRaamRtTm1ReQ
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
ct.pinterest.com/v3/ Frame 40D1 35 B
333 B 127ms
41ms Image
image/gif 23.197.32.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?tid=2620075802369&pd=%7B%22em%22%3A%22e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4%22%2C%22ref%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4%22%2C%22if%22%3Atrue%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%2273589e70%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1675442938793

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.197.32.188 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-197-32-188.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.1e112817.1675442938.1e73d66
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 3
content-length: 35
x-pinterest-rid: 5611656131093630
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 49ms
49ms Ping
application/json 2600:1f18:24e6:b901:fb77:f01:241a:594c
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20undefined&batch_time=1675442938794
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:fb77:f01:241a:594c Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 /
www.google.com/pagead/1p-user-list/848879802/ 42 B
64 B 48ms
47ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848879802/?random=1675442938567&cv=11&fst=1675440000000&bg=ffffff&guid=ON&async=1&gtm=45be3210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2687442516&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ Frame 40D1 0
185 B 82ms
27ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&rl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D722%26pkey2%3D44%26pkey3%3D7fb66d16ea364e8db2c30743898630f4%26sourceid%3Dlmb-54867-113582-722%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D722%26_ef_transaction_id%3D7fb66d16ea364e8db2c30743898630f4&if=true&ts=1675442938799&sw=1600&sh=1200&v=2.9.95&r=stable&ec=0&o=28&cs_est=true&fbp=fb.1.1675442938798.1563044118&it=1675442938333&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 03 Feb 2023 16:48:58 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1E96
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y906@QAAAQ1yG16a&expires=90

42 B
753 B

172ms
33ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y906@QAAAQ1yG16a&expires=90
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 03d4828e33e22cf7b4098c5a68746480
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-ewr18142-EWR
pragma: no-cache
date: Fri, 03 Feb 2023 16:48:58 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1675442939.854757,VS0,VE0
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y906@QAAAQ1yG16a&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1E96
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y906@QAAAQ1yG16a
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y906@QAAAQ1yG16a&C=1

43 B
766 B

27ms
26ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y906@QAAAQ1yG16a&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 03 Feb 2023 16:48:59 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 03 Feb 2023 16:48:59 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=88&external_user_id=Y906@QAAAQ1yG16a&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 1E96
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=Y906@QAAAQ1yG16a
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY906%40QAAAQ1yG16a

43 B
1 KB

32ms
32ms

Image
image/gif

68.67.160.137
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY906%40QAAAQ1yG16a

Protocol

HTTP/1.1

Server

68.67.160.137 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 03 Feb 2023 16:48:59 GMT
AN-X-Request-Uuid: 34defe88-f8c5-47e9-9794-259bf5678812
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 96.9.246.195; 96.9.246.195; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 03 Feb 2023 16:48:59 GMT
AN-X-Request-Uuid: ef5ec7d6-7079-47c8-bbbd-f179c637152f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY906%40QAAAQ1yG16a
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 96.9.246.195; 96.9.246.195; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1E96
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y906@QAAAQ1yG16a
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=Y906@QAAAQ1yG16a

43 B
180 B

50ms
49ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=Y906@QAAAQ1yG16a
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Feb 2023 16:48:59 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=Y906@QAAAQ1yG16a
date: Fri, 03 Feb 2023 16:48:59 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 1E96
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y906@QAAAQ1yG16a

1 B
453 B

92ms
27ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y906@QAAAQ1yG16a
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 03 Feb 2023 16:48:58 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by: cache-ewr18142-EWR
pragma: no-cache
date: Fri, 03 Feb 2023 16:48:59 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1675442939.258441,VS0,VE0
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y906@QAAAQ1yG16a
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

partner
sync.search.spotxchange.com/ Frame 1E96
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y906@QAAAQ1yG16a&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y906@QAAAQ1yG16a&img=1&__user_check__=1&sync_id=a8011055-a3e2-11ed-9b40-19b3ac430103

43 B
419 B

35ms
35ms

Image
image/gif

192.35.249.138
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y906@QAAAQ1yG16a&img=1&__user_check__=1&sync_id=a8011055-a3e2-11ed-9b40-19b3ac430103
Protocol: H2
Server: 192.35.249.138 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 16:48:59 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 420
content-length: 43

Redirect headers

date: Fri, 03 Feb 2023 16:48:59 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
location: /partner?adv_id=6409&uid=Y906@QAAAQ1yG16a&img=1&__user_check__=1&sync_id=a8011055-a3e2-11ed-9b40-19b3ac430103
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 212
content-length: 0

GET
H2

200

b.php
www.facebook.com/fr/ Frame 1E96
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y906@QAAAQ1yG16a&t=2592000&o=0

43 B
688 B

45ms
44ms

Image
image/gif

2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y906@QAAAQ1yG16a&t=2592000&o=0

Protocol

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Fri, 03 Feb 2023 08:48:59 PST
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
pragma: public
x-fb-debug: i9bzWVjZ15V9EZMiMtyQnzl712OJ+bPvwXkDmXbeJZPoNdif3NHjm6PZ0/ulRdkDePdBfsAhDg/bjzTZXbZSFA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: image/gif
origin-agent-cluster: ?0
cache-control: public, max-age=0
priority: u=3,i
expires: Fri, 03 Feb 2023 08:48:59 PST

Redirect headers

x-served-by: cache-ewr18142-EWR
pragma: no-cache
date: Fri, 03 Feb 2023 16:48:59 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1675442939.460167,VS0,VE0
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y906@QAAAQ1yG16a&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

POST
H2 200 track Show response
trc.pushnami.com/api/push/ 2 B
168 B 256ms
255ms Fetch
text/html 34.230.132.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.132.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-132-105.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Fri, 03 Feb 2023 16:48:59 GMT
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
content-length: 2
content-type: text/html; charset=utf-8

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 104ms
37ms Preflight 34.230.132.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.132.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-132-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Fri, 03 Feb 2023 16:48:59 GMT

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 40D1 0
57 B 99ms
98ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=1655&scd=0&ssd=1&est=1675442938512&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1675442940168&mrir=u&vi=1675442938509&ref=null&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Fri, 03 Feb 2023 16:49:00 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442940.186186,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 40D1 0
203 B 96ms
96ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=1656&scd=0&ssd=1&est=1675442938512&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1675442940169&mrir=u&vi=1675442938509&ref=null&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Fri, 03 Feb 2023 16:49:00 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442940.186139,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 40D1 0
57 B 97ms
97ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=1656&scd=0&ssd=1&est=1675442938512&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1675442940169&mrir=u&vi=1675442938509&ref=null&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Fri, 03 Feb 2023 16:49:00 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442940.186115,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 40D1 0
242 B 96ms
95ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=4657&scd=0&ssd=1&est=1675442938512&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1675442943170&mrir=u&vi=1675442938509&ref=null&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Fri, 03 Feb 2023 16:49:03 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442943.187931,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 40D1 0
57 B 97ms
96ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=4658&scd=0&ssd=1&est=1675442938512&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1675442943171&mrir=u&vi=1675442938509&ref=null&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Fri, 03 Feb 2023 16:49:03 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442943.188162,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 40D1 0
57 B 97ms
96ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=4659&scd=0&ssd=1&est=1675442938512&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1675442943172&mrir=u&vi=1675442938509&ref=null&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Fri, 03 Feb 2023 16:49:03 GMT
via: 1.1 varnish
x-served-by: cache-ewr18145-EWR
server: nginx
x-timer: S1675442943.188127,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

68 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 09:25:29	Name: X-AB Value: 0d6e407936704bd380072f5891d28b0e
echo4.bluehornet.com/	1970-01-20 09:34:07	Name: AWSALB Value: 6lQyxXXZxNeiCFGMd09qU+ErY8dlb6DlvyC+8aiy8wyytlcMN+jbT5LP+BajnRbk9FMVhGXrZ7SZj5KMaEQVu2/t0ByLz9gXcbnAVNmW+aWNhwaq2nxavjDBj7Cc
.tr4ckme.com/	1969-12-31 23:59:59	Name: sid Value: /6KQPfJyJCUJw5r8ixYoBT4YlxwoBcr7C9O5ntuD11HmfYARUQoCuw==
.tr4ckme.com/	1970-01-20 19:00:02	Name: trk Value: cHAZKb8NooAJw5r8ixYoBT4YlxwoBcr7C9O5ntuD11HmfYARUQoCuw==
.tr4ckme.com/	1970-01-20 10:07:14	Name: c166 Value: /6KQPfJyJCXQrCkcWHMqmJRBoQvfyvwuQfFVBVnqOIE=
www.lmbahsj2.com/	1970-01-20 09:25:29	Name: uniqueClick_FGXLG Value: 12f88cd0-ab9d-41bd-ba89-bbeb2f1076c6:1675442935
www.lmbahsj2.com/	1970-01-20 11:33:38	Name: transaction_id Value: 7fb66d16ea364e8db2c30743898630f4
refinance.quickenloans.com/	1970-01-20 18:09:38	Name: visitorId Value: d8ca5a33-82f3-4fdf-98c8-3ba6e30f64eb
refinance.quickenloans.com/	1970-01-20 09:34:07	Name: contentTarget Value: %7B%22sourceId%22%3A%22lmb-54867-113582-722%22%7D
.quickenloans.com/	1969-12-31 23:59:59	Name: at_check Value: true
.lowermybills.com/	1970-01-20 09:24:04	Name: __cf_bm Value: GJA3H4mJn3D7D0PliAPJ7._kLgJhdNMBSMs6CY8ygIY-1675442936-0-AZaW92RVxqGGVBekoeGiJByk8xyCD9NoLYfbEC5MWbxCNPtqertpNuzB5t1xRD0hmQ2JOO2Wo54CTVAtsUbJbcE=
refinance.quickenloans.com/	1970-01-20 09:25:29	Name: DAPROPS Value: "sjs.webGlRenderer:Intel Iris OpenGL Engine\|bjs.accessDom:1\|bcookieSupport:1\|bcss.animations:1\|bcss.columns:1\|bcss.transforms:1\|bcss.transitions:1\|sdevicePixelRatio:1\|idisplayColorDepth:24\|bflashCapable:0\|bhtml.audio:1\|bhtml.canvas:1\|bhtml.inlinesvg:1\|bhtml.svg:1\|bhtml.video:1\|bjs.applicationCache:0\|bjs.deviceMotion:1\|bjs.deviceOrientation:0\|bjs.geoLocation:1\|bjs.indexedDB:1\|bjs.json:1\|bjs.localStorage:1\|bjs.modifyCss:1\|bjs.modifyDom:1\|bjs.querySelector:1\|bjs.sessionStorage:1\|bjs.supportBasicJavaScript:1\|bjs.supportConsoleLog:1\|bjs.supportEventListener:1\|bjs.supportEvents:1\|bjs.touchEvents:0\|bjs.webGl:1\|bjs.webSockets:1\|bjs.webSqlDatabase:0\|bjs.webWorkers:1\|bjs.xhr:1\|buserMedia:1\|bjs.battery:0"
.demdex.net/	1970-01-20 13:43:14	Name: demdex Value: 07357087537178398120383481460527332906
refinance.quickenloans.com/	1970-01-20 09:24:03	Name: _dd_s Value: rum=1&id=027c6d08-4a85-47ee-91fd-f9bbe709bf65&created=1675442937089&expire=1675443837089
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
.quickenloans.com/	1970-01-20 19:00:02	Name: _ga_WQ7TGZQSWQ Value: GS1.1.1675442937.1.0.1675442937.0.0.0
.quickenloans.com/	1970-01-20 19:00:02	Name: _ga Value: GA1.1.157014318.1675442937
.quickenloans.com/	1970-01-20 19:00:02	Name: mbox Value: session#a1d3ef55049f41d0831867d4dfe056de#1675444798\|PC#a1d3ef55049f41d0831867d4dfe056de.34_0#1738687738
refinance.quickenloans.com/	1970-01-20 09:34:07	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiMjc2NjllNzAtNzNmNy01NWM3LWI4YTMtMDFmMWM5Y2IyYjMyIiwidmlzaXRvcklkIjoiZDhjYTVhMzMtODJmMy00ZmRmLTk4YzgtM2JhNmUzMGY2NGViIiwic2Vzc2lvbklkIjoiYWY2NzQ1OGQtYTY4OC00MjEwLWExODMtYTNmMmMyM2U4MTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiI3MjIiLCJwa2V5MiI6IjQ0IiwicGtleTMiOiI3ZmI2NmQxNmVhMzY0ZThkYjJjMzA3NDM4OTg2MzBmNCIsInNvdXJjZUlkIjoibG1iLTU0ODY3LTExMzU4Mi03MjIiLCJzaWQiOiI5IiwiY21waWQiOiI5IiwiY3J0aWQiOiIiLCJvaWQiOiI5IiwiYWZmaWQiOiI3MjIiLCJfZWZfdHJhbnNhY3Rpb25faWQiOiI3ZmI2NmQxNmVhMzY0ZThkYjJjMzA3NDM4OTg2MzBmNCIsImFnZSI6bnVsbCwiZGV2aWNlIjpudWxsLCJmb3JjZU5hbWVzIjpudWxsLCJmb3JjZUlwIjpudWxsLCJmb3JjZVRlc3RJZHMiOm51bGwsImlucXVpcnlJZCI6bnVsbCwiaW5xdWlyeVNpZ25hdHVyZSI6bnVsbCwiaXNUZXN0IjpudWxsLCJsZXZlbE9mRWR1Y2F0aW9uIjpudWxsLCJtb2lkIjpudWxsLCJwcm9wZXJ0eVN0YXRlQ29kZSI6bnVsbCwicmVzb2x1dGlvbiI6IiIsInR0VHJhY2VJZCI6bnVsbCwicHJvdmlkZXJJZCI6bnVsbCwicWxzIjpudWxsLCJzdGlkIjpudWxsLCJvdmtleSI6bnVsbCwib3ZyYXciOm51bGwsIm92bXRjIjpudWxsLCJtb3J0Z2FnZUJhbGFuY2VSYW5nZSI6bnVsbCwiZGF0ZU5vdyI6MTY3NTQ0MjkzNzA1OSwicmFuZG9tTnVtYmVyIjo2Mzc5LCJtYXJrZXRpbmdPZmZlcklkIjpudWxsLCJ0aW1lT25Gb3JtU3RhcnRUaW1lIjoiMjAyMy0wMi0wM1QxNjo0ODo1Ny4xNjBaIiwib3JpZ2luUmVxdWVzdGVkVXJpIjoiaHR0cHM6Ly9yZWZpbmFuY2UucXVpY2tlbmxvYW5zLmNvbSIsInByZXNlbnRhdGlvbk5hbWUiOiIyODMyNDkzX01TUUxfTFJFX0xQX0NPTlRST0xfMDktMTQtMjIiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vcmVmaW5hbmNlLnF1aWNrZW5sb2Fucy5jb20vP3BrZXkxPTcyMiZwa2V5Mj00NCZwa2V5Mz03ZmI2NmQxNmVhMzY0ZThkYjJjMzA3NDM4OTg2MzBmNCZzb3VyY2VpZD1sbWItNTQ4NjctMTEzNTgyLTcyMiZzaWQ9OSZjbXBpZD05JmNydGlkPSZvaWQ9OSZhZmZpZD03MjImX2VmX3RyYW5zYWN0aW9uX2lkPTdmYjY2ZDE2ZWEzNjRlOGRiMmMzMDc0Mzg5ODYzMGY0IiwidmVydGljYWxOYW1lIjoiTVNRTF9MUkVfTEFORElORyIsInJlZmVycmluZ1VyaSI6IiIsImZsb3dJZCI6Ik1TUUxfTFJFX0xBTkRJTkdfVkVSVElDQUxfRkxPV18xIiwidGVzdElkIjoyMTEwMTg0LCJkYVZhbCI6InNqcy53ZWJHbFJlbmRlcmVyOkludGVsIElyaXMgT3BlbkdMIEVuZ2luZXxianMuYWNjZXNzRG9tOjF8YmNvb2tpZVN1cHBvcnQ6MXxiY3NzLmFuaW1hdGlvbnM6MXxiY3NzLmNvbHVtbnM6MXxiY3NzLnRyYW5zZm9ybXM6MXxiY3NzLnRyYW5zaXRpb25zOjF8c2RldmljZVBpeGVsUmF0aW86MXxpZGlzcGxheUNvbG9yRGVwdGg6MjR8YmZsYXNoQ2FwYWJsZTowfGJodG1sLmF1ZGlvOjF8Ymh0bWwuY2FudmFzOjF8Ymh0bWwuaW5saW5lc3ZnOjF8Ymh0bWwuc3ZnOjF8Ymh0bWwudmlkZW86MXxianMuYXBwbGljYXRpb25DYWNoZTowfGJqcy5kZXZpY2VNb3Rpb246MXxianMuZGV2aWNlT3JpZW50YXRpb246MHxianMuZ2VvTG9jYXRpb246MXxianMuaW5kZXhlZERCOjF8YmpzLmpzb246MXxianMubG9jYWxTdG9yYWdlOjF8YmpzLm1vZGlmeUNzczoxfGJqcy5tb2RpZnlEb206MXxianMucXVlcnlTZWxlY3RvcjoxfGJqcy5zZXNzaW9uU3RvcmFnZToxfGJqcy5zdXBwb3J0QmFzaWNKYXZhU2NyaXB0OjF8YmpzLnN1cHBvcnRDb25zb2xlTG9nOjF8YmpzLnN1cHBvcnRFdmVudExpc3RlbmVyOjF8YmpzLnN1cHBvcnRFdmVudHM6MXxianMudG91Y2hFdmVudHM6MHxianMud2ViR2w6MXxianMud2ViU29ja2V0czoxfGJqcy53ZWJTcWxEYXRhYmFzZTowfGJqcy53ZWJXb3JrZXJzOjF8YmpzLnhocjoxfGJ1c2VyTWVkaWE6MXxianMuYmF0dGVyeTowIiwiZGFWZXIiOiIxLjYiLCJjbGllbnRJcEFkZHJlc3MiOiIyNjAyOmZmYzg6MjoxMDQ6OjQiLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA5LjAuNTQxNC4xMTkgU2FmYXJpLzUzNy4zNiIsImJvdCI6ZmFsc2UsImlhdCI6MTY3NTQ0MjkzN30.LNyYLqUsiwWTrLtUflFW7EMPa45V7dclkt8NtpVH6SJx-h6BsdazxhsZalt13WnBgujSj8FC_qZ6jiLoQGvC_P0IDmlIX21fJyJwxhFdJYa12NXBxA2BxmptJE-8Qqqp4WTkhgnXiU4pXU2R5grLfbaGIj4Q2EDBdxlurabJm18
.dpm.demdex.net/	1970-01-20 13:43:14	Name: dpm Value: 07357087537178398120383481460527332906
.agkn.com/	1970-01-20 18:09:38	Name: ab Value: 0001%3Amj%2BXsndms8FtWdg%2FUBsD5FHs7z2ha29C
.quickenloans.com/	1970-01-20 19:00:02	Name: s_ecid Value: MCMID%7C07547164962540101240368995872409369314
.quickenloans.com/	1970-01-20 11:33:38	Name: _gcl_au Value: 1.1.1059571899.1675442938
.amazon-adsystem.com/	1970-01-20 15:09:38	Name: ad-id Value: A5gVqLTK0Ef3pbhnvRGZUVE
.amazon-adsystem.com/	1970-01-20 19:00:02	Name: ad-privacy Value: 0
.everesttech.net/	1970-01-20 18:09:38	Name: everest_g_v2 Value: g_surferid~Y906@QAAAQ1yG16a
.everesttech.net/	1969-12-31 23:59:59	Name: everest_session_v2 Value: Y906@QAAAQ1yG16a
.quickenloans.com/	1970-01-20 19:00:02	Name: s_v12 Value: 1675442937669
.quickenloans.com/	1970-01-20 09:24:04	Name: s_v12_s Value: First%20Visit
.quickenloans.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.quickenloans.com/	1970-01-20 19:00:02	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19392%7CMCMID%7C07547164962540101240368995872409369314%7CMCAAMLH-1676047737%7C7%7CMCAAMB-1676047737%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1675450137s%7CNONE%7CMCSYNCSOP%7C411-19399%7CMCAID%7CNONE%7CMCCIDH%7C1350442603%7CvVersion%7C5.4.0
.refinance.quickenloans.com/	1969-12-31 23:59:59	Name: Value: GA1.3.157014318.1675442937
.refinance.quickenloans.com/	1970-01-20 09:25:29	Name: _gid Value: GA1.3.772727732.1675442938
.refinance.quickenloans.com/	1970-01-20 09:24:02	Name: _gat_gtag_UA_3849768_74 Value: 1
.doubleclick.net/	1970-01-20 19:00:02	Name: IDE Value: AHWqTUmbXWt0DFK2x3-ua9NHzSIYqB7MAr3b9rpgbr9B0CUP6lLBADx9JQfpdNk6
.everesttech.net/	1970-01-20 10:08:41	Name: ev_sync_ax Value: 20230203
.mathtag.com/	1970-01-20 18:49:58	Name: uuid Value: c81363dd-3afa-4900-8776-fdfdf83ee6c1
.mortgage.quickenloans.com/	1970-01-20 09:24:04	Name: __cf_bm Value: WdtUXwB52p4Gq9fvHKb9EHu8.XD_s7ozOC8xLHemSmM-1675442938-0-AdwBrL1KRBEzSRBpur4A98xliEkWokiqy6hq9UyW29sWNuQtCGWNZKehEQJ6BgtynGlyVBiZ8OiLSViTT6ywfDU=
.quickenloans.com/	1970-01-20 11:33:38	Name: _rdt_uuid Value: 1675442938490.5b98c3ba-0b9b-4ce5-82b4-188689e9a09d
.quickenloans.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .quickenloans.com
.quickenloans.com/	1970-01-20 19:00:02	Name: _lc2_fpi Value: ddc3c751f117--01grc2wrma76ds8ph7mkdyfykn
.quickenloans.com/	1969-12-31 23:59:59	Name: _schn Value: _1814e3
.quickenloans.com/	1970-01-20 18:53:49	Name: _scid Value: de44ef84-782a-4c40-b3e5-66113c64a08f
.pmsrv.co/	1970-01-20 11:35:26	Name: _pmedia_opt-out Value: 1
.everesttech.net/	1970-01-20 10:08:41	Name: ev_sync_yh Value: 20230203
.revjet.com/	1970-01-20 19:00:02	Name: trx Value: 5218273415507370733
.taboola.com/	1970-01-20 18:09:38	Name: t_gid Value: 1fc030ed-f082-48d0-b778-e64c510b9a0e-tuctad6c07a
.mathtag.com/	1970-01-20 10:07:14	Name: mt_misc Value: mt_bt:1
.liadm.com/	1970-01-20 19:00:02	Name: lidid Value: be1e9850-d68f-46ef-8f67-939f9cf0ef99
.quickenloans.com/	1970-01-20 11:33:38	Name: _fbp Value: fb.1.1675442938798.1563044118
www.lmbahsj2.com/	1970-01-20 09:25:29	Name: uniqueClick Value: 1fcfec13-db8a-45a4-a493-673fbf971845:1675442938
.quickenloans.com/	1970-01-20 10:07:14	Name: ef_tid_c_o_9 Value: 7fb66d16ea364e8db2c30743898630f4
.quickenloans.com/	1970-01-20 10:07:14	Name: ef_tid_c_a_1 Value: 7fb66d16ea364e8db2c30743898630f4
.yahoo.com/	1970-01-20 18:10:00	Name: A3 Value: d=AQABBPo63WMCEK7S4ejoKFb7C7JbUhdQlvMFEgEBAQGM3mPnYwAAAAAA_eMAAA&S=AQAAAsGxLUooAPtDv8V2zYqD-KE
.refinance.quickenloans.com/	1970-01-20 18:09:38	Name: _pin_unauth Value: dWlkPVlUazNZVEZoT1dFdE56bG1NaTAwT1dJM0xUbGlZakF0WXpZeFkyTTRaamRtTm1ReQ
.rubiconproject.com/	1970-01-20 18:09:38	Name: khaos Value: LDORGTJH-1S-8JDI
.rubiconproject.com/	1970-01-20 18:09:38	Name: audit Value: 1\|xa6tI4hFFcVfMTrPGAENIoD7yReyEidBpCWPyNaonhOWLqPAUZ8eGF/HV4P0Dr9jxILji1onWBkwHTRO1/p4iM1d+xr7gW6vRTjahTvbHTFPdLGFpjP+GOBL61wH81WBca9/5gkgnIitAOTmjEas6/WQzJBJR0DUpRuCy0WrP/0=
.casalemedia.com/	1970-01-20 18:09:38	Name: CMID Value: Y906.8N2fY6lwpk0E.qmDgAA
.casalemedia.com/	1970-01-20 11:33:38	Name: CMPS Value: 1244
.casalemedia.com/	1970-01-20 11:33:38	Name: CMPRO Value: 1244
.adnxs.com/	1970-01-20 11:33:38	Name: uuid2 Value: 1121011217878424927
.adnxs.com/	1970-01-20 11:33:38	Name: anj Value: dTM7k!M4.FErk#WF']wIg2In?tzp%5!]tbPl1MwL(!R7qUY'DGN]NqzYWHAqDEYX3Ajed$^D%Jx<QG=%9sk?bIRwi:w9Ld1_NfoO17Mco/y@Yw#ttf=*v3NJ
.openx.net/	1970-01-20 18:09:38	Name: i Value: 5138d3ad-6941-4442-9433-c8139076e995\|1675442939
.pubmatic.com/	1970-01-20 11:33:38	Name: KRTBCOOKIE_218 Value: 4056-Y906@QAAAQ1yG16a&KRTB&22978-Y906@QAAAQ1yG16a&KRTB&23194-Y906@QAAAQ1yG16a&KRTB&23209-Y906@QAAAQ1yG16a
.pubmatic.com/	1970-01-20 10:07:14	Name: PugT Value: 1675442938
.demdex.net/	1970-01-20 13:43:14	Name: dextp Value: 21-1-1675442937335\|771-1-1675442937527\|1083-1-1675442937680\|1085-1-1675442937781\|1086-1-1675442937882\|1087-1-1675442937982\|1088-1-1675442938153\|19913-1-1675442938343\|83349-1-1675442938588\|144230-1-1675442938736\|144231-1-1675442938838\|144232-1-1675442938939\|144233-1-1675442939040\|144234-1-1675442939141\|144235-1-1675442939242\|144236-1-1675442939343\|144237-1-1675442939444
.spotxchange.com/	1970-01-20 10:04:22	Name: audience Value: a8010fe6-a3e2-11ed-9b40-19b3ac430103
.refinance.quickenloans.com/	1970-01-20 09:24:04	Name: __cf_bm Value: 7SSwvRJHYSDKvrdC2.kyHxDz4WDYDEXzhP8l04EUJjM-1675442939-0-AbB2f1B/ZIwqUeXhBARIVe9dBCy1OayEcjSkN8h323YFukY70dzylZcfUloAV8mZDeexjdpEqIkNF7LWLQZLtbQ=

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: https://refinance.quickenloans.com/?pkey1=722&pkey2=44&pkey3=7fb66d16ea364e8db2c30743898630f4&sourceid=lmb-54867-113582-722&sid=9&cmpid=9&crtid=&oid=9&affid=722&_ef_transaction_id=7fb66d16ea364e8db2c30743898630f4 Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
ad.doubleclick.net
ads.revjet.com
ads.yahoo.com
adservice.google.com
alb.reddit.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cdn1.decide.dev
cdn1.lockerdomecdn.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
content.lowermybills.com
content.refinance.quickenloans.com
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
echo4.bluehornet.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
pix.revjet.com
pixel.everesttech.net
pixel.mathtag.com
pixel.rubiconproject.com
pixel1083.everesttech.net
psp.pushnami.com
quicken.demdex.net
quickenloans.tt.omtrdc.net
refinance.quickenloans.com
rp.liadm.com
rp4.liadm.com
rum-http-intake.logs.datadoghq.com
s.amazon-adsystem.com
s.pinimg.com
s.yimg.com
sc-static.net
sgtm.lowermybills.com
somni.quickenloans.com
sp.analytics.yahoo.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
sync-tm.everesttech.net
sync.search.spotxchange.com
tr4ckme.com
trackpixel.refinance.quickenloans.com
trc.pushnami.com
trc.taboola.com
us-u.openx.net
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
www.redditstatic.com
108.138.113.246
13.225.214.12
13.225.224.171
135.148.150.48
142.250.65.162
142.250.65.166
142.251.40.226
151.101.1.44
151.101.129.140
151.101.130.49
151.139.128.10
162.248.18.37
18.161.21.58
18.161.34.83
192.35.249.138
192.40.39.223
2001:4860:4802:36::15
2001:4998:1c:800::1000
23.197.32.188
23.200.196.208
2600:1400:d:5a5::1e80
2600:141b:7000:692::1931
2600:1f18:24e6:b901:fb77:f01:241a:594c
2600:1f18:730:b140:7681:9678:781c:27c9
2600:9000:23cb:5a00:8:8845:1500:93a1
2600:9000:24eb:3600:a:8e7d:9900:93a1
2606:4700:4400::6812:2021
2606:4700:4400::6812:246e
2606:4700:4400::ac40:98bb
2606:4700:4400::ac40:9bdf
2606:4700::6810:3865
2607:f8b0:4006:807::2003
2607:f8b0:4006:80d::2002
2607:f8b0:4006:80f::200e
2607:f8b0:4006:816::2002
2607:f8b0:4006:81c::2004
2607:f8b0:4006:81c::200a
2607:f8b0:4006:820::2008
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42:600::396
3.216.213.114
34.193.165.73
34.193.23.165
34.230.132.105
34.233.25.80
35.162.23.149
35.201.76.131
35.244.159.8
44.210.217.65
52.46.143.56
52.5.63.122
52.89.136.182
54.85.168.187
63.140.36.121
68.67.160.137
74.217.31.245
76.13.32.146
8.43.72.98
0093220d4c1b5e63d15fb4e0086a3f1a5e352c183335c5ec2b26dc0397804b65
0418770bab41d98ca97ea53ee7fd49f55b8cab0cd52634340b9a15a2a06a94fe
048b68880387d7af19b7e60d4f151cb4f09f6e9954e0da8478b1d484e38449b2
0716b77ae94ad392bc3fd022273e0ac439b06162405ca061e08d6da5b3eb1bba
0a469b0ce3a0aef7d2e834bdf52ddaf37f2f80ee043874da8701747f9e5d3e5c
0ad482ec4a0543bc2039f03bff3d56cf8ec7a6bb73b68ce920e6acdbceefe727
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0b914b8cf2f12a331cfbfc20fbf94c6017c707ba81e21dafdbefc92c94355d58
0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d
0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3
0f9fa930b391cfbd4ed64d394a8d118e26d6180bf435e3bc162479f6025adec5
19094c592aeeebae116447ed13c90636e41825350032b21a7c4e8eb202d448bc
1b0d7b4d07edcf9646c37389987b88701d3c117ce6694a9ade4387eefe1c8241
1f32dd832efef60f0f67a8d4059f49370afa4c06e5ea1f02e12d020bc524f43d
1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532
23ec0f6fbb6ebcaa01534849617d1879be68ab1bb399c0689480369aa23983b2
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
2d5373f1af87557cdcbe602281c46c66b59734e927716aaa33f6cd17aabed1c1
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
307fb73d0dba9ca102686fc6d891eea87e46371e03d6bf2aabfdb8bed4b68f8e
33024d4c4fb42360df1d0518b959c8efbe9647c0b0fb798dc16066af2f8dfe5c
346b201c23d955268360c48581503142377f7dd45f922a9e4a13e304ef6b97e4
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
3a541998b9c385a9e7c8aa59980b151070459d8fd8f1dc4a5f469cd1d57d43d2
3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae
3ef64e4a0001cd55211fff6bd306290f29c7482a6006d070ee21e52484b7ef22
4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
4741eb8666b071a5713d221d02b247e3bc29270e1aad907a0bbae392ad9d2bef
4999dc924f15440930503fb99bc5fef53a2a317b173b033ee44aec3760717e9f
4b01f9a7a6886d1fa34e50af146b0c0df3e7582547121f00f307afd7766b5d54
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4cd749cb1a66ca42afac2d38a803da602eef0619f6a9efba23a8ab454226575e
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
538031f84c7b144493c7d8e7d1e481225a772b76b5993f3f7e88f0470951f36e
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5849e07d0d6cbb144829b98da75fda4a8eb3fc2b5749d48cc94bb170db54859a
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
59d77d6ec839482406c58678ddf9a96bcad7d0c1953916670b01b21bc7d3f764
5e1ac89bc27498e96d508a6b08f21fbdca2b4105aa138506e0f476c62931e37b
60f53fa9f3bd1e5f4dac4f0130c296dd932a57e909c0eac77ffb58746d476f33
625e7ba89e6ca1f0f26e68246e3ddc0d549392bac4a1da01d61e4e267d9adc7b
63b2f0b99fea462c96bdb35799e62b4cb534a14b09ee95c6632a7828959e63eb
68067c289ecbd54461eb9d4774f4040628e6dfe6e09e4458de962540c316bd0b
68f274e5330a1431b6e07a6a979209097633d713576cf9620bee34a6bd898ad7
6e7636bca175866a71beb0256f9b762ad9caec95e2c3e26c175386fa37aeaac2
6eceb1f0125e55dc7051adfec1166348ae06593aefa875aa9f835c5eabe5fd34
75125501d9e16f957cb03fafafede95dea7c5e935aa48670938d6ac3776d20ea
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
7a3bcc4ea246253c762bbf4df2af7be93a663ec62af9fea8188e9c8a7f8b8c6e
7a6cf3b6daf39a9b2f236a2b3449bc004378762c6ddc1fc09c98673ad247a691
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9
86ffe14d6f7df5d0924cbee4edcee2b71078b000d46e1540a8fa9cca9a6817fb
8bb2d616aa69bc3bdfdd1b2763a542d294f0f35a97fcf90295fcfdbc95230758
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
91ae255b347f3c230cb350e9c018242056b4c0233a1128e85024641ded5ad6e0
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a1153dbbaba0a81114b0fe03ce2b1c4ee67b79536c2570b738d3ec4c42d257b1
a2fc9d032af13dc22fedca605e9ff0c7617fd6c2a99d6f5e91c07d9362adaa5d
a51a0a22a2fe997b8453a36cd724a706d3ec1d77476ff8c2b247661caa78f865
ab8140419c7b5be781790bfc0835bebbe09c8ee3edeb6f1bda347bda8a457ecd
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05
b04e372caa56937a9f6d8a956ab927b472e988513e727f33d67b6afb05906fe1
b12371694a492579998ee3e382e63bcf34680a0d9658541a01f1e5d005714b95
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6a58f3f46a612b869fd36905173622fc8d2e556d26ea534da090e2ab269fbd4
b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be
bd657684891d2f2479201aeb49e84cb4e8b85df88a633fb66a83b8676d60b6db
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
cbd776702975c01e9074609608a5734125e6e41e2f0061428ba8f2099ac537ff
cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a
cf4dde90e0a02ba859cc1d415fcb3d74dac6bc276ca9a1b7144873a75b18a6eb
d1312d710a6a3874e823702a5fd44c5213a0a60cc166060c58d8326d34c9020e
d238d36e878d9841bd0cb36cf028341e2007081c5df833549f47b4c4a4487ec6
d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321
d435b2ebd079098fab15da7103b567f361674ea89d070cdf6c006a4e6243b909
d60aa838e099599b51126886e7fa0334ad2022c7b4f76977c86f45463b55bfe9
d623468cf1b8285b10c533f193be0c27ffbdb4feacd3256e488121fde7bb902f
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
dbe0bf1b9db8912770e849b979650a616b44dc78930290df944591d75d292a08
de1b34b4d5a451c2e53967cef8b5904da16872b52b61bad46b6c0ec769fcdcce
de9462e351a7c74cd76bf432a62faf0dbf0b068beeb7a16c83eac6728956b7f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c
e98aa993d60d3fc596be07347a1dd0b6f65aa00823ba761bfcadc72ca92b87e7
e9a79241a4dac3cc8a78fe0208acf9ec9b02858f095f55f5538c06a9251dda16
ec5c91e9e19c7feb3b9697d1479972a1f316d01c0d11b926ea8b948ebf8eba5b
ed49359dd841f7601fbe26fa64ecfbe97a4ad9468732cd9a0266527d610a8331
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0
f20db67a81d317ed8300a06fc25097344fe99726b67db360c680b760ef02a2d4
f3496bc7c277d917d35553c46ed1597a86065494cac582e42a3a1d55aedef7fb
f3e9287e2c3b20f9f8d9afb0c8117d6a3cec13f3b8587f362dc5476ed1eedaad
fa42d02480f27fd0a8768e025d5033abf291c0df6391f25074faf80fa58c422c
fdf85d7c2572c064d848fd3ee3be8d0c0aa6bb5afb9e39dbcf52c41a0147c7e7

refinance.quickenloans.com Open in urlscan Pro 2606:4700:4400::6812:2021 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

158 Requests

83 %HTTPS

39 %IPv6

45 Domains

65 Subdomains

53 IPs

2 Countries

1887 kBTransfer

5294 kBSize

68 Cookies

18 Outgoing links

Page URL History

Redirected requests

158 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::6812:2021 Public Scan

Screenshot
Live screenshot

Full Image

158
Requests

83 %
HTTPS

39 %
IPv6

45
Domains

65
Subdomains

53
IPs

2
Countries

1887 kB
Transfer

5294 kB
Size

68
Cookies

158 HTTP transactions
0 data transactions