www.refiadvantageexperts.com Open in urlscan Pro
18.188.52.203 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://app.bronto.com/t/l?ssid=43791&subscriber_id=ajruyncbigvnvohdizmwgwtqxcjubkk&delivery_id=btiawdvkzoglijrjvncfabz...
Effective URL:
https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&...
Submission: On May 31 via manual (May 31st 2022, 9:57:41 pm UTC) from US — Scanned from DE

Summary HTTP 43 Redirects Behaviour Indicators

Summary

This website contacted 17 IPs in 3 countries across 18 domains to perform 43 HTTP transactions. The main IP is 18.188.52.203, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is www.refiadvantageexperts.com.
TLS certificate: Issued by R3 on May 9th 2022. Valid for: 3 months.

This is the only time www.refiadvantageexperts.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	216.27.63.20 216.27.63.20	7349 (AS-TIERP-...) (AS-TIERP-7349)
1 1	23.92.19.76 23.92.19.76	63949 (LINODE-AP...) (LINODE-AP Linode)
2 2	52.43.54.228 52.43.54.228	16509 (AMAZON-02) (AMAZON-02)
1 15	18.188.52.203 18.188.52.203	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
1	65.9.63.33 65.9.63.33	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::ac43:29e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
2	108.61.229.128 108.61.229.128	20473 (AS-CHOOPA) (AS-CHOOPA)
1	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	99.86.4.6 99.86.4.6	16509 (AMAZON-02) (AMAZON-02)
1	143.204.215.118 143.204.215.118	16509 (AMAZON-02) (AMAZON-02)
1	52.51.233.122 52.51.233.122	16509 (AMAZON-02) (AMAZON-02)
1	65.9.63.123 65.9.63.123	16509 (AMAZON-02) (AMAZON-02)
8	54.172.138.183 54.172.138.183	14618 (AMAZON-AES) (AMAZON-AES)
1	13.32.23.225 13.32.23.225	16509 (AMAZON-02) (AMAZON-02)
1	18.215.96.230 18.215.96.230	14618 (AMAZON-AES) (AMAZON-AES)
43	17

1 216.27.63.20 (Raleigh, United States) 1 redirects

ASN7349 (AS-TIERP-7349, US)
PTR: bronto.com

app.bronto.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.92.19.76 (Cedar Knolls, United States) 1 redirects

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li644-76.members.linode.com

www.sjejhhhe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.43.54.228 (Boardman, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-43-54-228.us-west-2.compute.amazonaws.com

corlnk1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cormain1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 18.188.52.203 (Columbus, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-188-52-203.us-east-2.compute.amazonaws.com

www.refiadvantageexperts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.63.33 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-63-33.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:29e5 (United States)

ASN13335 (CLOUDFLARENET, US)

create.lidstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.61.229.128 (Elk Grove Village, United States)

ASN20473 (AS-CHOOPA, US)
PTR: 108.61.229.128.vultrusercontent.com

zip.getziptastic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-6.fra6.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.215.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-118.fra53.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.51.233.122 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-233-122.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.63.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-63-123.fra56.r.cloudfront.net

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.172.138.183 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-138-183.compute-1.amazonaws.com

create.leadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.23.225 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-23-225.fra56.r.cloudfront.net

d2m2wsoho8qq12.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.215.96.230 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-215-96-230.compute-1.amazonaws.com

deviceid.trueleadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	refiadvantageexperts.com 1 redirects www.refiadvantageexperts.com	535 KB
8	leadid.com create.leadid.com — Cisco Umbrella Rank: 12593	5 KB
6	gstatic.com fonts.gstatic.com	102 KB
4	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 584 script.hotjar.com — Cisco Umbrella Rank: 713 vars.hotjar.com — Cisco Umbrella Rank: 832 in.hotjar.com — Cisco Umbrella Rank: 1585	67 KB
2	getziptastic.com zip.getziptastic.com — Cisco Umbrella Rank: 524686	725 B
1	trueleadid.com deviceid.trueleadid.com — Cisco Umbrella Rank: 2558	2 KB
1	cloudfront.net d2m2wsoho8qq12.cloudfront.net	2 KB
1	hotjar.io vc.hotjar.io — Cisco Umbrella Rank: 2056	257 B
1	google.de www.google.de — Cisco Umbrella Rank: 6117	548 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	548 B
1	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 40	2 KB
1	lidstatic.com create.lidstatic.com — Cisco Umbrella Rank: 22401	39 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 114	17 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 42	1 KB
1	cormain1.com 1 redirects cormain1.com	816 B
1	corlnk1.com 1 redirects corlnk1.com	435 B
1	sjejhhhe.com 1 redirects www.sjejhhhe.com	493 B
1	bronto.com 1 redirects app.bronto.com — Cisco Umbrella Rank: 107101	1 KB
43	18

	Domain	Requested by
15	www.refiadvantageexperts.com	1 redirects www.refiadvantageexperts.com
8	create.leadid.com	create.lidstatic.com deviceid.trueleadid.com
6	fonts.gstatic.com	fonts.googleapis.com
2	zip.getziptastic.com	www.refiadvantageexperts.com
1	deviceid.trueleadid.com	d2m2wsoho8qq12.cloudfront.net
1	d2m2wsoho8qq12.cloudfront.net	create.lidstatic.com
1	vc.hotjar.io	script.hotjar.com
1	in.hotjar.com	script.hotjar.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	www.google.de	www.refiadvantageexperts.com
1	www.google.com	www.refiadvantageexperts.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	create.lidstatic.com	www.refiadvantageexperts.com
1	static.hotjar.com	www.refiadvantageexperts.com
1	www.googleadservices.com	www.refiadvantageexperts.com
1	fonts.googleapis.com	www.refiadvantageexperts.com
1	cormain1.com	1 redirects
1	corlnk1.com	1 redirects
1	www.sjejhhhe.com	1 redirects
1	app.bronto.com	1 redirects
43	21

This site contains no links.

Subject Issuer	Validity	Valid
www.refiadvantageexperts.com R3	`2022-05-09` - `2022-08-07`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.hotjar.com Amazon	`2021-11-25` - `2022-12-23`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
lidstatic.com Cloudflare Inc ECC CA-3	`2022-03-30` - `2023-03-30`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
getziptastic.com R3	`2022-04-27` - `2022-07-26`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.hotjar.io Amazon	`2021-08-17` - `2022-09-15`	a year	crt.sh
create.leadid.com Amazon	`2021-10-22` - `2022-11-19`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
deviceid.trueleadid.com Amazon	`2022-01-07` - `2023-02-05`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Frame ID: D09A8B7C755CFA1EB8A6272EE4994BB6
Requests: 38 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-63c3a81830bf549dafe40b369003f751.html
Frame ID: 3AC33E481979C76C9F6EC54B3104ED7A
Requests: 1 HTTP requests in this frame

Frame: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=C37BC821-D60A-C891-DFF7-E343A5714FAA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=EA857B2C-FE7E-12EA-8BBD-CA6BA300C2D6&lac=A7EE6729-C0D4-2BB9-A8DE-6E48402F074A
Frame ID: 4F83461925170D2FC3C13EBA619209C8
Requests: 1 HTTP requests in this frame

Frame: https://deviceid.trueleadid.com/iframe.html?token=C37BC821-D60A-C891-DFF7-E343A5714FAA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=EA857B2C-FE7E-12EA-8BBD-CA6BA300C2D6&lac=A7EE6729-C0D4-2BB9-A8DE-6E48402F074A
Frame ID: 9906D453E55F8F289424CAD033F6CF28
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Refi Advantage Experts

Page URL History Show full URLs

http://app.bronto.com/t/l?ssid=43791&subscriber_id=ajruyncbigvnvohdizmwgwtqxcjubkk&delivery_id=bti... HTTP 307
https://www.sjejhhhe.com/rd/r.php?sid=7830&pub=460632&c1=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MA... HTTP 302
https://corlnk1.com/?a=3&c=37&s1=460632&s2=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MAY22_3_8ka... HTTP 302
https://cormain1.com/?a=3&c=37&s1=460632&s2=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MAY22_3_8ka... HTTP 302
http://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname... HTTP 301
https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

43
Requests

100 %
HTTPS

30 %
IPv6

18
Domains

21
Subdomains

17
IPs

3
Countries

773 kB
Transfer

1066 kB
Size

16
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://app.bronto.com/t/l?ssid=43791&subscriber_id=ajruyncbigvnvohdizmwgwtqxcjubkk&delivery_id=btiawdvkzoglijrjvncfabzrkhajbpc&td=S4vFpshg4LIWmy_USGgnhAjL-ODiMfJvYVm2EQSQAL5brm3ak7OznjpEg6-T3sUQ2Rm8UMzhYDzNyOXrtfp4r1VLHeiYAgPfKRwSi-3UfWIuWYk7u1bCHx_9pi88jTpRe1sJH-uitV9x-1Sah50cdIgJ6nIjXBXNfaBZf1KZYM7XNxRXvrduYusOukAeMluR_4oApWGyX4lUfRabt2_eeANSK5yfemSa3mVZt07zWyWRoDpQjstDCuxG24vB4mtu4jdmqFGfoe66GdvtSZ609EDX9qQSDS4-a9 HTTP 307
https://www.sjejhhhe.com/rd/r.php?sid=7830&pub=460632&c1=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MAY22_3_8kaKcCHt&first_name=John&last_name=Horn&email=jhorn@firstenergycorp.com&city=YORK&state=PA&zip=17402&gender=&age=&phone_number=&_bta_tid=03022072531401955360218257562462641122262907762661458401645333533179226290737379641776852375507076159408648 HTTP 302
https://corlnk1.com/?a=3&c=37&s1=460632&s2=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MAY22_3_8kaKcCHt&s3=1162441197&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA HTTP 302
https://cormain1.com/?a=3&c=37&s1=460632&s2=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MAY22_3_8kaKcCHt&s3=1162441197&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA&ckmguid=800d21db-f48d-49e8-b2c1-c6c33149666a HTTP 302
http://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA HTTP 301
https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

43 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.refiadvantageexperts.com/
Redirect Chain

http://app.bronto.com/t/l?ssid=43791&subscriber_id=ajruyncbigvnvohdizmwgwtqxcjubkk&delivery_id=btiawdvkzoglijrjvncfabzrkhajbpc&td=S4vFpshg4LIWmy_USGgnhAjL-ODiMfJvYVm2EQSQAL5brm3ak7OznjpEg6-T3sUQ2Rm...
https://www.sjejhhhe.com/rd/r.php?sid=7830&pub=460632&c1=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MAY22_3_8kaKcCHt&first_name=John&last_name=Horn&email=jhorn@firstenergycorp.com&city=YORK&state=PA...
https://corlnk1.com/?a=3&c=37&s1=460632&s2=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MAY22_3_8kaKcCHt&s3=1162441197&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=1740...
https://cormain1.com/?a=3&c=37&s1=460632&s2=BR_FA1_460632_1014694_PMG.RF_O30_7830_2_31MAY22_3_8kaKcCHt&s3=1162441197&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=174...
http://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA

50 KB
50 KB

518ms
259ms

Document
text/html

18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 / PHP/5.6.40
Resource Hash: a48b167c5fbf0ac5cb7f6ab86a43bcef4ff7a7a82c8962f042cb9aefc3e208c5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate post-check=0, pre-check=0
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 31 May 2022 21:57:34 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 31 May 2022 21:57:34 GMT
Pragma: no-cache
Server: nginx/1.16.1
Transfer-Encoding: chunked
X-Powered-By: PHP/5.6.40

Redirect headers

Connection: keep-alive
Content-Length: 169
Content-Type: text/html
Date: Tue, 31 May 2022 21:57:33 GMT
Location: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Server: nginx/1.16.1

GET
H2 200 css
fonts.googleapis.com/ 10 KB
1 KB 131ms
46ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Nunito+Sans:300,400,600,700,800,900

Requested by

Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

beb481550e37a74109253b7825c19b03e08a61174fb7d36357c7f5fe240b5f39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 31 May 2022 21:56:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 31 May 2022 21:57:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 31 May 2022 21:57:34 GMT

GET
H/1.1 200
OK price-range.css
www.refiadvantageexperts.com/css/ 1 KB
2 KB 249ms
127ms Stylesheet
text/css 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/css/price-range.css
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 347b17eb7f992f547da5e904b4a8408d3bdba87df4d1c3d8174ac3bbe8b33c61

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:34 GMT
Last-Modified: Tue, 23 Feb 2021 18:49:04 GMT
Server: nginx/1.16.1
ETag: "60354e20-5c0"
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1472
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK bootstrap.css
www.refiadvantageexperts.com/css/ 113 KB
113 KB 377ms
127ms Stylesheet
text/css 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/css/bootstrap.css
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 8a4c3338c3b0fb43648f886f8c30f5fa55b2136c1b02058ed3aa0c8f589996f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:34 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-1c270"
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 115312
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK style.css
www.refiadvantageexperts.com/css/ 10 KB
10 KB 382ms
127ms Stylesheet
text/css 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/css/style.css
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 85e4f547f27afbe08ad1d6d325707d420172402018c495fd9f1be197b0e9397d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:34 GMT
Last-Modified: Tue, 23 Feb 2021 18:49:04 GMT
Server: nginx/1.16.1
ETag: "60354e20-275b"
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10075
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery-1.11.2.min.js Show response
www.refiadvantageexperts.com/js/ 94 KB
94 KB 509ms
255ms Script
application/javascript 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/js/jquery-1.11.2.min.js
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:34 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-176bb"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 95931
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK parsley.js Show response
www.refiadvantageexperts.com/js/ 41 KB
41 KB 510ms
255ms Script
application/javascript 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/js/parsley.js
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 447d82e240dba8299b6fcf45ff12e15ee6409cde1dafdbbaa73bb848a591b834

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:34 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-a49e"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42142
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK mask.js Show response
www.refiadvantageexperts.com/js/ 6 KB
6 KB 382ms
128ms Script
application/javascript 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/js/mask.js
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: e0ef803f8bb9cbe07f2407212c2422f87d48dbd08addb5bb994c5f485b2dcc6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:34 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-1788"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6024
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK validation.js Show response
www.refiadvantageexperts.com/js/ 1 KB
1 KB 383ms
128ms Script
application/javascript 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/js/validation.js
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: c33681591a2f32579a18e32cd51b59c82de800c15ec6b84d0632ef82966a142d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:34 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-41c"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1052
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK dragger.js Show response
www.refiadvantageexperts.com/js/ 59 KB
60 KB 510ms
128ms Script
application/javascript 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/js/dragger.js
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 04a816686a31e05c5ef0ba9307dade292f5ef47dbec7e9a177dbb049748c9050

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:34 GMT
Last-Modified: Fri, 24 Sep 2021 21:09:41 GMT
Server: nginx/1.16.1
ETag: "614e3e95-ed2d"
Content-Type: application/javascript
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 60717
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK logo.png
www.refiadvantageexperts.com/images/ 7 KB
7 KB 128ms
127ms Image
image/png 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.refiadvantageexperts.com/images/logo.png
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: c99792f9bbdcbee55ee5b2a03cd03e704b8ae9cef5fe2b0b5cb20fee02976dc9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:35 GMT
Last-Modified: Tue, 23 Feb 2021 21:18:23 GMT
Server: nginx/1.16.1
ETag: "6035711f-1a93"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6803
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK bot-logo.png
www.refiadvantageexperts.com/images/ 8 KB
8 KB 127ms
127ms Image
image/png 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.refiadvantageexperts.com/images/bot-logo.png
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: d7f767f12ce56183819aad6a6d6a5b2d09ee0181437b85f12756131e4047ae96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:35 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-1e16"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7702
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 43 KB
17 KB 136ms
47ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

73c45566702f8e7cce5c32604d2d97dc5d7d7905678664d8080cfb3ac495fde4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 31 May 2022 21:57:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16776
x-xss-protection: 0
server: cafe
etag: 6865143739343241494
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 31 May 2022 21:57:35 GMT

GET
H2 200 hotjar-1654995.js Show response
static.hotjar.com/c/ 4 KB
2 KB 193ms
68ms Script
application/javascript 65.9.63.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1654995.js?sv=6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.63.33 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-9-63-33.fra56.r.cloudfront.net

Software

Resource Hash

35fee76e941f629df1868278044468e4b327d402515d122b2bcbf9eef7d53e9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 31 May 2022 21:57:35 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
x-amz-cf-pop: FRA56-C1
etag: W/5d95831971b3bd5bb7c60006c80b738b
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: uUSpiPCA7UXAxNYRdJNfiOwurm5b_Ew8nFChtSfQDYnRxrBf12mRHw==
via: 1.1 f2fa38e6635ded6d22a69d089217bc90.cloudfront.net (CloudFront)

GET
H/1.1 200
OK top-background.jpg
www.refiadvantageexperts.com/images/ 100 KB
101 KB 128ms
128ms Image
image/jpeg 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.refiadvantageexperts.com/images/top-background.jpg
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/css/style.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: be63c8cb7532bc98f93a5939f8ce661fe6a19bae906f1c513599e327017759f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:35 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-191cd"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 102861
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK downarrow.png
www.refiadvantageexperts.com/images/ 291 B
603 B 128ms
128ms Image
image/png 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.refiadvantageexperts.com/images/downarrow.png
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/css/style.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: b3104f98dbc82eaca38b5c3e2089fd8aeac5f938fc9cc1956b05bfeaac8a7e77

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:35 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-123"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 291
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 pe03MImSLYBIv1o4X1M8cc8WAc5tU1E.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 138ms
39ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8WAc5tU1E.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:300,400,600,700,800,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

976177894b0cca88ff93ab02c6da363f2d55cce5d940139db955b251fcdd19a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.refiadvantageexperts.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 13:27:04 GMT
x-content-type-options: nosniff
age: 117031
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16920
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:31:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 May 2023 13:27:04 GMT

GET
H2 200 pe03MImSLYBIv1o4X1M8cc8-BM5tU1E.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 149ms
50ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8-BM5tU1E.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:300,400,600,700,800,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00dd63b0ca2fb12eb12eef7af3f543b085cb1e94d1a861b484865c973b75e93e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.refiadvantageexperts.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 10:27:07 GMT
x-content-type-options: nosniff
age: 127828
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17364
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:32:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 May 2023 10:27:07 GMT

GET
H2 200 pe03MImSLYBIv1o4X1M8cc8aBc5tU1E.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 181ms
82ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8aBc5tU1E.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:300,400,600,700,800,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6fce8ebc3557b63496f8fafe1c182f2aa8669550f9398b4d9beebddd43306ed3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.refiadvantageexperts.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 16:45:07 GMT
x-content-type-options: nosniff
age: 105148
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17324
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:31:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 May 2023 16:45:07 GMT

GET
H2 200 pe03MImSLYBIv1o4X1M8cc8GBs5tU1E.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 206ms
108ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc8GBs5tU1E.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:300,400,600,700,800,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

280aaa8929329764ac3213ca093c63505cfcc665347939c79905c426d33867c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.refiadvantageexperts.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 15:04:56 GMT
x-content-type-options: nosniff
age: 111159
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17116
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:31:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 May 2023 15:04:56 GMT

GET
H2 200 pe03MImSLYBIv1o4X1M8cc9iB85tU1E.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 193ms
95ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe03MImSLYBIv1o4X1M8cc9iB85tU1E.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:300,400,600,700,800,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c84423c305779f2aab07847a2e3870ac1ea4072e470d5eb149c01e0e0497eae3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.refiadvantageexperts.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 21:51:18 GMT
x-content-type-options: nosniff
age: 86777
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17156
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:33:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 May 2023 21:51:18 GMT

GET
H2 200 pe0qMImSLYBIv1o4X1M8cce9I9s.woff2
fonts.gstatic.com/s/nunitosans/v12/ 17 KB
17 KB 213ms
116ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunitosans/v12/pe0qMImSLYBIv1o4X1M8cce9I9s.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Nunito+Sans:300,400,600,700,800,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97d5a594e7f76c7e50045b67667fd6b74b268515efe6425097be1b2647079787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.refiadvantageexperts.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 15:01:52 GMT
x-content-type-options: nosniff
age: 111343
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16980
x-xss-protection: 0
last-modified: Mon, 09 May 2022 18:33:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 May 2023 15:01:52 GMT

GET
H2 200 ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js Show response
create.lidstatic.com/campaign/ 123 KB
39 KB 531ms
439ms Script
text/javascript 2606:4700:10::ac43:29e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/?reqid=8763182&affid=3&city=YORK&email=jhorn%40firstenergycorp.com&firstname=John&lastname=Horn&zip=17402&phone=&state=PA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:29e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 285ac229a0db2272c7df4535ad5935d088e17030b0cc8cb27c2582f702a3b891

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 31 May 2022 21:57:35 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Fri, 12 Nov 2021 01:28:07 GMT
server: cloudflare
x-amz-request-id: 9Q9Q3P2S1CV7HH27
etag: W/"f9c39459b5885b04d6b6126f61a14f48"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=1800
x-amz-replication-status: COMPLETED
cf-ray: 7142f74fbdaa9072-FRA
x-amz-version-id: rcUesbRvnV30h9CZiaz6SHjgXZhF_YD4
x-amz-id-2: RZ5fLHhbWmE78wRHwJjrP+EqPjEPHi/1lo6Tgx6Dxl782MYF7/wnldNpruUwByXvsNUV6PJZ+n8=

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/805514038/ 2 KB
2 KB 133ms
50ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/805514038/?random=1654034255213&cv=9&fst=1654034255213&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.refiadvantageexperts.com%2F%3Freqid%3D8763182%26affid%3D3%26city%3DYORK%26email%3Djhorn%2540firstenergycorp.com%26firstname%3DJohn%26lastname%3DHorn%26zip%3D17402%26phone%3D%26state%3DPA&tiba=Refi%20Advantage%20Experts&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7029c163ebf0829db15c555d86f4bca84387ee693c08f052f9523856dadc375

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 May 2022 21:57:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1105
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H/1.1 200
OK 17402
zip.getziptastic.com/v3/US/ Frame 0
0 1045ms
136ms Preflight
text/html 108.61.229.128
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://zip.getziptastic.com/v3/US/17402?_=1654034255175
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.61.229.128 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 108.61.229.128.vultrusercontent.com
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-key
Access-Control-Request-Method: GET
Origin: https://www.refiadvantageexperts.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Access-Control-Allow-Headers: x-referrer, x-key, content-type
Access-Control-Allow-Methods: HEAD, OPTIONS, GET
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 21600
Allow: HEAD, OPTIONS, GET
Cache-Control: max-age=3600
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Tue, 31 May 2022 21:57:36 GMT
Expires: Tue, 31 May 2022 22:57:36 GMT
Server: nginx/1.10.3 (Ubuntu)

GET
H/1.1 200
OK ProximaNova-Regular.woff
www.refiadvantageexperts.com/fonts/ 40 KB
40 KB 256ms
255ms Font
font/woff 18.188.52.203
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.refiadvantageexperts.com/fonts/ProximaNova-Regular.woff
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/css/style.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.188.52.203 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-188-52-203.us-east-2.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 414dcbef0bb16dec697a3b07514cb19c26ba17755929a5427cb72cd1f0496b6e

Request headers

Referer: https://www.refiadvantageexperts.com/css/style.css
Origin: https://www.refiadvantageexperts.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:35 GMT
Last-Modified: Mon, 03 Jun 2019 23:16:36 GMT
Server: nginx/1.16.1
ETag: "5cf5aa54-a08c"
Content-Type: font/woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 41100

GET
H/1.1 200
OK 17402 Show response
zip.getziptastic.com/v3/US/ 225 B
725 B 138ms
138ms XHR
application/json 108.61.229.128
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://zip.getziptastic.com/v3/US/17402?_=1654034255175
Requested by: Host: www.refiadvantageexperts.com
URL: https://www.refiadvantageexperts.com/js/jquery-1.11.2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 108.61.229.128 Elk Grove Village, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 108.61.229.128.vultrusercontent.com
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 8a6c4bb148f4ce69a315a5bd696a3c82fce3bbbf9552ac3cd1c88bf070b27785

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.refiadvantageexperts.com/
x-key: 4cb55e88839b2e72ad9e6d9b55190b2f9a9375bd
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Tue, 31 May 2022 21:57:36 GMT
Server: nginx/1.10.3 (Ubuntu)
Access-Control-Max-Age: 21600
Access-Control-Allow-Methods: HEAD, OPTIONS, GET
Content-Type: application/json
Access-Control-Allow-Origin: *
X-RateLimit-Remaining: 10569.0
Cache-Control: max-age=3600
X-RateLimit-Reset: 1654041600
X-RateLimit-Limit: 12000.0
Connection: keep-alive
Access-Control-Allow-Headers: x-referrer, x-key, content-type
Content-Length: 225
Expires: Tue, 31 May 2022 22:57:36 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/805514038/ 42 B
548 B 133ms
49ms Image
image/gif 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/805514038/?random=1654034255213&cv=9&fst=1654030800000&num=1&guid=ON&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.refiadvantageexperts.com%2F%3Freqid%3D8763182%26affid%3D3%26city%3DYORK%26email%3Djhorn%2540firstenergycorp.com%26firstname%3DJohn%26lastname%3DHorn%26zip%3D17402%26phone%3D%26state%3DPA&tiba=Refi%20Advantage%20Experts&fmt=3&is_vtc=1&random=2861484041&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 May 2022 21:57:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/805514038/ 42 B
548 B 132ms
48ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/805514038/?random=1654034255213&cv=9&fst=1654030800000&num=1&guid=ON&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.refiadvantageexperts.com%2F%3Freqid%3D8763182%26affid%3D3%26city%3DYORK%26email%3Djhorn%2540firstenergycorp.com%26firstname%3DJohn%26lastname%3DHorn%26zip%3D17402%26phone%3D%26state%3DPA&tiba=Refi%20Advantage%20Experts&fmt=3&is_vtc=1&random=2861484041&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 May 2022 21:57:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.d0961e771164cd91e405.js Show response
script.hotjar.com/ 243 KB
63 KB 127ms
42ms Script
application/javascript 99.86.4.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.d0961e771164cd91e405.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1654995.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.4.6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-4-6.fra6.r.cloudfront.net

Software

Resource Hash

dd6afc5ca21e20fba6c0f8063017e22fcbcf5f94d9ad50db0b5320133f0cfbb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 31 May 2022 07:34:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51809
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 64057
access-control-allow-origin: *
last-modified: Tue, 31 May 2022 07:33:23 GMT
etag: "1ed5739adb19197da798013ab080794d"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 a7dcca466407f1871feceef50bc84272.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: YbGQb2oPWFOvOQkBScVPnJ6Vq2CwWGBQwLPq-49UNbSzXsUQQDQoQg==

GET
H2 200 box-63c3a81830bf549dafe40b369003f751.html Show response
vars.hotjar.com/ Frame 3AC3 2 KB
1 KB 124ms
38ms Document
text/html 143.204.215.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-63c3a81830bf549dafe40b369003f751.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1654995.js?sv=6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-118.fra53.r.cloudfront.net
Software: /
Resource Hash: f05ac9ba83369cd58d06d8ee2e5f8d61c040d30d044e20752153f95577627dc6

Request headers

Referer: https://www.refiadvantageexperts.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 51809
cache-control: max-age=31536000
content-encoding: br
content-length: 1044
content-type: text/html
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 31 May 2022 07:34:06 GMT
etag: "e6fb1304cb60a0dea0f76f7077cb13c6"
last-modified: Tue, 31 May 2022 07:33:23 GMT
vary: Accept-Encoding
via: 1.1 78c402b74e65ae12b398b6b957ab229e.cloudfront.net (CloudFront)
x-amz-cf-id: 3Uq51Mq8mNG7w8nsx9Swu-zRVZ9lWAi0ohwYJTMxydzT9MhvazTWig==
x-amz-cf-pop: FRA53-C1
x-cache: Hit from cloudfront
x-robots-tag: none

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1654995/ 147 B
322 B 179ms
60ms XHR
application/json 52.51.233.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1654995/visit-data?sv=6
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.d0961e771164cd91e405.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.233.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-233-122.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 4c88237efbd80053668d55dfb4f84f10c756d3d69142f801bd440d5ca4c46468

Request headers

Referer: https://www.refiadvantageexperts.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 31 May 2022 21:57:35 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H2 204 1654995 Show response
vc.hotjar.io/sessions/ 0
257 B 150ms
64ms XHR
text/plain 65.9.63.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/1654995?s=0.25&r=0.1410665974796379
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.d0961e771164cd91e405.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.63.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-63-123.fra56.r.cloudfront.net
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.refiadvantageexperts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 31 May 2022 21:57:35 GMT
via: 1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)
server: Python/3.7 aiohttp/3.5.4
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-id: td71PY3e5X0zg6u0qCyiwUyZFmzfoxH78Kvcrg7BsFL27G9RPNNVIA==

POST
H2 200 GenerateToken Show response
create.leadid.com/2.11.9/ 36 B
658 B 448ms
181ms XHR
text/plain 54.172.138.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.11.9/GenerateToken?msn=1&pid=e6a120e1-c153-41c5-bf9e-411bce155839&_=771658684

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.138.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-138-183.compute-1.amazonaws.com

Software

nginx /

Resource Hash

f4214d60219bbadbcc0e61261c28752d03edb5766496e7d6c41408c32b241ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.refiadvantageexperts.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 31 May 2022 21:57:36 GMT
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK iframe.html Show response
d2m2wsoho8qq12.cloudfront.net/ Frame 4F83 3 KB
2 KB 125ms
37ms Document
text/html 13.32.23.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=C37BC821-D60A-C891-DFF7-E343A5714FAA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=EA857B2C-FE7E-12EA-8BBD-CA6BA300C2D6&lac=A7EE6729-C0D4-2BB9-A8DE-6E48402F074A

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.32.23.225 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-23-225.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.refiadvantageexperts.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 62916
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 31 May 2022 04:29:19 GMT
ETag: W/"628ccde2-dbb"
Last-Modified: Tue, 24 May 2022 12:21:54 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
Via: 1.1 a23dafbbb9a61c77bda1d66d97f24e2e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8FDix-Uh0oqr8aiThAFshRsh5xrT2qJAWW7WOBSOzP80O2JyKQyIrw==
X-Amz-Cf-Pop: FRA56-C2
X-Cache: Hit from cloudfront

POST
H2 200 SaveDom Show response
create.leadid.com/2.11.9/ 0
623 B 131ms
131ms XHR
text/plain 54.172.138.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.11.9/SaveDom?msn=2&pid=e6a120e1-c153-41c5-bf9e-411bce155839&token=C37BC821-D60A-C891-DFF7-E343A5714FAA&_=771658685

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.138.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-138-183.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.refiadvantageexperts.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 31 May 2022 21:57:36 GMT
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 InitFormData Show response
create.leadid.com/2.11.9/ 0
623 B 259ms
259ms XHR
text/plain 54.172.138.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.11.9/InitFormData?msn=3&pid=e6a120e1-c153-41c5-bf9e-411bce155839&token=C37BC821-D60A-C891-DFF7-E343A5714FAA&_=771658686

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.138.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-138-183.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.refiadvantageexperts.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 31 May 2022 21:57:36 GMT
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 SaveFormField Show response
create.leadid.com/2.11.9/ 0
622 B 228ms
228ms XHR
text/plain 54.172.138.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.11.9/SaveFormField?msn=4&pid=e6a120e1-c153-41c5-bf9e-411bce155839&token=C37BC821-D60A-C891-DFF7-E343A5714FAA&_=771658687

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.138.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-138-183.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.refiadvantageexperts.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 31 May 2022 21:57:36 GMT
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 iframe.html Show response
deviceid.trueleadid.com/ Frame 9906 4 KB
2 KB 401ms
127ms Document
text/html 18.215.96.230
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://deviceid.trueleadid.com/iframe.html?token=C37BC821-D60A-C891-DFF7-E343A5714FAA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=EA857B2C-FE7E-12EA-8BBD-CA6BA300C2D6&lac=A7EE6729-C0D4-2BB9-A8DE-6E48402F074A
Requested by: Host: d2m2wsoho8qq12.cloudfront.net
URL: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=C37BC821-D60A-C891-DFF7-E343A5714FAA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=EA857B2C-FE7E-12EA-8BBD-CA6BA300C2D6&lac=A7EE6729-C0D4-2BB9-A8DE-6E48402F074A
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.215.96.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-215-96-230.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 602ea48b7fd2a48e702e43825b0d6f6495f78cb4cc1fa24cb8c95f61e014215a

Request headers

Referer: https://d2m2wsoho8qq12.cloudfront.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=86400 public
content-encoding: gzip
content-type: text/html
date: Tue, 31 May 2022 21:57:36 GMT
etag: W/"6283a250-1049"
expires: Wed, 01 Jun 2022 21:57:36 GMT
last-modified: Tue, 17 May 2022 13:25:36 GMT
p3p: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
server: nginx

POST
H2 200 InitFormData Show response
create.leadid.com/2.11.9/ 0
623 B 135ms
134ms XHR
text/plain 54.172.138.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.11.9/InitFormData?msn=5&pid=e6a120e1-c153-41c5-bf9e-411bce155839&token=C37BC821-D60A-C891-DFF7-E343A5714FAA&_=771658688

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.138.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-138-183.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.refiadvantageexperts.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 31 May 2022 21:57:36 GMT
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 SaveDeviceId.js Show response
create.leadid.com/2.11.9/ Frame 9906 0
627 B 388ms
131ms Script
text/javascript 54.172.138.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.11.9/SaveDeviceId.js?lac=A7EE6729-C0D4-2BB9-A8DE-6E48402F074A&lck=EA857B2C-FE7E-12EA-8BBD-CA6BA300C2D6&methods=48&token=C37BC821-D60A-C891-DFF7-E343A5714FAA&uuid=9a8041782e8748d2bd46de55c69f9f03

Requested by

Host: deviceid.trueleadid.com
URL: https://deviceid.trueleadid.com/iframe.html?token=C37BC821-D60A-C891-DFF7-E343A5714FAA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.9&lck=EA857B2C-FE7E-12EA-8BBD-CA6BA300C2D6&lac=A7EE6729-C0D4-2BB9-A8DE-6E48402F074A

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.138.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-138-183.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://deviceid.trueleadid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 31 May 2022 21:57:37 GMT
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 Snap Show response
create.leadid.com/2.11.9/ 0
623 B 651ms
268ms XHR
text/plain 54.172.138.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.11.9/Snap?msn=6&pid=e6a120e1-c153-41c5-bf9e-411bce155839&token=C37BC821-D60A-C891-DFF7-E343A5714FAA&_=771658689

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.138.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-138-183.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.refiadvantageexperts.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 31 May 2022 21:57:38 GMT
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 Snap Show response
create.leadid.com/2.11.9/ 0
623 B 716ms
301ms XHR
text/plain 54.172.138.183
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.11.9/Snap?msn=7&pid=e6a120e1-c153-41c5-bf9e-411bce155839&token=C37BC821-D60A-C891-DFF7-E343A5714FAA&_=771658690

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/ea857b2c-fe7e-12ea-8bbd-ca6ba300c2d6.js?snippet_version=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.172.138.183 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-172-138-183.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.refiadvantageexperts.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 31 May 2022 21:57:38 GMT
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

114 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bronto.com/	1970-01-27 10:46:13	Name: bs_t_8a9198b0850e00bb7e45b8c0b7cd5dc0 Value: YTo3OntzOjE6InMiO3M6MzI6IjhhOTE5OGIwODUwZTAwYmI3ZTQ1YjhjMGI3Y2Q1ZGMwIjtzOjE6ImMiO3M6MzI6IjJjZGE5M2E4YjQxMGQ3YWJjMDdiYzFhMzk3ZDFlOWJlIjtzOjE6ImQiO3M6MzI6ImQxZDc3MzEyZWRmOWYyNTQ5MGYxYTA0NmIzNjZjMTA1IjtzOjM6Im12bCI7czozMjoiZDYwMDcyM2NhOGEzYWVkNWE2YzhkMDI1NmUyYjU3NjUiO3M6MzoiY2lkIjtzOjI5OiI0YjgzaHU1emdhaDVjdTg1dDdqbHVpZHJiczV6dSI7czozOiJ0aWQiO3M6MTA3OiIwMzAyMjA3MjUzMTQwMTk1NTM2MDIxODI1NzU2MjQ2MjY0MTEyMjI2MjkwNzc2MjY2MTQ1ODQwMTY0NTMzMzUzMzE3OTIyNjI5MDczNzM3OTY0MTc3Njg1MjM3NTUwNzA3NjE1OTQwODY0OCI7czoxOiJlIjtzOjE6IjAiO30=
.bronto.com/	1969-12-31 23:59:59	Name: bs_t_bc_8a9198b0850e00bb7e45b8c0b7cd5dc0 Value: 1
.bronto.com/	1969-12-31 23:59:59	Name: tid_arenmcqgnssjsvfvqgemvobtduisblm Value: 03022072531401955360218257562462641122262907762661458401645333533179226290737379641776852375507076159408648
.sjejhhhe.com/	1969-12-31 23:59:59	Name: uid7830 Value: 1162441197-20220531145732-78f09001b1ecd16e7b965093ae1072f3-
.cormain1.com/	1969-12-31 23:59:59	Name: sid Value: +Q/5yhMqei+MOrTogapUEfOBDBAqTOhvamLTvPVZ0PQxZ6Tf+sSB6A==
.cormain1.com/	1970-01-20 20:59:52	Name: trk Value: ca/6Gbq5DRqMOrTogapUEfOBDBAqTOhvamLTvPVZ0PQxZ6Tf+sSB6A==
.cormain1.com/	1970-01-20 04:10:26	Name: c35 Value: +Q/5yhMqei834zYFM9gv4URd7CBTp308wboG1af46Wo=
www.refiadvantageexperts.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1mk026de3c8aqir873094hffi0
.doubleclick.net/	1970-01-20 03:27:15	Name: test_cookie Value: CheckForPermission
.refiadvantageexperts.com/	1970-01-20 12:12:50	Name: _hjSessionUser_1654995 Value: eyJpZCI6IjBhZmI1YTg0LTMwNDYtNWJjZS04NWUzLWI3ZmMxNTE0NDM3ZSIsImNyZWF0ZWQiOjE2NTQwMzQyNTU1NzQsImV4aXN0aW5nIjpmYWxzZX0=
.refiadvantageexperts.com/	1970-01-20 03:27:16	Name: _hjFirstSeen Value: 1
www.refiadvantageexperts.com/	1970-01-20 03:27:14	Name: _hjIncludedInPageviewSample Value: 1
.refiadvantageexperts.com/	1970-01-20 03:27:16	Name: _hjSession_1654995 Value: eyJpZCI6ImJlYTllNjllLWFhYWUtNDYzNy1hMmYzLTc2NjI2MDZkZDUyYyIsImNyZWF0ZWQiOjE2NTQwMzQyNTU1ODgsImluU2FtcGxlIjp0cnVlfQ==
.refiadvantageexperts.com/	1970-01-20 03:27:16	Name: _hjAbsoluteSessionInProgress Value: 1
www.refiadvantageexperts.com/	1970-01-20 03:27:15	Name: leadid_token-A7EE6729-C0D4-2BB9-A8DE-6E48402F074A-EA857B2C-FE7E-12EA-8BBD-CA6BA300C2D6 Value: C37BC821-D60A-C891-DFF7-E343A5714FAA
.deviceid.trueleadid.com/	1970-01-25 20:28:19	Name: uuid Value: 9a8041782e8748d2bd46de55c69f9f03

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.bronto.com
corlnk1.com
cormain1.com
create.leadid.com
create.lidstatic.com
d2m2wsoho8qq12.cloudfront.net
deviceid.trueleadid.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
in.hotjar.com
script.hotjar.com
static.hotjar.com
vars.hotjar.com
vc.hotjar.io
www.google.com
www.google.de
www.googleadservices.com
www.refiadvantageexperts.com
www.sjejhhhe.com
zip.getziptastic.com
108.61.229.128
13.32.23.225
142.250.185.162
143.204.215.118
18.188.52.203
18.215.96.230
216.27.63.20
23.92.19.76
2606:4700:10::ac43:29e5
2a00:1450:4001:802::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:811::2004
2a00:1450:4001:830::200a
52.43.54.228
52.51.233.122
54.172.138.183
65.9.63.123
65.9.63.33
99.86.4.6
00dd63b0ca2fb12eb12eef7af3f543b085cb1e94d1a861b484865c973b75e93e
04a816686a31e05c5ef0ba9307dade292f5ef47dbec7e9a177dbb049748c9050
280aaa8929329764ac3213ca093c63505cfcc665347939c79905c426d33867c5
285ac229a0db2272c7df4535ad5935d088e17030b0cc8cb27c2582f702a3b891
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
347b17eb7f992f547da5e904b4a8408d3bdba87df4d1c3d8174ac3bbe8b33c61
35fee76e941f629df1868278044468e4b327d402515d122b2bcbf9eef7d53e9d
414dcbef0bb16dec697a3b07514cb19c26ba17755929a5427cb72cd1f0496b6e
447d82e240dba8299b6fcf45ff12e15ee6409cde1dafdbbaa73bb848a591b834
4c88237efbd80053668d55dfb4f84f10c756d3d69142f801bd440d5ca4c46468
602ea48b7fd2a48e702e43825b0d6f6495f78cb4cc1fa24cb8c95f61e014215a
6fce8ebc3557b63496f8fafe1c182f2aa8669550f9398b4d9beebddd43306ed3
73c45566702f8e7cce5c32604d2d97dc5d7d7905678664d8080cfb3ac495fde4
85e4f547f27afbe08ad1d6d325707d420172402018c495fd9f1be197b0e9397d
8a4c3338c3b0fb43648f886f8c30f5fa55b2136c1b02058ed3aa0c8f589996f3
8a6c4bb148f4ce69a315a5bd696a3c82fce3bbbf9552ac3cd1c88bf070b27785
976177894b0cca88ff93ab02c6da363f2d55cce5d940139db955b251fcdd19a6
97d5a594e7f76c7e50045b67667fd6b74b268515efe6425097be1b2647079787
a48b167c5fbf0ac5cb7f6ab86a43bcef4ff7a7a82c8962f042cb9aefc3e208c5
b3104f98dbc82eaca38b5c3e2089fd8aeac5f938fc9cc1956b05bfeaac8a7e77
be63c8cb7532bc98f93a5939f8ce661fe6a19bae906f1c513599e327017759f3
beb481550e37a74109253b7825c19b03e08a61174fb7d36357c7f5fe240b5f39
c33681591a2f32579a18e32cd51b59c82de800c15ec6b84d0632ef82966a142d
c84423c305779f2aab07847a2e3870ac1ea4072e470d5eb149c01e0e0497eae3
c99792f9bbdcbee55ee5b2a03cd03e704b8ae9cef5fe2b0b5cb20fee02976dc9
d7f767f12ce56183819aad6a6d6a5b2d09ee0181437b85f12756131e4047ae96
dd6afc5ca21e20fba6c0f8063017e22fcbcf5f94d9ad50db0b5320133f0cfbb4
e0ef803f8bb9cbe07f2407212c2422f87d48dbd08addb5bb994c5f485b2dcc6a
e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f05ac9ba83369cd58d06d8ee2e5f8d61c040d30d044e20752153f95577627dc6
f4214d60219bbadbcc0e61261c28752d03edb5766496e7d6c41408c32b241ea3
f7029c163ebf0829db15c555d86f4bca84387ee693c08f052f9523856dadc375

www.refiadvantageexperts.com Open in urlscan Pro 18.188.52.203 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

43 Requests

100 %HTTPS

30 %IPv6

18 Domains

21 Subdomains

17 IPs

3 Countries

773 kBTransfer

1066 kBSize

16 Cookies

0 Outgoing links

Page URL History

Redirected requests

43 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.refiadvantageexperts.com Open in urlscan Pro
18.188.52.203 Public Scan

Screenshot
Live screenshot

Full Image

43
Requests

100 %
HTTPS

30 %
IPv6

18
Domains

21
Subdomains

17
IPs

3
Countries

773 kB
Transfer

1066 kB
Size

16
Cookies

43 HTTP transactions
0 data transactions