auth.savings.workingadvantage.com Open in urlscan Pro
172.64.151.143 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://e.email.workingadvantage.com/click?EYW5nZWxhLnR1cm5lckBnY3BzazEyLm9yZw/CeyJtaWQiOiIxNjU1MjE2MjUyMDY1MDM4NWQ0MjVjMmMzIiwiY3QiO...
Effective URL:
https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium...
Submission: On June 15 via api (June 15th 2022, 1:35:52 pm UTC) from US — Scanned from DE

Summary HTTP 75 Redirects Behaviour Indicators

Summary

This website contacted 17 IPs in 6 countries across 13 domains to perform 75 HTTP transactions. The main IP is 172.64.151.143, located in United States and belongs to CLOUDFLARENET, US. The main domain is auth.savings.workingadvantage.com. The Cisco Umbrella rank of the primary domain is 581451.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 10th 2022. Valid for: a year.

This is the only time auth.savings.workingadvantage.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	96.47.24.171 96.47.24.171	46263 (EDIALOG) (EDIALOG)
1 17	172.64.151.143 172.64.151.143	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2a02:26f0:350... 2a02:26f0:3500:591::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (STACKPATH...) (STACKPATH-CDN)
4	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 4	108.128.0.238 108.128.0.238	16509 (AMAZON-02) (AMAZON-02)
2	34.249.212.46 34.249.212.46	16509 (AMAZON-02) (AMAZON-02)
2	15.188.95.229 15.188.95.229	16509 (AMAZON-02) (AMAZON-02)
1 1	63.32.153.188 63.32.153.188	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c09::9a	15169 (GOOGLE) (GOOGLE)
10	172.64.144.61 172.64.144.61	() ()
1	52.212.242.20 52.212.242.20	() ()
75	17

1 96.47.24.171 (United States) 1 redirects

ASN46263 (EDIALOG, US)
PTR: houselogic.mx1.bm16.maas.zetaglobal.net

e.email.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 172.64.151.143 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

gwinnett.savings.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
auth.savings.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:3500:591::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 108.128.0.238 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-0-238.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.249.212.46 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-212-46.eu-west-1.compute.amazonaws.com

entertainmentbenefitsgroupllc.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.95.229 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

smetrics.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.32.153.188 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-63-32-153-188.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c09::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.64.144.61 (None, )

ASN- ()

gwinnett.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.242.20 (None, )

ASN- ()

starget.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	workingadvantage.com 2 redirects e.email.workingadvantage.com — Cisco Umbrella Rank: 97749 gwinnett.savings.workingadvantage.com smetrics.workingadvantage.com — Cisco Umbrella Rank: 325782 auth.savings.workingadvantage.com — Cisco Umbrella Rank: 581451 starget.workingadvantage.com	1 MB
10	beneplace.com gwinnett.savings.beneplace.com	21 KB
8	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60	80 KB
8	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 432	292 KB
7	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67 maps.googleapis.com — Cisco Umbrella Rank: 356	109 KB
6	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 212 entertainmentbenefitsgroupllc.demdex.net — Cisco Umbrella Rank: 214545	11 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 96	158 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 246	43 KB
4	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 444	95 KB
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 125	521 B
2	gstatic.com fonts.gstatic.com	47 KB
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 686	48 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1015	517 B
75	13

	Domain	Requested by
11	gwinnett.savings.workingadvantage.com	gwinnett.savings.workingadvantage.com
10	gwinnett.savings.beneplace.com	auth.savings.workingadvantage.com
8	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com gwinnett.savings.workingadvantage.com
8	assets.adobedtm.com	gwinnett.savings.workingadvantage.com assets.adobedtm.com auth.savings.workingadvantage.com
6	auth.savings.workingadvantage.com	1 redirects gwinnett.savings.workingadvantage.com auth.savings.workingadvantage.com
4	www.googletagmanager.com	gwinnett.savings.workingadvantage.com auth.savings.workingadvantage.com
4	dpm.demdex.net	1 redirects gwinnett.savings.workingadvantage.com auth.savings.workingadvantage.com
4	cdnjs.cloudflare.com	gwinnett.savings.workingadvantage.com auth.savings.workingadvantage.com
4	maps.googleapis.com	gwinnett.savings.workingadvantage.com maps.googleapis.com auth.savings.workingadvantage.com
4	cdn.jsdelivr.net	gwinnett.savings.workingadvantage.com auth.savings.workingadvantage.com
3	fonts.googleapis.com	gwinnett.savings.workingadvantage.com auth.savings.workingadvantage.com
2	stats.g.doubleclick.net	gwinnett.savings.workingadvantage.com
2	fonts.gstatic.com	fonts.googleapis.com
2	smetrics.workingadvantage.com	assets.adobedtm.com auth.savings.workingadvantage.com
2	entertainmentbenefitsgroupllc.demdex.net	assets.adobedtm.com
2	code.jquery.com	gwinnett.savings.workingadvantage.com auth.savings.workingadvantage.com
1	starget.workingadvantage.com	auth.savings.workingadvantage.com
1	cm.everesttech.net	1 redirects
1	e.email.workingadvantage.com	1 redirects
75	19

This site contains no links.

Subject Issuer	Validity	Valid
workingadvantage.com Cloudflare Inc ECC CA-3	`2022-05-10` - `2023-05-09`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-10` - `2022-09-10`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
smetrics.workingadvantage.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-05` - `2022-08-05`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-25` - `2022-08-17`	3 months	crt.sh
beneplace.com Cloudflare Inc ECC CA-3	`2022-01-30` - `2023-01-30`	a year	crt.sh
starget.ticketsatwork.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-09` - `2023-02-09`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta
Frame ID: A004F9F62C641582DB69FAE9C865A193
Requests: 74 HTTP requests in this frame

Frame: https://entertainmentbenefitsgroupllc.demdex.net/dest5.html?d_nsid=0
Frame ID: 8AFBB03D0CE1F3806A63D75F6A639DB8
Requests: 1 HTTP requests in this frame

Frame: https://entertainmentbenefitsgroupllc.demdex.net/dest5.html?d_nsid=0
Frame ID: DEFCA042B8F94D7554372B420800FE59
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Beneplace Team Discounts

Page URL History Show full URLs

https://e.email.workingadvantage.com/click?EYW5nZWxhLnR1cm5lckBnY3BzazEyLm9yZw/CeyJtaWQiOiIxNjU1MjE2MjUyMDY1MDM4N... HTTP 302
https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombu... Page URL
https://auth.savings.workingadvantage.com/auth/authorize?subdomain=gwinnett&response_type=code&client_id=9ezalirn45mF4... HTTP 302
https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_sou... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

<script [^>]*src="[^"]*/popper\.js/([0-9.]+)
/popper\.js/([0-9.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

75
Requests

97 %
HTTPS

56 %
IPv6

13
Domains

19
Subdomains

17
IPs

6
Countries

2204 kB
Transfer

8596 kB
Size

12
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://e.email.workingadvantage.com/click?EYW5nZWxhLnR1cm5lckBnY3BzazEyLm9yZw/CeyJtaWQiOiIxNjU1MjE2MjUyMDY1MDM4NWQ0MjVjMmMzIiwiY3QiOiJlYmctd2FnMy0xYjAwNTg5NmZkNjBiMTI3ZmViNTY2ZjZkNjk4YTgyNC0wIiwicmQiOiJnY3BzazEyLm9yZyJ9/HWkhfZWJnd2FfTkRCQU0wNjE0MjAyMjU5NzA3MDAsZWIyLGh0dHBzOi8vZ3dpbm5ldHQuc2F2aW5ncy53b3JraW5nYWR2YW50YWdlLmNvbS8/qP3V0bV9jYW1wYWlnbj1XZWxjb21lMS1XQUczJnV0bV9tZWRpdW09V2VsY29tZTEtV0FHMyZ1dG1fc291cmNlPUVtYWlsJmZyb21idWxsZXRpbj0xJmNsdGhhc2g9JmNtcGlkPTE1MTEwMyZ1aWQ9JmNvbnZfc291cmNlPXpldGE/sve2d52dd8f HTTP 302
https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta Page URL
https://auth.savings.workingadvantage.com/auth/authorize?subdomain=gwinnett&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta HTTP 302
https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://e.email.workingadvantage.com/click?EYW5nZWxhLnR1cm5lckBnY3BzazEyLm9yZw/CeyJtaWQiOiIxNjU1MjE2MjUyMDY1MDM4NWQ0MjVjMmMzIiwiY3QiOiJlYmctd2FnMy0xYjAwNTg5NmZkNjBiMTI3ZmViNTY2ZjZkNjk4YTgyNC0wIiwicmQiOiJnY3BzazEyLm9yZyJ9/HWkhfZWJnd2FfTkRCQU0wNjE0MjAyMjU5NzA3MDAsZWIyLGh0dHBzOi8vZ3dpbm5ldHQuc2F2aW5ncy53b3JraW5nYWR2YW50YWdlLmNvbS8/qP3V0bV9jYW1wYWlnbj1XZWxjb21lMS1XQUczJnV0bV9tZWRpdW09V2VsY29tZTEtV0FHMyZ1dG1fc291cmNlPUVtYWlsJmZyb21idWxsZXRpbj0xJmNsdGhhc2g9JmNtcGlkPTE1MTEwMyZ1aWQ9JmNvbnZfc291cmNlPXpldGE/sve2d52dd8f HTTP 302
https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta

Request Chain 14

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1655300146359 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1655300146359

Request Chain 19

https://cm.everesttech.net/cm/dd?d_uuid=42459494381210374562741071333947573771 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YqngMgAAAKIcqANx

75 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
gwinnett.savings.workingadvantage.com/
Redirect Chain

https://e.email.workingadvantage.com/click?EYW5nZWxhLnR1cm5lckBnY3BzazEyLm9yZw/CeyJtaWQiOiIxNjU1MjE2MjUyMDY1MDM4NWQ0MjVjMmMzIiwiY3QiOiJlYmctd2FnMy0xYjAwNTg5NmZkNjBiMTI3ZmViNTY2ZjZkNjk4YTgyNC0wIiwic...
https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta

4 KB
3 KB

212ms
157ms

Document
text/html

172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

850847f092a74112a6690ab57bf3fcea82ca41d9f70d43de1f0b70a5a7ef1d41

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 71bbb0d7eda890d4-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
content-type: text/html; charset=utf-8
date: Wed, 15 Jun 2022 13:35:46 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Wed, 08 Jun 2022 01:12:09 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Wed, 15 Jun 2022 13:35:45 GMT
Keep-Alive: timeout=5, max=100
Location: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
Server: Apache
Strict-Transport-Security: max-age=60
X-Powered-By: PHP/7.3.33

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 513 KB
132 KB 99ms
20ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ae02e22172f5a9bdfbff834b9246d7df02d4410bbe931eca201ee5050a23ccfd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: gzip
last-modified: Thu, 17 Mar 2022 03:33:46 GMT
server: AkamaiNetStorage
etag: "676c70c5d70000c3166aa484963398a2:1647488026.832258"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 134135
expires: Wed, 15 Jun 2022 14:35:46 GMT

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 87ms
38ms Stylesheet
text/css 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
Origin: https://gwinnett.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7445633
x-jsd-version: 4.5.3
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19143-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2BOrpxEeKSpkyJYeXsBdlOHTbcjMdAsA2Rj6qTvw9iVV6PiC1aLKURJMr8YCth7JJWb%2F6fPu8BiWG9jjQwnp4ThwYA83bq14jSZ4RUKmvZzwNooE7AwuG2SLpuZ%2Bz0ZJ3%2FcFZgjOXjhDaMp9r2M%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 71bbb0d9ec1e9010-FRA

GET
H2 200 css
fonts.googleapis.com/ 3 KB
933 B 79ms
28ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700,900

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5ef043454b128260dda530a42312fbb985505034036cd3f3ea23cfe324a7905b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 11:42:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 15 Jun 2022 13:35:46 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 15 Jun 2022 13:35:46 GMT

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 164 KB
54 KB 220ms
169ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

26c3c9b7985012c01d01c91147a22224645154e80ad327e8f616a8ab3197121d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: gzip
vary: Accept-Language
server: mafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=13
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54688
x-xss-protection: 0
expires: Wed, 15 Jun 2022 14:05:46 GMT

GET
H2 200 styles.227104c5c758384d8bac.css
gwinnett.savings.workingadvantage.com/ 153 KB
20 KB 499ms
497ms Stylesheet
text/css 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/styles.227104c5c758384d8bac.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9ce1228c79208149d1a08c37264d7fc82a4cbdfe02ccba9a64b3186775db965

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Jun 2022 01:12:08 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629ff768-263e2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
strict-transport-security: max-age=5184000; includeSubDomains
cf-ray: 71bbb0d998a690d4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 api.js Show response
gwinnett.savings.workingadvantage.com/cdn-cgi/bm/cv/669835187/ 35 KB
9 KB 28ms
27ms Script
text/javascript 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/cdn-cgi/bm/cv/669835187/api.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=5184000; includeSubDomains
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=604800, public
cf-ray: 71bbb0db18bd915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery-3.5.1.slim.min.js Show response
code.jquery.com/ 71 KB
24 KB 78ms
27ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.slim.min.js
Requested by: Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
Origin: https://gwinnett.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-11abc"
vary: Accept-Encoding
x-hw: 1655300146.dop001.fr8.t,1655300146.cds003.fr8.hn,1655300146.cds240.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 24606

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/ 21 KB
7 KB 73ms
27ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
Origin: https://gwinnett.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 479947
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6646
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-520c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uS009MpYXlFGjcPyThh1oYD7o15JYE1RVfNYsqU8EC1F%2BZs1jrj6bk9BMriVc9ErhNYzs3ECq5QQUeifusxMVa9ZNE8hiarzqMSPFgwN32ak%2FHRFJecsWqmtjEX29vEj50sZtldhTVslu7M31yvEIMxc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71bbb0d9e9808fe0-FRA
expires: Mon, 05 Jun 2023 13:35:46 GMT

GET
H2 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ 82 KB
23 KB 82ms
36ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/bootstrap.bundle.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
Origin: https://gwinnett.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7445630
x-jsd-version: 4.5.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19178-FRA, cache-hhn4051-HHN
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"148b8-qycDEVlyTiQh9v9ccPSOZXq+nTk"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bsqYAI6XmpNWS6b4yYWgWsnBBFUfH%2FoftdzNeMAakoe%2BYqerlU39oaKaCzm5qLTx15NzVsKsgE9kGX7SjfJDqo%2FskYvvETy%2FKki834ZW26C4F5W5pHjBfKYNzoQ%2FlDPxXdJKnJzweLECW2FW%2BEI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 71bbb0d9ec219010-FRA

GET
H2 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 73ms
27ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 12202774
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13763
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=onvpcNqxx51yLcOBT4A9ywhMSBK%2FqRIXY%2Fp5wNZN15WmRw%2BJrTtRHXXpUkHfW4T%2BVXKb3lek51XxwhF2L4t7QY3teA%2F1ui%2FbPEPDvXitIyH89nuJN1FO6UOlTtfPFvzfVAwUvfxln7UX7li4Sjyhzj2d"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71bbb0d9e8229079-FRA
expires: Mon, 05 Jun 2023 13:35:46 GMT

GET
H3 200 runtime.0f3ac861c40560c67fdd.js Show response
gwinnett.savings.workingadvantage.com/ 3 KB
2 KB 160ms
159ms Script
application/javascript 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/runtime.0f3ac861c40560c67fdd.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec3f5353565727983d325e58926d32c0ed8ef6a2a1eef264e9a9bcaa363eb4ff

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Jun 2022 01:12:08 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629ff768-a5c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
strict-transport-security: max-age=5184000; includeSubDomains
cf-ray: 71bbb0db18c3915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 polyfills.b9d9e6a9e2bd25627a0e.js Show response
gwinnett.savings.workingadvantage.com/ 138 KB
46 KB 166ms
165ms Script
application/javascript 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b6489ec68513cd93386bfefef39af09523fbd026f46f80d13bf216197ae4cfd

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Jun 2022 01:12:08 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629ff768-2293d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
strict-transport-security: max-age=5184000; includeSubDomains
cf-ray: 71bbb0db18c5915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 main.e60167b0e7469ee824d1.js Show response
gwinnett.savings.workingadvantage.com/ 4 MB
856 KB 180ms
180ms Script
application/javascript 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/main.e60167b0e7469ee824d1.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd879413c5b867666ca24ff629ae5aa3de01773f79914f1136d0668b33ae4e1f

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Jun 2022 01:12:08 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629ff768-3af177"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
strict-transport-security: max-age=5184000; includeSubDomains
cf-ray: 71bbb0db18c8915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1655300146359
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1655300146359

388 B
1 KB

53ms
53ms

XHR
application/json

108.128.0.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1655300146359

Requested by

Protocol

HTTP/1.1

Server

108.128.0.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-108-128-0-238.eu-west-1.compute.amazonaws.com

Software

Resource Hash

b4401336b62d7f4b6a571caaefdf2f8cfd2150bd694e8b13c8b5bd1faaf5d8f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v034-07176562c.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: yadVF96MQlg=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://gwinnett.savings.workingadvantage.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 323
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v034-087a1f9d4.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://gwinnett.savings.workingadvantage.com
X-TID: 9MOBnkhrTX8=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1655300146359
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 21ms
21ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Wed, 15 Jun 2022 14:35:46 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 22ms
22ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Wed, 15 Jun 2022 14:35:46 GMT

GET
H/1.1 200
OK dest5.html Show response
entertainmentbenefitsgroupllc.demdex.net/ Frame 8AFB 7 KB
3 KB 164ms
43ms Document
text/html 34.249.212.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://entertainmentbenefitsgroupllc.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.212.46 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-212-46.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v034-0f505efce.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: gngdtv5lS6k=
content-encoding: gzip
date: Wed, 15 Jun 2022 13:35:46 GMT
last-modified: Wed, 8 Jun 2022 13:40:06 GMT
vary: accept-encoding

GET
H2 200 id Show response
smetrics.workingadvantage.com/ 48 B
530 B 107ms
34ms XHR
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.workingadvantage.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&mid=42425265115364534232740126170707427252&ts=1655300146602

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

2e0e8a20711458edf54ceb0bc72cd555abfde237a0eb5d23eaf9e2b0d778fb77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-df488f754-kdggv
vary: Origin
x-c: main-1645.Id526ce.M0-571
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YqngMgAAAKIcqANx
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=42459494381210374562741071333947573771
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YqngMgAAAKIcqANx

42 B
945 B

46ms
46ms

Image
image/gif

108.128.0.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YqngMgAAAKIcqANx

Requested by

Protocol

HTTP/1.1

Server

108.128.0.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-108-128-0-238.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v034-058ca741f.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: rn3sX8v8S5I=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YqngMgAAAKIcqANx
Date: Wed, 15 Jun 2022 13:35:46 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 142ms
75ms XHR
application/json 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ 23 KB
24 KB 80ms
21ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gwinnett.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Tue, 14 Jun 2022 17:07:14 GMT
x-content-type-options: nosniff
age: 73712
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Jun 2023 17:07:14 GMT

GET
H3 200 info Show response
gwinnett.savings.workingadvantage.com/api/ 6 KB
2 KB 157ms
157ms XHR
application/json 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/api/info

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f3f89f99fee8590da3ec8b7500fd76995a6e359dc07febac6be54b6764502d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:47 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
etag: W/"1750-hdQrB6BfyxfZohr6/Y1EFivUFCM"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=5184000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://gwinnett.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0df8a9b915f-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:46 GMT

GET
H3 200 marketplace-styles.css Show response
gwinnett.savings.workingadvantage.com/api/gwinnett/ 31 KB
5 KB 1105ms
1105ms XHR
text/css 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/api/gwinnett/marketplace-styles.css

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8a4ecac81c06d9774c02d32d358f21ce7ad1c4ead617a579d63d923afab31bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:48 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
etag: W/"7a5b-l0QPAhOf8UXGSTxPmRbHRuGSNew"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=5184000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://gwinnett.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0df8a9c915f-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:47 GMT

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/webp

POST
H3 204 result Show response
gwinnett.savings.workingadvantage.com/cdn-cgi/bm/cv/ 0
485 B 25ms
24ms XHR
text/plain 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/cdn-cgi/bm/cv/result?req_id=71bbb0d7eda890d4

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
date: Wed, 15 Jun 2022 13:35:47 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-ray: 71bbb0e04c21915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 gwinnett Show response
gwinnett.savings.workingadvantage.com/api/controls/ 2 KB
1 KB 191ms
190ms XHR
application/json 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/api/controls/gwinnett

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3031a2c046ec72b75ab467d1097905b62ee4cbdb4e3e307023baa8f10ca29e88

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:47 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
etag: W/"761-x5HLMHL0r78sfZxDURZlxEyznoc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=5184000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://gwinnett.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0e08c9c915f-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:46 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 105 KB
40 KB 100ms
50ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/main.e60167b0e7469ee824d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

97a5227815f288434eabbffcccddb39b9c0d3ee735dc2de00d1c3f032dee0ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:48 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40936
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 15 Jun 2022 13:35:48 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 101 KB
39 KB 79ms
29ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2876877-9

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/main.e60167b0e7469ee824d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

00638be88249475fc3a69e924a16ceea26c960b182d1d1fdc4c758dd7b23d38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:48 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39751
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 15 Jun 2022 13:35:48 GMT

GET
H3 200 info
gwinnett.savings.workingadvantage.com/api/ 7 KB
2 KB 867ms
867ms XHR
text/html 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.workingadvantage.com/api/info?authInfo=true

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://gwinnett.savings.workingadvantage.com/?utm_campaign=Welcome1-WAG3&utm_medium=Welcome1-WAG3&utm_source=Email&frombulletin=1&clthash=&cmpid=151103&uid=&conv_source=zeta
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=5184000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://gwinnett.savings.workingadvantage.com
vary: Accept-Encoding, Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0e698c1915f-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:48 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 70ms
21ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2876877-9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 2801
date: Wed, 15 Jun 2022 12:49:07 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 15 Jun 2022 14:49:07 GMT

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 105 KB
40 KB 83ms
43ms Script
application/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-KLXJRH5&t=gtag_UA_2876877_9&cid=519933445.1655300148

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

315e35f12dafc669b0e40b2d1c22214020c7d8673047457969a6c5ea8fc48a51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:48 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41248
x-xss-protection: 0
expires: Wed, 15 Jun 2022 13:35:48 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 27ms
27ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1664960448&t=pageview&_s=1&dl=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Gwinnett%20County%20Public%20Schools%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&exp=BVuyTtv7SUSJfpOtu3Nh2A.1&_u=aGBAAUADQAAAAC~&jid=492140575&gjid=1711601783&cid=519933445.1655300148&tid=UA-2876877-9&_gid=490742031.1655300148&_r=1&gtm=2ou6d0&z=1786973211

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 15 Jun 2022 13:35:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 27ms
27ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1664960448&t=pageview&_s=1&dl=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Gwinnett%20County%20Public%20Schools%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAUADQAAAAC~&jid=759701118&gjid=310664370&cid=519933445.1655300148&tid=UA-2876877-9&_gid=490742031.1655300148&_r=1&gtm=2wg6d05QN8HWM&z=1342630407

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 15 Jun 2022 13:35:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 19ms
19ms Image
image/gif 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1664960448&t=event&_s=1&dl=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Gwinnett%20County%20Public%20Schools%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=BVuyTtv7SUSJfpOtu3Nh2A&ea=experiment-chosen.interaction&el=1&_u=aGDAAUADQAAAAC~&jid=&gjid=&cid=519933445.1655300148&tid=UA-2876877-9&_gid=490742031.1655300148&gtm=2wg6d05QN8HWM&z=217930391

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gwinnett.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Jun 2022 10:21:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 11640
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
454 B 81ms
26ms XHR
text/plain 2a00:1450:400c:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2876877-9&cid=519933445.1655300148&jid=492140575&gjid=1711601783&_gid=490742031.1655300148&_u=aGBAAUACQAAAAC~&z=1967690011

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 15 Jun 2022 13:35:48 GMT
content-type: text/plain
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
67 B 79ms
27ms XHR
text/plain 2a00:1450:400c:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2876877-9&cid=519933445.1655300148&jid=759701118&gjid=310664370&_gid=490742031.1655300148&_u=aGDAAUADQAAAAC~&z=520870977

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/polyfills.b9d9e6a9e2bd25627a0e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 15 Jun 2022 13:35:48 GMT
content-type: text/plain
access-control-allow-origin: https://gwinnett.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

Primary Request sign-in Show response
auth.savings.workingadvantage.com/gwinnett/
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=gwinnett&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&...
https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=http...

4 KB
2 KB

157ms
156ms

Document
text/html

172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta

Requested by

Host: gwinnett.savings.workingadvantage.com
URL: https://gwinnett.savings.workingadvantage.com/main.e60167b0e7469ee824d1.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11f9f8a3ff02b045ea9de6815a6b95c5aa23bc34cd8f0179f4ffa1263f8d006e

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://gwinnett.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 71bbb0edc8cc915f-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
content-type: text/html; charset=utf-8
date: Wed, 15 Jun 2022 13:35:49 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Wed, 08 Jun 2022 01:15:44 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 71bbb0ec1fd390d4-FRA
content-type: text/html; charset=utf-8
date: Wed, 15 Jun 2022 13:35:49 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Wed, 15 Jun 2022 13:35:48 GMT
location: /gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 513 KB
132 KB 22ms
17ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ae02e22172f5a9bdfbff834b9246d7df02d4410bbe931eca201ee5050a23ccfd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: gzip
last-modified: Thu, 17 Mar 2022 03:33:46 GMT
server: AkamaiNetStorage
etag: "676c70c5d70000c3166aa484963398a2:1647488026.832258"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 134135
expires: Wed, 15 Jun 2022 14:35:49 GMT

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 77ms
52ms Stylesheet
text/css 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7445636
x-jsd-version: 4.5.3
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19143-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s9%2B6e41Zp9krbV6gJcRjj%2FINKGrmhLxkfeh1sualxt5YvmVEfzKD2V4I8JFcRplLmkAW%2FrprVpeee3VYSth5lX9f4mwrbXaCCaWXhEDsHsH5Qft6hE4hCSx9PEf2nB6RNncgZGw9LxyW0arGvgo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 71bbb0eeef2b903a-FRA

GET
H3 200 css
fonts.googleapis.com/ 3 KB
431 B 73ms
29ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700,900

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5ef043454b128260dda530a42312fbb985505034036cd3f3ea23cfe324a7905b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 13:32:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 15 Jun 2022 13:35:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H3 200 css
fonts.googleapis.com/ 2 KB
539 B 73ms
29ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:500

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

42fc207ebec992c03f7e8b3bf2f56ed07d798add6da0d4e91777eef7c9262875

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 11:45:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 15 Jun 2022 13:35:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 164 KB
53 KB 228ms
185ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

26c3c9b7985012c01d01c91147a22224645154e80ad327e8f616a8ab3197121d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: gzip
vary: Accept-Language
server: mafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=12
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54688
x-xss-protection: 0
expires: Wed, 15 Jun 2022 14:05:49 GMT

GET
H3 200 styles.6681dfd5edea42f6750a.css
auth.savings.workingadvantage.com/ 23 KB
6 KB 415ms
413ms Stylesheet
text/css 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/styles.6681dfd5edea42f6750a.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e129a2af01a0a7afd364e616c7e9f6561aab29655970183503d53a395c67de46

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Jun 2022 01:15:44 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629ff840-5d2f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
strict-transport-security: max-age=5184000; includeSubDomains
cf-ray: 71bbb0eecab0915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 jquery-3.5.1.slim.min.js Show response
code.jquery.com/ 71 KB
24 KB 25ms
23ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.slim.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-11abc"
vary: Accept-Encoding
x-hw: 1655300149.dop001.fr8.t,1655300149.cds003.fr8.hn,1655300149.cds240.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 24606

GET
H3 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/ 21 KB
7 KB 69ms
30ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 479950
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6646
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-520c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hNjWIWnLEYYN5c8LpH3aw9bf4zn2AfKKsIu9h5x3bNYypI8bnMbrU6yLIpphMsQcazxriCuhUAmXYscJoSeRyz%2BMo4rLDhBtPVsY0kTqSN6VYUU74ulwmFN2ejBNgYFxcqw317mJtqbs%2FwowGNyk2u8V"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71bbb0ef0b009036-FRA
expires: Mon, 05 Jun 2023 13:35:49 GMT

GET
H3 200 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ 82 KB
23 KB 55ms
33ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/bootstrap.bundle.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7445633
x-jsd-version: 4.5.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19178-FRA, cache-hhn4051-HHN
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"148b8-qycDEVlyTiQh9v9ccPSOZXq+nTk"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B9OJ7OYFILs3EMoZtwSgtOX2xKUUIFQ0b5N4pXcH1180zxTEYo2xJYE9fUZbjtl%2FoQ%2F7CNgHoochA7xBEBVvufBWxuXEtYoD5R%2BneXvzP57iW%2Fktebd1ocwnYb%2BMl7heGoZQuy0v983SIqpOV4Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 71bbb0eeef2e903a-FRA

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 54ms
30ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8450427
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13763
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mE9ccZbJezbw0P1lSfRmcvx2I9JGT91ooxx%2F9eZ7%2FaZFrhtWvt0xdJFumPVHK0pH67RD0cLtn6AN9IUW5EE5Lz%2FIUsJ6HKrnaRBjsXViokv8sj0EEI4kyqsrMQ%2FcWvw9OpyLclr6neY9wBYmcDzEvkCt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71bbb0eef8a16963-FRA
expires: Mon, 05 Jun 2023 13:35:49 GMT

GET
H3 200 runtime.458556a34b891ea32398.js Show response
auth.savings.workingadvantage.com/ 1 KB
1 KB 147ms
145ms Script
application/javascript 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/runtime.458556a34b891ea32398.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c5acbb82a46a4971660f65131241dffcc28828f4dbd76b8ec7bab0b468250f8

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Jun 2022 01:15:44 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629ff840-5cd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
strict-transport-security: max-age=5184000; includeSubDomains
cf-ray: 71bbb0f00d07915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 polyfills.b2c3db03c7d82b03025e.js Show response
auth.savings.workingadvantage.com/ 122 KB
42 KB 150ms
149ms Script
application/javascript 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

413df6044aa06b1799e22c1e9988938572f677aae4a4292c7d682d4b5fc3e372

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Jun 2022 01:15:44 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629ff840-1e936"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
strict-transport-security: max-age=5184000; includeSubDomains
cf-ray: 71bbb0f00d0b915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 main.26d9d52831c847831f5f.js Show response
auth.savings.workingadvantage.com/ 1 MB
299 KB 153ms
152ms Script
application/javascript 172.64.151.143
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/main.26d9d52831c847831f5f.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.151.143 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e56b29ced86570b59725511a81ebdae483cc1d91836e3c8fa0486bc85b58fb7

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/gwinnett/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=Email&utm_medium=Welcome1-WAG3&utm_campaign=Welcome1-WAG3&redirect_uri=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F%3Futm_campaign%3DWelcome1-WAG3%26utm_medium%3DWelcome1-WAG3%26utm_source%3DEmail%26frombulletin%3D1%26clthash%3D%26cmpid%3D151103%26uid%3D%26conv_source%3Dzeta
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Jun 2022 01:15:44 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"629ff840-15569f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io
strict-transport-security: max-age=5184000; includeSubDomains
cf-ray: 71bbb0f00d0c915f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 20ms
19ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Wed, 15 Jun 2022 14:35:49 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 20ms
20ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:49 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Wed, 15 Jun 2022 14:35:49 GMT

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ 23 KB
23 KB 63ms
20ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,900

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Tue, 14 Jun 2022 17:07:14 GMT
x-content-type-options: nosniff
age: 73716
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Jun 2023 17:07:14 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 37ms
37ms XHR
application/json 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H2 200 system-wide Show response
gwinnett.savings.beneplace.com/api/notifications/ 2 B
320 B 238ms
176ms XHR
application/json 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/notifications/system-wide

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f2afa0910a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H2 200 info Show response
gwinnett.savings.beneplace.com/api/ 7 KB
2 KB 224ms
163ms XHR
text/html 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

18898819ea54e0472f146883c252e8ca269af3e7f6fcbf2f3360e80e2681f72a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Accept-Encoding, Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f2afa1910a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H2 200 info Show response
gwinnett.savings.beneplace.com/api/ 7 KB
3 KB 218ms
157ms XHR
text/html 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

18898819ea54e0472f146883c252e8ca269af3e7f6fcbf2f3360e80e2681f72a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Accept-Encoding, Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f2afa2910a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H2 200 info Show response
gwinnett.savings.beneplace.com/api/ 6 KB
2 KB 358ms
298ms XHR
text/html 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/info

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

0f3f89f99fee8590da3ec8b7500fd76995a6e359dc07febac6be54b6764502d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Accept-Encoding, Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f2afa4910a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H2 200 gwinnett Show response
gwinnett.savings.beneplace.com/api/controls/ 2 KB
1 KB 262ms
203ms XHR
application/json 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/controls/gwinnett

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

3031a2c046ec72b75ab467d1097905b62ee4cbdb4e3e307023baa8f10ca29e88

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
etag: W/"761-x5HLMHL0r78sfZxDURZlxEyznoc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f2afa5910a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H2 200 marketplace-styles.css Show response
gwinnett.savings.beneplace.com/api/gwinnett/ 31 KB
5 KB 342ms
283ms XHR
text/css 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/gwinnett/marketplace-styles.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

b8a4ecac81c06d9774c02d32d358f21ce7ad1c4ead617a579d63d923afab31bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
etag: W/"7a5b-l0QPAhOf8UXGSTxPmRbHRuGSNew"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f2afa8910a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H2 200 auth-v2 Show response
gwinnett.savings.beneplace.com/api/google-experiments/ 4 KB
2 KB 533ms
475ms XHR
application/json 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/google-experiments/auth-v2

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

a83eaf590f2c078872c01c0f332037dc8fef2a3a2f925d9d8ea5425d0172cf99

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
etag: W/"fd8-xTrkXE581f1SQMoUGwMfCAmZvJg"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f2afa7910a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H3 200 auth Show response
gwinnett.savings.beneplace.com/api/navigation/gwinnett/auth_footer/US/ 959 B
1 KB 208ms
181ms XHR
application/json 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/navigation/gwinnett/auth_footer/US/auth

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

0f1fcdbb7a1a7887a3bc1cb0a7db80ce3e3915ab3e5dd0a57ad4bbc69a92036a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
etag: W/"3bf-k9flXPfpO3tpAFCU3xDY23+lqkg"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f3d9629b95-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:49 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 105 KB
40 KB 71ms
31ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/main.26d9d52831c847831f5f.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

97a5227815f288434eabbffcccddb39b9c0d3ee735dc2de00d1c3f032dee0ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:50 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40936
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 15 Jun 2022 13:35:50 GMT

GET
H3 200 gwinnett Show response
gwinnett.savings.beneplace.com/api/controls/ 2 KB
1 KB 601ms
600ms XHR
application/json 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/controls/gwinnett

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

3031a2c046ec72b75ab467d1097905b62ee4cbdb4e3e307023baa8f10ca29e88

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
etag: W/"761-x5HLMHL0r78sfZxDURZlxEyznoc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f59d999b95-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:50 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 2803
date: Wed, 15 Jun 2022 12:49:07 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 15 Jun 2022 14:49:07 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 20ms
20ms Image
image/gif 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=48289766&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fgwinnett%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3DEmail%26utm_medium%3DWelcome1-WAG3%26utm_campaign%3DWelcome1-WAG3%26redirect_uri%3Dhttps%253A%252F%252Fgwinnett.savings.workingadvantage.com%252F%253Futm_campaign%253DWelcome1-WAG3%2526utm_medium%253DWelcome1-WAG3%2526utm_source%253DEmail%2526frombulletin%253D1%2526clthash%253D%2526cmpid%253D151103%2526uid%253D%2526conv_source%253Dzeta&dr=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEAB~&jid=&gjid=&cid=519933445.1655300148&tid=UA-2876877-9&_gid=490742031.1655300148&gtm=2wg6d05QN8HWM&z=1185322113

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Jun 2022 10:21:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 11642
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 101 KB
39 KB 33ms
32ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2876877-9

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/main.26d9d52831c847831f5f.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

00638be88249475fc3a69e924a16ceea26c960b182d1d1fdc4c758dd7b23d38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:51 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39751
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 15 Jun 2022 13:35:51 GMT

GET
H3 200 info
gwinnett.savings.beneplace.com/api/ 7 KB
3 KB 687ms
686ms XHR
text/html 172.64.144.61

General

Check archive.org

Show headers Download Go to

Full URL

https://gwinnett.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.144.61 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
vary: Accept-Encoding, Origin
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 71bbb0f98f3e9b95-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Wed, 15 Jun 2022 13:35:50 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
21ms Image
image/gif 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=48289766&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fgwinnett%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3DEmail%26utm_medium%3DWelcome1-WAG3%26utm_campaign%3DWelcome1-WAG3%26redirect_uri%3Dhttps%3A%252F%252Fgwinnett.savings.workingadvantage.com%252F%253Futm_campaign%253DWelcome1-WAG3%2526utm_medium%253DWelcome1-WAG3%2526utm_source%253DEmail%2526frombulletin%253D1%2526clthash%253D%2526cmpid%253D151103%2526uid%253D%2526conv_source%253Dzeta&dr=https%3A%2F%2Fgwinnett.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Gwinnett%20County%20Public%20Schools%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEAB~&jid=&gjid=&cid=519933445.1655300148&tid=UA-2876877-9&_gid=490742031.1655300148&gtm=2wg6d05QN8HWM&z=508856384

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Jun 2022 10:21:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 11643
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 RC3e5728f70053438ba19dcab0d47fa3df-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/1405d3870fab/ 594 B
639 B 20ms
20ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/1405d3870fab/RC3e5728f70053438ba19dcab0d47fa3df-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8cfc9c317d8a8e0d820df771fb1018159d78aaab856dc2b52fb2f0c074b87f67

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:51 GMT
content-encoding: gzip
last-modified: Thu, 17 Mar 2022 03:33:48 GMT
server: AkamaiNetStorage
etag: "9a06da61c3edfe360503cc4c32010eb7:1647488028.169394"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 361
expires: Wed, 15 Jun 2022 14:35:51 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 388 B
1 KB 44ms
44ms XHR
application/json 108.128.0.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&d_mid=42425265115364534232740126170707427252&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=adobe_ecid%0142425265115364534232740126170707427252&ts=1655300151292

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

108.128.0.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-108-128-0-238.eu-west-1.compute.amazonaws.com

Software

Resource Hash

b6fd384be4bf4832e5682b8b079020997d54927eae9cb3537edf6c6ace346553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v034-0c7706e1f.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: 6Tz+UnU/TTY=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://auth.savings.workingadvantage.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 324
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 RC264ccfd21d5b400cab1786e7daef4de0-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/1405d3870fab/ 757 B
706 B 20ms
19ms Script
application/x-javascript 2a02:26f0:3500:591::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/1405d3870fab/RC264ccfd21d5b400cab1786e7daef4de0-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:591::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5e4081d4bfd00ddf188998b64b08f5271722f398f1026abe10b1e8fd3d86baf3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 13:35:51 GMT
content-encoding: gzip
last-modified: Thu, 17 Mar 2022 03:33:48 GMT
server: AkamaiNetStorage
etag: "9a06da61c3edfe360503cc4c32010eb7:1647488028.169394"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 428
expires: Wed, 15 Jun 2022 14:35:51 GMT

POST
H2 200 delivery Show response
starget.workingadvantage.com/rest/v1/ 517 B
814 B 180ms
49ms XHR
application/json 52.212.242.20

General

Check archive.org

Show headers Download Go to

Full URL: https://starget.workingadvantage.com/rest/v1/delivery?client=entertainmentbenefit&sessionId=e3a6db2976d64ba49b8b8d018b65c376&version=2.8.1
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.242.20 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1acf4f1e010b2df057b6f2570f6f8fb8e12ad426af94b41a4a25865ed1fc3571

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 15 Jun 2022 13:35:51 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: e006450416ae073206ce28776fb5299f

GET
H/1.1 200
OK dest5.html Show response
entertainmentbenefitsgroupllc.demdex.net/ Frame DEFC 7 KB
3 KB 40ms
40ms Document
text/html 34.249.212.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://entertainmentbenefitsgroupllc.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.212.46 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-212-46.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://auth.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v034-0b5dc734a.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 98D//J7zSHc=
content-encoding: gzip
date: Wed, 15 Jun 2022 13:35:51 GMT
last-modified: Wed, 8 Jun 2022 13:40:06 GMT
transfer-encoding: chunked
vary: accept-encoding

POST
H2 200 s89196144740703 Show response
smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LBWB/ 43 B
387 B 34ms
33ms XHR
image/gif 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LBWB/s89196144740703

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/polyfills.b2c3db03c7d82b03025e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 15 Jun 2022 13:35:51 GMT
x-content-type-options: nosniff
x-c: main-1645.Id526ce.M0-571
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 16 Jun 2022 13:35:51 GMT
server: jag
xserver: anedge-df488f754-z7hpw
etag: 3554730007873683456-4619901237028020819
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Tue, 14 Jun 2022 13:35:51 GMT

Verdicts & Comments Add Verdict or Comment

184 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-20 08:07:32	Name: demdex Value: 42459494381210374562741071333947573771
.workingadvantage.com/	1969-12-31 23:59:59	Name: AMCVS_B5F9FF2554F608410A4C98C6%40AdobeOrg Value: 1
.workingadvantage.com/	1970-01-20 21:19:32	Name: s_ecid Value: MCMID%7C42425265115364534232740126170707427252
.everesttech.net/	1970-01-20 12:33:56	Name: everest_g_v2 Value: g_surferid~YqngMgAAAKIcqANx
.dpm.demdex.net/	1970-01-20 08:07:32	Name: dpm Value: 42459494381210374562741071333947573771
.workingadvantage.com/	1970-01-20 21:20:58	Name: AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19159%7CMCMID%7C42425265115364534232740126170707427252%7CMCAAMLH-1655904946%7C6%7CMCAAMB-1655904946%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1655307346s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19166%7CvVersion%7C5.4.0
.workingadvantage.com/	1970-01-20 03:48:21	Name: __cf_bm Value: YaRKZwCB3GZceguvY43kGTFUpSCI59k5_UqOh.QuTW0-1655300147-0-AQOHOG/5HQMBpJMfJ1RFf47qVwp5tvd4iTSuU47PmECLLwCDck5Suli6mMTsOXIUaK47q1jf9XO6lGCrH98jLNSJhvZju61eGwjMvMjSfwaDwIdO2XcvgMGml6kYPEmp0AuhGzfYTTyR6hERwW2t95QaLGHHxhNfz1EmOdcIC6iq
.workingadvantage.com/	1970-01-20 21:19:32	Name: _ga Value: GA1.2.519933445.1655300148
.workingadvantage.com/	1970-01-20 03:49:46	Name: _gid Value: GA1.2.490742031.1655300148
.workingadvantage.com/	1970-01-20 04:53:45	Name: _gaexp Value: GAX1.2.BVuyTtv7SUSJfpOtu3Nh2A.19204.1
.workingadvantage.com/	1970-01-20 03:48:20	Name: _gat_gtag_UA_2876877_9 Value: 1
.workingadvantage.com/	1970-01-20 03:48:20	Name: _gat_UA-2876877-9 Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
auth.savings.workingadvantage.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
cm.everesttech.net
code.jquery.com
dpm.demdex.net
e.email.workingadvantage.com
entertainmentbenefitsgroupllc.demdex.net
fonts.googleapis.com
fonts.gstatic.com
gwinnett.savings.beneplace.com
gwinnett.savings.workingadvantage.com
maps.googleapis.com
smetrics.workingadvantage.com
starget.workingadvantage.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
108.128.0.238
15.188.95.229
172.64.144.61
172.64.151.143
2001:4de0:ac18::1:a:1a
2606:4700::6810:5614
2606:4700::6811:190e
2a00:1450:4001:809::2008
2a00:1450:4001:809::200e
2a00:1450:4001:80b::200a
2a00:1450:4001:812::200a
2a00:1450:4001:82b::2003
2a00:1450:400c:c09::9a
2a02:26f0:3500:591::1e80
34.249.212.46
52.212.242.20
63.32.153.188
96.47.24.171
00638be88249475fc3a69e924a16ceea26c960b182d1d1fdc4c758dd7b23d38d
05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
0f1fcdbb7a1a7887a3bc1cb0a7db80ce3e3915ab3e5dd0a57ad4bbc69a92036a
0f3f89f99fee8590da3ec8b7500fd76995a6e359dc07febac6be54b6764502d5
11f9f8a3ff02b045ea9de6815a6b95c5aa23bc34cd8f0179f4ffa1263f8d006e
18898819ea54e0472f146883c252e8ca269af3e7f6fcbf2f3360e80e2681f72a
1acf4f1e010b2df057b6f2570f6f8fb8e12ad426af94b41a4a25865ed1fc3571
26c3c9b7985012c01d01c91147a22224645154e80ad327e8f616a8ab3197121d
2e0e8a20711458edf54ceb0bc72cd555abfde237a0eb5d23eaf9e2b0d778fb77
3031a2c046ec72b75ab467d1097905b62ee4cbdb4e3e307023baa8f10ca29e88
315e35f12dafc669b0e40b2d1c22214020c7d8673047457969a6c5ea8fc48a51
3e56b29ced86570b59725511a81ebdae483cc1d91836e3c8fa0486bc85b58fb7
413df6044aa06b1799e22c1e9988938572f677aae4a4292c7d682d4b5fc3e372
42fc207ebec992c03f7e8b3bf2f56ed07d798add6da0d4e91777eef7c9262875
462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
5b6489ec68513cd93386bfefef39af09523fbd026f46f80d13bf216197ae4cfd
5e4081d4bfd00ddf188998b64b08f5271722f398f1026abe10b1e8fd3d86baf3
5ef043454b128260dda530a42312fbb985505034036cd3f3ea23cfe324a7905b
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c5acbb82a46a4971660f65131241dffcc28828f4dbd76b8ec7bab0b468250f8
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
850847f092a74112a6690ab57bf3fcea82ca41d9f70d43de1f0b70a5a7ef1d41
8cfc9c317d8a8e0d820df771fb1018159d78aaab856dc2b52fb2f0c074b87f67
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
97a5227815f288434eabbffcccddb39b9c0d3ee735dc2de00d1c3f032dee0ca5
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a83eaf590f2c078872c01c0f332037dc8fef2a3a2f925d9d8ea5425d0172cf99
a9ce1228c79208149d1a08c37264d7fc82a4cbdfe02ccba9a64b3186775db965
ae02e22172f5a9bdfbff834b9246d7df02d4410bbe931eca201ee5050a23ccfd
b4401336b62d7f4b6a571caaefdf2f8cfd2150bd694e8b13c8b5bd1faaf5d8f9
b6fd384be4bf4832e5682b8b079020997d54927eae9cb3537edf6c6ace346553
b8a4ecac81c06d9774c02d32d358f21ce7ad1c4ead617a579d63d923afab31bf
bd879413c5b867666ca24ff629ae5aa3de01773f79914f1136d0668b33ae4e1f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e129a2af01a0a7afd364e616c7e9f6561aab29655970183503d53a395c67de46
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
ec3f5353565727983d325e58926d32c0ed8ef6a2a1eef264e9a9bcaa363eb4ff
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

auth.savings.workingadvantage.com Open in urlscan Pro 172.64.151.143 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

75 Requests

97 %HTTPS

56 %IPv6

13 Domains

19 Subdomains

17 IPs

6 Countries

2204 kBTransfer

8596 kBSize

12 Cookies

0 Outgoing links

Page URL History

Redirected requests

75 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

auth.savings.workingadvantage.com Open in urlscan Pro
172.64.151.143 Public Scan

Screenshot
Live screenshot

Full Image

75
Requests

97 %
HTTPS

56 %
IPv6

13
Domains

19
Subdomains

17
IPs

6
Countries

2204 kB
Transfer

8596 kB
Size

12
Cookies

75 HTTP transactions
1 data transactions