plusbonuscare.com Open in urlscan Pro
2606:4700:3036::6815:c7f Public Scan

Go To Rescan
Add Verdict Report

URL:
https://plusbonuscare.com/
Submission: On January 23 via api (January 23rd 2024, 11:44:10 pm UTC) from US — Scanned from US

Summary HTTP 35 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 1 countries across 11 domains to perform 35 HTTP transactions. The main IP is 2606:4700:3036::6815:c7f, located in United States and belongs to CLOUDFLARENET, US. The main domain is plusbonuscare.com.
TLS certificate: Issued by E1 on January 23rd 2024. Valid for: 3 months.

This is the only time plusbonuscare.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:303... 2606:4700:3036::6815:c7f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c09::5f	15169 (GOOGLE) (GOOGLE)
1	3.213.228.14 3.213.228.14	14618 (AMAZON-AES) (AMAZON-AES)
4	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:10:... 2606:4700:10::6816:27b6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	54.237.189.37 54.237.189.37	14618 (AMAZON-AES) (AMAZON-AES)
1	13.225.189.121 13.225.189.121	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:215... 2600:9000:215f:fe00:4:1957:6500:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	45.223.17.68 45.223.17.68	19551 (INCAPSULA) (INCAPSULA)
4	54.224.107.155 54.224.107.155	14618 (AMAZON-AES) (AMAZON-AES)
1	44.206.56.53 44.206.56.53	14618 (AMAZON-AES) (AMAZON-AES)
35	13

10 2606:4700:3036::6815:c7f (United States)

ASN13335 (CLOUDFLARENET, US)

plusbonuscare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::5f (Ashburn, United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.213.228.14 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-228-14.compute-1.amazonaws.com

mylanderportal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:27b6 (United States)

ASN13335 (CLOUDFLARENET, US)

create.lidstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.237.189.37 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-189-37.compute-1.amazonaws.com

create.leadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.189.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-189-121.yul62.r.cloudfront.net

d2m2wsoho8qq12.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:215f:fe00:4:1957:6500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-js.ringba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 45.223.17.68 (United States)

ASN19551 (INCAPSULA, US)

deviceid.trueleadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.224.107.155 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-224-107-155.compute-1.amazonaws.com

display.ringba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.206.56.53 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-206-56-53.compute-1.amazonaws.com

info.leadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	plusbonuscare.com plusbonuscare.com	118 KB
5	ringba.com b-js.ringba.com — Cisco Umbrella Rank: 107905 display.ringba.com — Cisco Umbrella Rank: 84171	19 KB
4	leadid.com create.leadid.com — Cisco Umbrella Rank: 16554 info.leadid.com — Cisco Umbrella Rank: 86958	2 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	162 KB
3	trueleadid.com deviceid.trueleadid.com — Cisco Umbrella Rank: 19602	22 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	247 B
1	cloudfront.net d2m2wsoho8qq12.cloudfront.net	2 KB
1	lidstatic.com create.lidstatic.com — Cisco Umbrella Rank: 28974	38 KB
1	mylanderportal.com mylanderportal.com
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 369	31 KB
0	morehealthbenefits.com Failed morehealthbenefits.com Failed
35	11

	Domain	Requested by
10	plusbonuscare.com	plusbonuscare.com
4	display.ringba.com	b-js.ringba.com
4	connect.facebook.net	plusbonuscare.com connect.facebook.net
3	deviceid.trueleadid.com	d2m2wsoho8qq12.cloudfront.net deviceid.trueleadid.com
3	www.facebook.com
3	create.leadid.com	create.lidstatic.com deviceid.trueleadid.com
1	info.leadid.com	create.lidstatic.com
1	b-js.ringba.com	plusbonuscare.com
1	d2m2wsoho8qq12.cloudfront.net	create.lidstatic.com
1	create.lidstatic.com	plusbonuscare.com
1	mylanderportal.com	plusbonuscare.com
1	ajax.googleapis.com	plusbonuscare.com
0	morehealthbenefits.com Failed	plusbonuscare.com
35	13

This site contains no links.

Subject Issuer	Validity	Valid
plusbonuscare.com E1	`2024-01-23` - `2024-04-22`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
mylanderportal.com R3	`2023-12-13` - `2024-03-12`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-02` - `2024-01-31`	3 months	crt.sh
lidstatic.com Cloudflare Inc ECC CA-3	`2023-02-28` - `2024-02-28`	a year	crt.sh
create.leadid.com Amazon RSA 2048 M02	`2023-08-21` - `2024-09-17`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.ringba.com Amazon RSA 2048 M03	`2023-11-27` - `2024-12-23`	a year	crt.sh
imperva.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-01-16` - `2024-07-14`	6 months	crt.sh
*.leadid.com Amazon RSA 2048 M02	`2023-07-20` - `2024-08-17`	a year	crt.sh

This page contains 3 frames:

Frame: https://morehealthbenefits.com/
Frame ID: FCC73854F52D19705CF376C1C1C112D1
Requests: 29 HTTP requests in this frame

Frame: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=C978EDCF-FF16-D739-E174-20D425F62778&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Frame ID: DE82E5291874D51C4F6D88F92BC1D60C
Requests: 1 HTTP requests in this frame

Frame: https://deviceid.trueleadid.com/iframe.html?token=C978EDCF-FF16-D739-E174-20D425F62778&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Frame ID: 5BC969D6E424E313F7BD94947E6A748E
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Imperva (Security) Expand

Overall confidence: 100%
Detected patterns

/_Incapsula_Resource

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

35
Requests

94 %
HTTPS

50 %
IPv6

11
Domains

13
Subdomains

13
IPs

1
Countries

395 kB
Transfer

1127 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

35 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
plusbonuscare.com/ 13 KB
5 KB 191ms
115ms Document
text/html 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonuscare.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e0d9e7cd299d6302fa1d3cd05f58bd5763374e387ff112ece801f720627949c6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: max-age=2678400
cf-cache-status: MISS
cf-ray: 84a3e68f6cb44bcc-BUF
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 23 Jan 2024 23:43:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8sE6%2Fg2JfcRMnwdTcQo5BfmtKG4lv23usL9NpolkqQ4v%2FbZiU6FUDYk9PShH%2BkM2IoiLmeuhVYgCZN2Ys6RxHxxL3j3WSCZOU0fB9rsPIfDHosG2pA6v6EGS0t4SPhXw1DCK8oInEOeXlARcD4JYmg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: Express

GET
H2 200 styles.css
plusbonuscare.com/css/ 3 KB
1 KB 179ms
178ms Stylesheet
text/css 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonuscare.com/css/styles.css
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 123081148f2b16549f97e30ce29fbfe23a4cd769b1319f03cfa7e353a88f34a3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:44 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"b35-CG4YrVb96XHM4kuH734tCT7qaFQ"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VaH9RHKxfYdLufIxrqBqv5f1vM7BO6qpmiqhy4Lq1K9i2WWGwN6VnEtcslZ5df8NGTlxnzobEOeCs4nRN1uVIpD7GcKr21ju1UGIJbRO%2FnjdjpBNzdvBoeud6PMXn2MoR5L6UWLejJO6jgUkCd4QUw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84a3e6902d824bcc-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 logo.webp
plusbonuscare.com/images/ 3 KB
4 KB 150ms
149ms Image
image/webp 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://plusbonuscare.com/images/logo.webp
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0001aaeb9d257978c8985c0295c76f031200f806848b6b5f5704e78fd9eb8535

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:44 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"d74-isOCM8wMElmdoyyRc3sIdeNp/UA"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ajUg8o66TpPl0H6TFDDsPOPPWBGu%2BSRRF8GQe1QUUTKaXBHw58uh9hOe1N8M8qY9EgtuKp1lTrKT0bFcIoboZ7ywjOfhTrQfWlpJT4rgmuSF%2Fcw6zbiYbn8WCzGneSqYE48TjSP4Lwah0vFOli4MNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 84a3e6902d834bcc-BUF
alt-svc: h3=":443"; ma=86400
content-length: 3444

GET
H2 200 family.jpg
plusbonuscare.com/images/ 99 KB
99 KB 240ms
239ms Image
image/jpeg 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://plusbonuscare.com/images/family.jpg
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d1965706316e1ad3d701bc06fa2f18b07a7ce8c12088adb7cccef426b5421a73

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:44 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"18aa8-dOsJpvbbOOoFaWPkj/+KOtIWbDE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pF0e3OQbyxItXDtFApKunbH6%2FsBHKWu1b7Ais9lxYbaoV1pPB93HYqeZLKE0ZtaxU4fk9Bh7tNGpNRvCtoHHlde1B5jAWN8fQQgA9lkMobFPbjg6UhkXv98HgVRF2mzCH4MYmMtRpghaIYruoopjRg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 84a3e6902d864bcc-BUF
alt-svc: h3=":443"; ma=86400
content-length: 101032

GET
H2 200 rocket-loader.min.js Show response
plusbonuscare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 36ms
35ms Script
application/javascript 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusbonuscare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: plusbonuscare.com
URL: https://plusbonuscare.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 19 Jan 2024 15:56:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65aa9bb3-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=88e7iiOBoRGFxurcXCvfC9FOK7W1aY%2FEcFPdihiBQol5vz4zgMWZC28VFbGTn%2F52%2BEKywJxE%2Fe01t%2FaRJDETpaszCeTrASnzQmBH5ixLE1IjBMIHVq5kWvE%2FugO1pLGKcvSuZkq7%2BmHhDzkipd6rFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 84a3e6902d884bcc-BUF
expires: Thu, 25 Jan 2024 23:43:44 GMT

GET
H3 200 absf_v3.0.js
plusbonuscare.com/js/ 854 B
921 B 247ms
246ms Script
text/javascript 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonuscare.com/js/absf_v3.0.js
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:45 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"356-8fIttMgCKLnZmSXrVpgWK1t7KTw"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ioIBojdqNbu0qRUe3pMv%2Bk0lqNXgD02uWXN4AaXCBCawPr7PN%2FB%2FQzgwOrFyQsvmPOBXbSa8A%2BvIVlea44OrynBxRQ16qjRgW0k9uPQ6zShrhr512l5cPdx14Zsm5UoSb8i2BBhGl6RTteiFkvtMiA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84a3e6914f7f4bbd-BUF
alt-svc: h3=":443"; ma=86400

GET
H3 200 absf_v1.0_references.js Show response
plusbonuscare.com/js/ 2 KB
1 KB 168ms
167ms Script
application/javascript 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonuscare.com/js/absf_v1.0_references.js
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f4072f447c005996868b6b87565da4dce65d821d77c1956b763de1ce74d2ae62

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:44 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"751-hK17w5UpbZeNtU4bdEfzKF8VCzU"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ErNYtm8zndHxIUYypo1THSqUB5J%2FR2ZTMVGnok%2BorsZdxDrHpKMZ8mNCRF1v6uP8Ogp4Bo3edeVtk3PsrjahDkR5dqZpBEg639E35nfe2R4EtWoZY4RrzPueX7sbeN0iWCKlKCqZJMeOzF0mpOXvug%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84a3e6914f844bbd-BUF
alt-svc: h3=":443"; ma=86400

GET
H3 200 loader.js Show response
plusbonuscare.com/js/ 3 KB
1 KB 175ms
174ms Script
application/javascript 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonuscare.com/js/loader.js
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b9c145899fb05ff5510dfebe9d4ef2da5a8d3439aaa9f3754bb5e8e64bf66c71

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:44 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"aa8-7nA1H/3E0mrkEyTaaABVPNrGS3w"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H69NIgLFeKyxccdZhhrlpTx%2FUp3qxAvuJhFDBz2AXJa1c6NMuULYcu8V%2F7muJeXLQKqo5rnxUjexrgEiNwDsvqhoWJWy8gRpAXS6T%2FQpqov57iXiQBOqiEPtZCj6cVsrtpVEXIcPUIQIdKCREGaCKA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84a3e6914f884bbd-BUF
alt-svc: h3=":443"; ma=86400

GET
H3 200 countdown.js Show response
plusbonuscare.com/js/ 504 B
755 B 191ms
190ms Script
application/javascript 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonuscare.com/js/countdown.js
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0e47b1350cf329c793437da7e12c09f395d65726a80d9a7f35b6a0db85a896d9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:45 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"1f8-AUvfoIdMQ1X6qJRAcf5vy5+Y7Vg"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y6LbGzlkeChSfDTCbGGpNByLcVfY2M3ioMUGumamQD%2BYew13pQOGxMbwKYnDFbsgREW3mAtoj54qFShJ94GJ7F0VDR4HsZthkw%2BwEvVO3ZMzlyPXFs3nzMqRyHRs27pxHpUko6AUZlmQSDmtSV%2B7Wg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84a3e6914f8d4bbd-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 97ms
32ms Script
text/javascript 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: plusbonuscare.com
URL: https://plusbonuscare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 21 Jan 2024 18:40:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 190971
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 20 Jan 2025 18:40:53 GMT

GET
H3 200 bootstrap@5.3.0.min.prot.js Show response
plusbonuscare.com/js/ 632 B
827 B 171ms
170ms Script
text/javascript 2606:4700:3036::6815:c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonuscare.com/js/bootstrap@5.3.0.min.prot.js
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:c7f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 93720b7d0047b43b089ed778f251d3239b30b0db269c75270e24b4b0f9e1cd5f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:44 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"278-wcwbUZQw5YN20K3Y7gqn+Ng2VqQ"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EbWTNi89v7SLBhbvmFMTFlgZmDu8LWOY6uqQahno1JRzp3XaMbljEofL7wA5Xruw7uNjyCF345EI6QST7%2BJ%2FqqdfFdIeKZzhJfDHqWaEOkg8xqxSzD9z7AiC4aEf7%2BUMNL3j1G%2BVK3HbJOktNNep%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84a3e6914f904bbd-BUF
alt-svc: h3=":443"; ma=86400

OPTIONS
H/1.1 404
NOT FOUND location
mylanderportal.com/api/ Frame 0
0 129ms
40ms Preflight
text/html 3.213.228.14
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mylanderportal.com/api/location
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.213.228.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-228-14.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://plusbonuscare.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
Access-Control-Allow-Origin: https://plusbonuscare.com
Connection: keep-alive
Content-Length: 232
Content-Type: text/html; charset=utf-8
Date: Tue, 23 Jan 2024 23:43:45 GMT
Server: nginx/1.22.1
Vary: Origin

POST location
mylanderportal.com/api/ 0
0

GET /
morehealthbenefits.com/ 0
0

GET
H2 200 fbevents.js
connect.facebook.net/en_US/ 213 KB
57 KB 101ms
33ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: plusbonuscare.com
URL: https://plusbonuscare.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 23 Jan 2024 23:43:45 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57021
x-xss-protection: 0
pragma: public
x-fb-debug: wPGlMM5cPeZpJSiMbGShnSAuWc/Pn7eAI9jgWrMHXdUDe3hcxEKBHRhdozf0HiElg7lqXKkD3jgPpaij4PmRRA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 a57816b4-6c59-f397-7853-7e14e45d3e1b.js
create.lidstatic.com/campaign/ 121 KB
38 KB 202ms
128ms Script
text/javascript 2606:4700:10::6816:27b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:27b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:45 GMT
x-amz-version-id: 0TYZIhZnCiJDj1Gzr_aWxHS1MWCxaYWH
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 18 Jan 2024 02:21:13 GMT
server: cloudflare
x-amz-request-id: 7J8FWQTJSKANQTN0
etag: W/"bc138804ddd94411bd78fba4df4e96b0"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=1800
x-amz-replication-status: COMPLETED
cf-ray: 84a3e6935dcf4bc1-BUF
x-amz-id-2: SCHOVz3r+ycSNFw8J6VfEtykKWxpIUrO6ELBXv9E+eLZ/acyJxnB8ovgMwd19XQEYkE97Vk4ZrTDFL3esXCDAQ==

GET
H2 200 1333889473851400
connect.facebook.net/signals/config/ 135 KB
35 KB 112ms
111ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1333889473851400?v=2.9.142&r=stable&domain=plusbonuscare.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 23 Jan 2024 23:43:45 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: nUJuxmpL7P+faylR7rs7sQ2agXRHqCKMPkWdSMC8IppAjgZQaCV5j39kLMYFJA+63f48M67eVgY4lnRJG1lyaQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 GenerateToken
create.leadid.com/2.12.1/ 36 B
660 B 177ms
92ms XHR
text/plain 54.237.189.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.12.1/GenerateToken?msn=1&pid=e19dde3b-eb5b-4ce3-ac2c-07ae44074bef&_=180382170

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.237.189.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-189-37.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://plusbonuscare.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 23 Jan 2024 23:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 6411826982256929
connect.facebook.net/signals/config/ 134 KB
35 KB 94ms
93ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/6411826982256929?v=2.9.142&r=stable&domain=plusbonuscare.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 23 Jan 2024 23:43:45 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: QmOaRt/Kv1deEwZdaJgMkZZ5Lz6AKX+BEZjrCD/6eGt2Cc/R7hvhfCgPv22rUhDdd5Xta56HAWLEn0pxMtfnbA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK iframe.html
d2m2wsoho8qq12.cloudfront.net/ Frame DE82 3 KB
2 KB 118ms
34ms Document
text/html 13.225.189.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=C978EDCF-FF16-D739-E174-20D425F62778&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.225.189.121 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-189-121.yul62.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://plusbonuscare.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Age: 31899
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 23 Jan 2024 14:52:06 GMT
ETag: W/"65a0715c-dbb"
Last-Modified: Thu, 11 Jan 2024 22:53:16 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
Via: 1.1 3aa87db4ada59e0f9698dcd8ce9e9728.cloudfront.net (CloudFront)
X-Amz-Cf-Id: yYD2Yos3nAPie2pUR-BOQU5q6Gn79N2rGrwcwD8sOzenLRK1WFd5Gg==
X-Amz-Cf-Pop: YUL62-C1
X-Cache: Hit from cloudfront

POST
H2 200 SaveDom
create.leadid.com/2.12.1/ 0
623 B 43ms
43ms XHR
text/plain 54.237.189.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.12.1/SaveDom?msn=2&pid=e19dde3b-eb5b-4ce3-ac2c-07ae44074bef&token=C978EDCF-FF16-D739-E174-20D425F62778&_=180382171

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.237.189.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-189-37.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://plusbonuscare.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 23 Jan 2024 23:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 CA701edcfda750434cbdf14b7ceddcabf1
b-js.ringba.com/ 17 KB
17 KB 176ms
61ms Script
text/html 2600:9000:215f:fe00:4:1957:6500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-js.ringba.com/CA701edcfda750434cbdf14b7ceddcabf1
Requested by: Host: plusbonuscare.com
URL: https://plusbonuscare.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:fe00:4:1957:6500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:38:55 GMT
via: 1.1 e0170582752f8bcacf802243afe5509c.cloudfront.net (CloudFront)
x-aspnet-version: 4.0.30319
x-amz-cf-pop: YUL62-C2
age: 289
x-powered-by: ASP.NET
x-cache: Hit from cloudfront
content-length: 17076
x-runtime: 0.0000
server: Microsoft-IIS/10.0
access-control-max-age: 300
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public
x-amz-cf-id: aYBuGHdmx3oiImCoDa8HgJqjTOR35xAzbFo5Rpgpzjq9myPquJVZGA==
expires: Tue, 23 Jan 2024 23:43:56 GMT

GET
H3 200 254961090299261
connect.facebook.net/signals/config/ 134 KB
35 KB 93ms
93ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/254961090299261?v=2.9.142&r=stable&domain=plusbonuscare.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 23 Jan 2024 23:43:45 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: QZzwfzBxfMTBvvLSG12k2197+OxHEEBAAh+OKWqBBv4YQUtXnGmA+NwU4+Xb0YYMf4HSKm5sopNxURpBma86Ow==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 102ms
34ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1333889473851400&ev=PageView&dl=https%3A%2F%2Fplusbonuscare.com%2F%3Fleadid%3DC978EDCF-FF16-D739-E174-20D425F62778&rl=&if=false&ts=1706053425652&sw=1600&sh=1200&v=2.9.142&r=stable&ec=0&o=4126&fbp=fb.1.1706053425650.1035951729&ler=empty&it=1706053425273&coo=false&exp=d2&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 23 Jan 2024 23:43:45 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 102ms
34ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=6411826982256929&ev=PageView&dl=https%3A%2F%2Fplusbonuscare.com%2F%3Fleadid%3DC978EDCF-FF16-D739-E174-20D425F62778&rl=&if=false&ts=1706053425655&sw=1600&sh=1200&v=2.9.142&r=stable&ec=0&o=4126&fbp=fb.1.1706053425650.1035951729&ler=empty&it=1706053425273&coo=false&exp=d2&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 23 Jan 2024 23:43:45 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 101ms
34ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=254961090299261&ev=PageView&dl=https%3A%2F%2Fplusbonuscare.com%2F%3Fleadid%3DC978EDCF-FF16-D739-E174-20D425F62778&rl=&if=false&ts=1706053425659&sw=1600&sh=1200&v=2.9.142&r=stable&ec=0&o=4126&fbp=fb.1.1706053425650.1035951729&ler=empty&it=1706053425273&coo=false&exp=d2&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonuscare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 23 Jan 2024 23:43:45 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 iframe.html
deviceid.trueleadid.com/ Frame 5BC9 4 KB
2 KB 102ms
41ms Document
text/html 45.223.17.68
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://deviceid.trueleadid.com/iframe.html?token=C978EDCF-FF16-D739-E174-20D425F62778&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Requested by

Host: d2m2wsoho8qq12.cloudfront.net
URL: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=C978EDCF-FF16-D739-E174-20D425F62778&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.17.68 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://d2m2wsoho8qq12.cloudfront.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=86400 public
content-encoding: gzip
content-type: text/html
date: Tue, 23 Jan 2024 23:43:45 GMT
etag: W/"6554d155-1049"
expires: Wed, 24 Jan 2024 23:43:45 GMT
last-modified: Wed, 15 Nov 2023 14:10:29 GMT
p3p: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
server: nginx
strict-transport-security: max-age=31536000
x-cdn: Imperva
x-iinfo: 17-13687502-13667987 pNNy RT(1706053425419 29) q(0 0 0 0) r(0 0) U24
x-incap-sess-cookie-hdr: FeCLU5G7fUfCrWV8q+97AjFPsGUAAAAApMtPcpmfB5tDXhfC215wlw==

POST
H/1.1 200
OK gnbulk
display.ringba.com/v2/nis/ 400 B
788 B 182ms
44ms XHR
application/json 54.224.107.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://display.ringba.com/v2/nis/gnbulk
Requested by: Host: b-js.ringba.com
URL: https://b-js.ringba.com/CA701edcfda750434cbdf14b7ceddcabf1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.224.107.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-224-107-155.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Referer: https://plusbonuscare.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 23 Jan 2024 23:43:45 GMT
X-Runtime: 0.0030
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Max-Age: 300
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://plusbonuscare.com
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 400
Expires: -1

POST
H2 200 info
info.leadid.com/ 1 B
109 B 172ms
39ms XHR
text/plain 44.206.56.53
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://info.leadid.com/info?msn=3&pid=e19dde3b-eb5b-4ce3-ac2c-07ae44074bef&token=C978EDCF-FF16-D739-E174-20D425F62778&_=180382172
Requested by: Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.206.56.53 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-206-56-53.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://plusbonuscare.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Tue, 23 Jan 2024 23:43:45 GMT
server: nginx
content-type: text/plain;charset=UTF-8

GET
H2 200 _Incapsula_Resource
deviceid.trueleadid.com/ Frame 5BC9 142 KB
20 KB 32ms
32ms Script
application/javascript 45.223.17.68
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://deviceid.trueleadid.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1401306785

Requested by

Host: deviceid.trueleadid.com
URL: https://deviceid.trueleadid.com/iframe.html?token=C978EDCF-FF16-D739-E174-20D425F62778&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.17.68 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://deviceid.trueleadid.com/iframe.html?token=C978EDCF-FF16-D739-E174-20D425F62778&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store
content-encoding: gzip
x-robots-tag: noindex
content-length: 20393
content-type: application/javascript

GET
H2 200 SaveDeviceId.js
create.leadid.com/2.12.1/ Frame 5BC9 0
626 B 116ms
41ms Script
text/javascript 54.237.189.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.12.1/SaveDeviceId.js?lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&methods=48&token=C978EDCF-FF16-D739-E174-20D425F62778&uuid=004bed437976492d9093d3699e42bd1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.237.189.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-237-189-37.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://deviceid.trueleadid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 23 Jan 2024 23:43:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 _Incapsula_Resource
deviceid.trueleadid.com/ Frame 5BC9 1 B
36 B 26ms
26ms Image
text/plain 45.223.17.68
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://deviceid.trueleadid.com/_Incapsula_Resource?SWKMTFSR=1&e=0.08197772461022645

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.17.68 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://deviceid.trueleadid.com/iframe.html?token=C978EDCF-FF16-D739-E174-20D425F62778&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
content-type: text/plain

POST
H/1.1 200
OK hb
display.ringba.com/v1/nis/ 0
339 B 44ms
43ms XHR
text/plain 54.224.107.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://display.ringba.com/v1/nis/hb
Requested by: Host: b-js.ringba.com
URL: https://b-js.ringba.com/CA701edcfda750434cbdf14b7ceddcabf1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.224.107.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-224-107-155.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Referer: https://plusbonuscare.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 23 Jan 2024 23:43:50 GMT
X-Runtime: 0.0020
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Max-Age: 300
Access-Control-Allow-Origin: https://plusbonuscare.com
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: -1

POST
H/1.1 200
OK hb
display.ringba.com/v1/nis/ 0
339 B 44ms
43ms XHR
text/plain 54.224.107.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://display.ringba.com/v1/nis/hb
Requested by: Host: b-js.ringba.com
URL: https://b-js.ringba.com/CA701edcfda750434cbdf14b7ceddcabf1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.224.107.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-224-107-155.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Referer: https://plusbonuscare.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 23 Jan 2024 23:43:55 GMT
X-Runtime: 0.0020
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Max-Age: 300
Access-Control-Allow-Origin: https://plusbonuscare.com
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: -1

POST
H/1.1 200
OK hb
display.ringba.com/v1/nis/ 0
339 B 44ms
44ms XHR
text/plain 54.224.107.155
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://display.ringba.com/v1/nis/hb
Requested by: Host: b-js.ringba.com
URL: https://b-js.ringba.com/CA701edcfda750434cbdf14b7ceddcabf1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.224.107.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-224-107-155.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

Referer: https://plusbonuscare.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 23 Jan 2024 23:44:00 GMT
X-Runtime: 0.0030
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Max-Age: 300
Access-Control-Allow-Origin: https://plusbonuscare.com
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: -1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mylanderportal.com
URL: https://mylanderportal.com/api/location

Domain: morehealthbenefits.com
URL: https://morehealthbenefits.com/

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
plusbonuscare.com/	1970-01-20 17:54:14	Name: leadid_token-F252983F-4BD1-0DD8-CD81-F4700AF60B66-A57816B4-6C59-F397-7853-7E14E45D3E1B Value: C978EDCF-FF16-D739-E174-20D425F62778
.plusbonuscare.com/	1970-01-20 20:03:49	Name: _fbp Value: fb.1.1706053425650.1035951729
.trueleadid.com/	1969-12-31 23:59:59	Name: nlbi_3051494 Value: j017KxdZ9ieAQBw2C30iGwAAAAAegR7RCZB1oUwms0yJHFw5
.trueleadid.com/	1970-01-21 02:38:55	Name: visid_incap_3051494 Value: GmvfLwYTQG27cM+7JlA8DjFPsGUAAAAAQUIPAAAAAACtI/OvrmeiO+uA/YwuQMF6
.trueleadid.com/	1969-12-31 23:59:59	Name: incap_ses_179_3051494 Value: LRx1FrBUxAHCrWV8q+97AjFPsGUAAAAApBZ9cCCCtxrPB+68sYOWTA==
.deviceid.trueleadid.com/	1970-01-21 03:30:13	Name: uuid Value: 004bed437976492d9093d3699e42bd1d

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://plusbonuscare.com/ Message: Access to XMLHttpRequest at 'https://mylanderportal.com/api/location' from origin 'https://plusbonuscare.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.
network	error	URL: https://mylanderportal.com/api/location Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
b-js.ringba.com
connect.facebook.net
create.leadid.com
create.lidstatic.com
d2m2wsoho8qq12.cloudfront.net
deviceid.trueleadid.com
display.ringba.com
info.leadid.com
morehealthbenefits.com
mylanderportal.com
plusbonuscare.com
www.facebook.com
morehealthbenefits.com
mylanderportal.com
13.225.189.121
2600:9000:215f:fe00:4:1957:6500:93a1
2606:4700:10::6816:27b6
2606:4700:3036::6815:c7f
2607:f8b0:4004:c09::5f
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
3.213.228.14
44.206.56.53
45.223.17.68
54.224.107.155
54.237.189.37
0001aaeb9d257978c8985c0295c76f031200f806848b6b5f5704e78fd9eb8535
0e47b1350cf329c793437da7e12c09f395d65726a80d9a7f35b6a0db85a896d9
123081148f2b16549f97e30ce29fbfe23a4cd769b1319f03cfa7e353a88f34a3
93720b7d0047b43b089ed778f251d3239b30b0db269c75270e24b4b0f9e1cd5f
b9c145899fb05ff5510dfebe9d4ef2da5a8d3439aaa9f3754bb5e8e64bf66c71
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d1965706316e1ad3d701bc06fa2f18b07a7ce8c12088adb7cccef426b5421a73
e0d9e7cd299d6302fa1d3cd05f58bd5763374e387ff112ece801f720627949c6
f4072f447c005996868b6b87565da4dce65d821d77c1956b763de1ce74d2ae62
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

plusbonuscare.com Open in urlscan Pro 2606:4700:3036::6815:c7f Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

35 Requests

94 %HTTPS

50 %IPv6

11 Domains

13 Subdomains

13 IPs

1 Countries

395 kBTransfer

1127 kBSize

6 Cookies

0 Outgoing links

Redirected requests

35 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

plusbonuscare.com Open in urlscan Pro
2606:4700:3036::6815:c7f Public Scan

Screenshot
Live screenshot

Full Image

35
Requests

94 %
HTTPS

50 %
IPv6

11
Domains

13
Subdomains

13
IPs

1
Countries

395 kB
Transfer

1127 kB
Size

6
Cookies

35 HTTP transactions
0 data transactions