Submitted URL: https://e.email.workingadvantage.com/click/EYWxseXNvbi5sb3phbm9Ac3dlZGlzaC5vcmc/CeyJtaWQiOiIxNjMzMzU5OTY2MTQ0ZjE4MjJhNGI1OWQ2IiwiY3Qi...
Effective URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Submission: On October 12 via api from US — Scanned from DE

Summary

This website contacted 62 IPs in 7 countries across 46 domains to perform 161 HTTP transactions. The main IP is 104.18.21.78, located in and belongs to CLOUDFLARENET, US. The main domain is www.workingadvantage.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 4th 2021. Valid for: a year.
This is the only time www.workingadvantage.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 96.47.20.26 46263 (EDIALOG)
2 38 104.18.21.78 13335 (CLOUDFLAR...)
1 54.236.154.122 14618 (AMAZON-AES)
9 2.21.141.223 16625 (AKAMAI-AS)
3 142.250.186.106 15169 (GOOGLE)
4 104.111.225.94 16625 (AKAMAI-AS)
2 173.201.201.4 26496 (AS-26496-...)
2 104.111.234.67 16625 (AKAMAI-AS)
1 4 52.48.145.41 16509 (AMAZON-02)
1 2 18.66.248.60 16509 (AMAZON-02)
11 199.101.26.126 33411 (BRIGHTPAT...)
3 142.250.184.227 15169 (GOOGLE)
2 142.250.186.46 15169 (GOOGLE)
2 142.250.185.72 15169 (GOOGLE)
1 23.111.9.38 33438 (HIGHWINDS2)
1 18.200.233.208 16509 (AMAZON-02)
3 15.188.95.229 16509 (AMAZON-02)
1 1 54.194.191.134 16509 (AMAZON-02)
1 18.203.190.43 16509 (AMAZON-02)
1 192.28.147.68 15224 (OMNITURE)
2 6 142.250.185.166 15169 (GOOGLE)
1 54.69.84.146 16509 (AMAZON-02)
1 108.177.15.155 15169 (GOOGLE)
1 18.66.97.36 16509 (AMAZON-02)
2 199.38.167.35 54312 (ROCKETFUEL)
1 18.66.248.33 16509 (AMAZON-02)
2 142.250.184.196 15169 (GOOGLE)
2 172.217.18.99 15169 (GOOGLE)
1 142.250.185.162 15169 (GOOGLE)
2 18.66.242.229 16509 (AMAZON-02)
1 34.195.31.102 14618 (AMAZON-AES)
2 6 193.0.160.128 54312 (ROCKETFUEL)
2 54.88.197.125 14618 (AMAZON-AES)
2 172.217.18.98 15169 (GOOGLE)
1 2 37.252.172.38 29990 (ASN-APPNEX)
1 142.250.181.226 15169 (GOOGLE)
4 207.244.84.210 30633 (LEASEWEB-...)
2 91.228.74.189 16509 (AMAZON-02)
1 18.66.248.13 16509 (AMAZON-02)
2 2 142.250.185.194 15169 (GOOGLE)
1 37.252.172.37 29990 (ASN-APPNEX)
1 2 104.111.215.191 16625 (AKAMAI-AS)
1 69.173.144.165 26667 (RUBICONPR...)
1 2 3.122.214.165 16509 (AMAZON-02)
1 2.21.140.74 16625 (AKAMAI-AS)
1 54.93.158.246 16509 (AMAZON-02)
1 3 35.244.174.68 15169 (GOOGLE)
1 52.200.156.204 14618 (AMAZON-AES)
1 2 2.21.141.232 16625 (AKAMAI-AS)
1 2 185.94.180.125 35220 (SPOTX-AMS)
1 52.206.168.194 14618 (AMAZON-AES)
1 18.169.90.17 16509 (AMAZON-02)
1 52.48.23.163 16509 (AMAZON-02)
1 2 3.127.209.187 16509 (AMAZON-02)
1 1 151.101.194.49 54113 (FASTLY)
3 35.165.115.120 16509 (AMAZON-02)
2 18.66.140.77 16509 (AMAZON-02)
1 52.54.221.90 14618 (AMAZON-AES)
8 104.17.209.240 13335 (CLOUDFLAR...)
1 151.101.2.137 54113 (FASTLY)
2 162.247.243.146 13335 (CLOUDFLAR...)
3 104.17.208.240 13335 (CLOUDFLAR...)
3 44.225.29.129 16509 (AMAZON-02)
1 44.238.130.186 16509 (AMAZON-02)
2 2 76.223.111.131 16509 (AMAZON-02)
1 52.19.133.118 16509 (AMAZON-02)
161 62
Apex Domain
Subdomains
Transfer
46 workingadvantage.com
e.email.workingadvantage.com
www.workingadvantage.com
initjs.rfk.workingadvantage.com
smetrics.workingadvantage.com
starget.workingadvantage.com
alweb.rfk.workingadvantage.com
526 KB
11 qualtrics.com
zn5bxs0kfcxmozrm9-ebg.siteintercept.qualtrics.com
siteintercept.qualtrics.com
86 KB
11 brightpattern.com
ebgcc.brightpattern.com
105 KB
10 doubleclick.net
6479484.fls.doubleclick.net
9767737.fls.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
4 KB
9 kaltura.com
cdnapisec.kaltura.com
stats.kaltura.com
cfvod.kaltura.com
analytics.kaltura.com
949 KB
9 adobedtm.com
assets.adobedtm.com
152 KB
6 rfihub.com
20835101p.rfihub.com
a.rfihub.com
p.rfihub.com
9 KB
5 steelhousemedia.com
dx.steelhousemedia.com
px.steelhousemedia.com
ww.steelhousemedia.com
9 KB
5 mouseflow.com
cdn.mouseflow.com
n2.mouseflow.com
59 KB
5 demdex.net
dpm.demdex.net
entertainmentbenefitsgroupllc.demdex.net
7 KB
4 google.com
www.google.com
adservice.google.com
1 KB
3 adsrvr.org
match.adsrvr.org
insight.adsrvr.org
1 KB
3 rlcdn.com
idsync.rlcdn.com
1011 B
3 adnxs.com
secure.adnxs.com
ib.adnxs.com
2 KB
3 boomtrain.com
cdn.boomtrain.com
people.api.boomtrain.com
events.api.boomtrain.com
24 KB
3 gstatic.com
fonts.gstatic.com
61 KB
3 googleapis.com
fonts.googleapis.com
3 KB
2 nr-data.net
bam-cell.nr-data.net
1 KB
2 bidswitch.net
x.bidswitch.net
1 KB
2 spotxchange.com
sync.search.spotxchange.com
1 KB
2 casalemedia.com
dsum-sec.casalemedia.com
2 KB
2 eyeota.net
ps.eyeota.net
1 KB
2 quantserve.com
secure.quantserve.com
pixel.quantserve.com
9 KB
2 cloudfront.net
d26opx5dl8t69i.cloudfront.net
86 KB
2 google.de
www.google.de
586 B
2 netmng.com
com-workadv.netmng.com
6 KB
2 everesttech.net
cm.everesttech.net
sync-tm.everesttech.net
733 B
2 googletagmanager.com
www.googletagmanager.com
84 KB
2 google-analytics.com
www.google-analytics.com
20 KB
2 rezync.com
live.rezync.com
6 KB
2 marketo.net
munchkin.marketo.net
6 KB
2 godaddy.com
seal.godaddy.com
6 KB
1 newrelic.com
js-agent.newrelic.com
16 KB
1 krxd.net
beacon.krxd.net
338 B
1 agkn.com
aa.agkn.com
238 B
1 tremorhub.com
partners.tremorhub.com
183 B
1 addthis.com
x.dlx.addthis.com
191 B
1 rtactivate.com
bpi.rtactivate.com
109 B
1 serving-sys.com
bs.serving-sys.com
105 B
1 media.net
contextual.media.net
696 B
1 rubiconproject.com
pixel.rubiconproject.com
239 B
1 bluekai.com
stags.bluekai.com
676 B
1 quantcount.com
rules.quantcount.com
355 B
1 googleadservices.com
www.googleadservices.com
15 KB
1 rfihub.net
c1.rfihub.net
6 KB
1 mktoresp.com
409-bcn-480.mktoresp.com
311 B
161 46
Domain Requested by
38 www.workingadvantage.com 2 redirects www.workingadvantage.com
11 ebgcc.brightpattern.com www.workingadvantage.com
ebgcc.brightpattern.com
10 siteintercept.qualtrics.com www.workingadvantage.com
9 assets.adobedtm.com www.workingadvantage.com
assets.adobedtm.com
4 p.rfihub.com 2 redirects www.workingadvantage.com
4 n2.mouseflow.com www.workingadvantage.com
4 dpm.demdex.net 1 redirects www.workingadvantage.com
4 cdnapisec.kaltura.com www.workingadvantage.com
3 px.steelhousemedia.com www.workingadvantage.com
3 idsync.rlcdn.com 1 redirects www.workingadvantage.com
3 9767737.fls.doubleclick.net 1 redirects www.googletagmanager.com
www.workingadvantage.com
3 6479484.fls.doubleclick.net 1 redirects www.googletagmanager.com
www.workingadvantage.com
3 smetrics.workingadvantage.com www.workingadvantage.com
3 fonts.gstatic.com fonts.googleapis.com
3 fonts.googleapis.com www.workingadvantage.com
2 match.adsrvr.org 2 redirects
2 bam-cell.nr-data.net www.workingadvantage.com
2 cfvod.kaltura.com www.workingadvantage.com
2 stats.kaltura.com www.workingadvantage.com
2 x.bidswitch.net 1 redirects www.workingadvantage.com
2 sync.search.spotxchange.com 1 redirects www.workingadvantage.com
2 dsum-sec.casalemedia.com 1 redirects www.workingadvantage.com
2 ps.eyeota.net 1 redirects www.workingadvantage.com
2 cm.g.doubleclick.net 2 redirects
2 secure.adnxs.com 1 redirects 6479484.fls.doubleclick.net
2 adservice.google.com 9767737.fls.doubleclick.net
6479484.fls.doubleclick.net
2 alweb.rfk.workingadvantage.com www.workingadvantage.com
2 d26opx5dl8t69i.cloudfront.net www.workingadvantage.com
2 www.google.de www.workingadvantage.com
2 www.google.com www.workingadvantage.com
2 com-workadv.netmng.com www.workingadvantage.com
2 www.googletagmanager.com www.workingadvantage.com
2 www.google-analytics.com www.workingadvantage.com
2 live.rezync.com 1 redirects www.workingadvantage.com
2 munchkin.marketo.net www.workingadvantage.com
2 seal.godaddy.com www.workingadvantage.com
1 insight.adsrvr.org
1 ww.steelhousemedia.com www.workingadvantage.com
1 js-agent.newrelic.com www.workingadvantage.com
1 zn5bxs0kfcxmozrm9-ebg.siteintercept.qualtrics.com www.workingadvantage.com
1 pixel.quantserve.com www.workingadvantage.com
1 events.api.boomtrain.com www.workingadvantage.com
1 analytics.kaltura.com www.workingadvantage.com
1 sync-tm.everesttech.net 1 redirects
1 beacon.krxd.net www.workingadvantage.com
1 aa.agkn.com www.workingadvantage.com
1 partners.tremorhub.com www.workingadvantage.com
1 x.dlx.addthis.com www.workingadvantage.com
1 bpi.rtactivate.com www.workingadvantage.com
1 bs.serving-sys.com www.workingadvantage.com
1 contextual.media.net www.workingadvantage.com
1 pixel.rubiconproject.com www.workingadvantage.com
1 stags.bluekai.com 1 redirects
1 ib.adnxs.com www.workingadvantage.com
1 a.rfihub.com www.workingadvantage.com
1 rules.quantcount.com www.workingadvantage.com
1 secure.quantserve.com www.workingadvantage.com
1 googleads.g.doubleclick.net www.workingadvantage.com
1 20835101p.rfihub.com www.workingadvantage.com
1 people.api.boomtrain.com www.workingadvantage.com
1 www.googleadservices.com www.workingadvantage.com
1 cdn.boomtrain.com www.workingadvantage.com
1 c1.rfihub.net www.workingadvantage.com
1 stats.g.doubleclick.net www.workingadvantage.com
1 dx.steelhousemedia.com www.workingadvantage.com
1 409-bcn-480.mktoresp.com munchkin.marketo.net
1 starget.workingadvantage.com www.workingadvantage.com
1 cm.everesttech.net 1 redirects
1 entertainmentbenefitsgroupllc.demdex.net www.workingadvantage.com
1 cdn.mouseflow.com www.workingadvantage.com
1 initjs.rfk.workingadvantage.com www.workingadvantage.com
1 e.email.workingadvantage.com 1 redirects
161 72

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-07-04 -
2022-07-03
a year crt.sh
*.rfk.plumbenefits.com
Amazon
2021-03-18 -
2022-04-16
a year crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1
2021-09-10 -
2022-09-10
a year crt.sh
upload.video.google.com
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
*.kaltura.com
DigiCert SHA2 Secure Server CA
2021-06-14 -
2022-06-22
a year crt.sh
mastercert.ext.pki.godaddy.com
Go Daddy Secure Certificate Authority - G2
2021-09-10 -
2022-10-12
a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2021-03-29 -
2022-04-06
a year crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1
2020-12-02 -
2022-01-02
a year crt.sh
*.rezync.com
Amazon
2021-01-26 -
2022-02-23
a year crt.sh
*.brightpattern.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2020-10-26 -
2021-11-26
a year crt.sh
*.gstatic.com
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
*.google-analytics.com
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
*.mouseflow.com
Sectigo RSA Domain Validation Secure Server CA
2020-06-12 -
2022-09-14
2 years crt.sh
smetrics.workingadvantage.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-05 -
2022-08-05
a year crt.sh
starget.ticketsatwork.com
DigiCert SHA2 High Assurance Server CA
2020-03-09 -
2022-03-14
2 years crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA
2020-01-17 -
2022-01-21
2 years crt.sh
*.doubleclick.net
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
*.steelhousemedia.com
Go Daddy Secure Certificate Authority - G2
2020-05-27 -
2022-07-16
2 years crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
*.rfihub.net
Sectigo RSA Domain Validation Secure Server CA
2021-02-10 -
2022-02-10
a year crt.sh
*.netmng.com
Sectigo RSA Domain Validation Secure Server CA
2021-02-04 -
2022-02-04
a year crt.sh
cdn.boomtrain.com
Amazon
2021-03-16 -
2022-04-14
a year crt.sh
www.google.com
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
www.google.de
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
www.googleadservices.com
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
*.cloudfront.net
Amazon
2021-03-19 -
2022-03-17
a year crt.sh
*.api.boomtrain.com
Amazon
2020-12-16 -
2022-01-14
a year crt.sh
*.rfihub.com
Sectigo RSA Domain Validation Secure Server CA
2020-06-18 -
2022-06-18
2 years crt.sh
*.google.com
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2021-03-05 -
2022-02-19
a year crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1
2021-09-22 -
2022-09-21
a year crt.sh
*.google.de
GTS CA 1C3
2021-09-13 -
2021-11-20
2 months crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1
2021-03-30 -
2022-04-04
a year crt.sh
*.eyeota.net
R3
2021-08-27 -
2021-11-25
3 months crt.sh
*.media.net
DigiCert SHA2 Secure Server CA
2021-04-12 -
2022-04-20
a year crt.sh
bs.serving-sys.com
Amazon
2021-05-10 -
2022-06-08
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2021-02-25 -
2022-03-28
a year crt.sh
rtactivate.com
Amazon
2021-05-13 -
2022-06-11
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2021-02-05 -
2022-02-09
a year crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2021-04-25 -
2022-04-26
a year crt.sh
*.search.spotxchange.com
GeoTrust RSA CA 2018
2021-04-08 -
2022-05-09
a year crt.sh
*.tremorhub.com
Amazon
2021-06-27 -
2022-07-26
a year crt.sh
*.agkn.com
RapidSSL RSA CA 2018
2020-07-25 -
2022-09-18
2 years crt.sh
beacon.krxd.net
DigiCert TLS RSA SHA256 2020 CA1
2021-01-13 -
2022-01-07
a year crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA
2020-04-23 -
2022-05-04
2 years crt.sh
*.qualtrics.com
DigiCert SHA2 Secure Server CA
2020-10-26 -
2021-11-26
a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA H2 2021
2021-10-06 -
2022-11-07
a year crt.sh
*.nr-data.net
DigiCert SHA2 Secure Server CA
2020-02-05 -
2022-02-08
2 years crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2021-03-18 -
2022-04-19
a year crt.sh

This page contains 6 frames:

Primary Page: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Frame ID: EB1A1E66791932413D6E02C0F09A9454
Requests: 128 HTTP requests in this frame

Frame: https://entertainmentbenefitsgroupllc.demdex.net/dest5.html?d_nsid=0
Frame ID: 6FC3911815802EBC1E65840DACD400C0
Requests: 1 HTTP requests in this frame

Frame: https://6479484.fls.doubleclick.net/activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll
Frame ID: 2C52A5EFFC5BDBF61BD6FF8A7B1BCD90
Requests: 3 HTTP requests in this frame

Frame: https://9767737.fls.doubleclick.net/activityi;dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll
Frame ID: 2A7CB2961548E520DE0DBF7148806539
Requests: 2 HTTP requests in this frame

Frame: https://20835101p.rfihub.com/ca.html?ver=9&rb=42748&ca=20835101&pid=&pname=&ptype=&cust4=account%3A%20enroll&cust5=register_enroll&cust6=&cust7=&cust8=&cust9=&cust10=&cust11=&cust12=&cust13=&cust14=&cust15=&cust16=&cust17=&cust18=&cust19=&pe=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&pf=&ra=3289683482349699
Frame ID: 51DE584D11C31DBF1C2801DA6E55F256
Requests: 20 HTTP requests in this frame

Frame: https://cdnapisec.kaltura.com/html5/html5lib/v2.90/load.php?debug=false&lang=en&modules=Hlsjs%2CPolyfill_Set%2CacCheck%2CacPreview%2Cbase64_decode%2Cbase64_encode%2Cclass%2CcontrolBarContainer%2CcurrentTimeLabel%2CdurationLabel%2CexpandToggleBtn%2Cid3Tag%2CkAnalony%2Ckdark%2CkeyboardShortcuts%2CkgitGuard%2ClargePlayBtn%2CliveStream%2CmatchMedia%2CmorePlugins%2CnativeBridge%2CplayPauseBtn%2Cpolyfill_Array_filter%2CqualitySettings%2CreportError%2Cscreenfull%2Cscrubber%2CsideBarContainer%2CsourceSelector%2CstatisticsPlugin%2CtopBarContainer%2CunMuteOverlayButton%2Cutf8_encode%2CvolumeControl%7Cjquery.client%2Ccolor%2Ccookie%2Cdebouncedresize%2ChoverIntent%2CmessageBox%2CmwEmbedUtil%2CmwExtension%2CnaturalSize%7Cjquery.ui.core%2Cmouse%2Cposition%2Cslider%2Ctooltip%2CtouchPunch%2Cwidget%7Cmediawiki.Uri%2CUtilitiesTime%2CUtilitiesUrl%2Cclient%2CjqueryMsg%2Ckmenu%2Clanguage%2Cutil%7Cmediawiki.util.tmpl%7Cmw.EmbedPlayer%2CEmbedPlayerImageOverlay%2CEmbedPlayerKplayer%2CEmbedPlayerNative%2CEmbedPlayerNativeComponent%2CEmbedTypes%2CKAnalytics%2CKBaseButton%2CKBaseComponent%2CKBasePlugin%2CKBaseSmartContainer%2CKCuePoints%2CKDPMapping%2CKEntryLoader%2CKWidgetSupport%2CKalturaIframePlayerSetup%2CMediaElement%2CMediaPlayer%2CMediaPlayers%2CMediaSource%2CPlayerElement%2CPlayerElementFlash%2CPlayerElementHTML%2CPluginManager%7Cmw.MwEmbedSupport.style&pskwidgetpath=..%2Fkwidget-ps%2F&skin=no-theme&version=20210805T073204Z&*&protocol=https&wid=_1093992
Frame ID: C1071258313DD25F5E323F566FAFA590
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

Working Advantage - Employee Discounts

Page URL History Show full URLs

  1. https://e.email.workingadvantage.com/click/EYWxseXNvbi5sb3phbm9Ac3dlZGlzaC5vcmc/CeyJtaWQiOiIxNjMzMzU5OTY2MTQ0ZjE4... HTTP 302
    https://www.workingadvantage.com/hotels.php?sub=destination&id=3&utm_campaign=las-vegas&utm_medium=October-4-... HTTP 302
    https://www.workingadvantage.com/hotels.php?sub=destination&id=3&utm_campaign=las-vegas&utm_medium=October-4-... HTTP 302
    https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_sour... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.mouseflow\.com

Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Overall confidence: 100%
Detected patterns
  • serving-sys\.com/

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery-ui[.-]([\d.]*\d)[^/]*\.js
  • jquery-ui.*\.js

Page Statistics

161
Requests

100 %
HTTPS

0 %
IPv6

46
Domains

72
Subdomains

62
IPs

7
Countries

2259 kB
Transfer

6554 kB
Size

70
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://e.email.workingadvantage.com/click/EYWxseXNvbi5sb3phbm9Ac3dlZGlzaC5vcmc/CeyJtaWQiOiIxNjMzMzU5OTY2MTQ0ZjE4MjJhNGI1OWQ2IiwiY3QiOiJlYmctd2EtZmMyZmIyM2M4NjllZWIwNTA5NDMxZTdmMGVmYWMzYWEtMSIsInJkIjoic3dlZGlzaC5vcmcifQ/HWkhfZWJnd2FfTkRCQU0xMDA0MjAyMTQ3ODg0MTEsZWIyLGh0dHBzOi8vd3d3LndvcmtpbmdhZHZhbnRhZ2UuY29tL2hvdGVscy5waHA/qP3N1Yj1kZXN0aW5hdGlvbiZpZD0zJnV0bV9jYW1wYWlnbj1sYXMtdmVnYXMmdXRtX21lZGl1bT1PY3RvYmVyLTQtMjAyMS1Ib3RlbHMmdXRtX3NvdXJjZT1FbWFpbCZmcm9tYnVsbGV0aW49MSZjbHRoYXNoPTkzMTM0ZDE5OWEyNTJhZTRhZjJjMWIzN2FkMTA3OWU4ODBhYWM1NTkmY21waWQ9ODE3NjkmdWlkPTEzMjM1NjAzJmNvbnZfc291cmNlPXpldGEmYnRfZWU9NEpHNm4lMkI2SWpQWTRHMHY4YlhCTkpqZXZTQTIlMkJIZGFvMmZ2d0tOa3ZmSlZuSzRlcjh6MkNlVEZPUG13Y2NlVnUmYnRfdHM9MTYzMzM1OTkyODE2Mw/sf8beeb77c1 HTTP 302
    https://www.workingadvantage.com/hotels.php?sub=destination&id=3&utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&frombulletin=1&clthash=93134d199a252ae4af2c1b37ad1079e880aac559&cmpid=81769&uid=13235603&conv_source=zeta&bt_ee=4JG6n%2B6IjPY4G0v8bXBNJjevSA2%2BHdao2fvwKNkvfJVnK4er8z2CeTFOPmwcceVu&bt_ts=1633359928163 HTTP 302
    https://www.workingadvantage.com/hotels.php?sub=destination&id=3&utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&clthash=93134d199a252ae4af2c1b37ad1079e880aac559&uid=13235603&conv_source=zeta&bt_ee=4JG6n+6IjPY4G0v8bXBNJjevSA2+Hdao2fvwKNkvfJVnK4er8z2CeTFOPmwcceVu&bt_ts=1633359928163 HTTP 302
    https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37
  • https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1634056434719 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1634056434719
Request Chain 55
  • https://cm.everesttech.net/cm/dd?d_uuid=25786024725159799883330558477773717055 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YWW48wAAALL47QP7
Request Chain 60
  • https://6479484.fls.doubleclick.net/activityi;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll HTTP 302
  • https://6479484.fls.doubleclick.net/activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll
Request Chain 61
  • https://9767737.fls.doubleclick.net/activityi;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll HTTP 302
  • https://9767737.fls.doubleclick.net/activityi;dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll
Request Chain 80
  • https://secure.adnxs.com/seg?add=8083872&t=2 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D8083872%26t%3D2
Request Chain 95
  • https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTE0MjMzNjcxODQ3Nzc4NDkxMA==&forward= HTTP 302
  • https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEO-Cp6v-8t1bPKqOA3gwNmo&google_cver=1
Request Chain 97
  • https://stags.bluekai.com/site/4722?id=5142336718477784910&redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fbk_uuid%3D%24_BK_UUID%26forward%3D HTTP 302
  • https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
Request Chain 100
  • https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
  • https://ps.eyeota.net/match?uid=5142336718477784910&bid=omt9pi0 HTTP 302
  • https://ps.eyeota.net/match/bounce/?uid=5142336718477784910&bid=omt9pi0
Request Chain 103
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5142336718477784910&referrer=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll HTTP 302
  • https://p.rfihub.com/cm?pub=39342&in=0&userid=4ad13cba-0a4b-4a8b-8d8f-eb5fdecdd4e9%3A1634056434.99&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D4ad13cba-0a4b-4a8b-8d8f-eb5fdecdd4e9%253A1634056434.99 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=4ad13cba-0a4b-4a8b-8d8f-eb5fdecdd4e9%3A1634056434.99 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEIN2WvV2eok7RRYGYwPGeQ0&google_cver=1
Request Chain 105
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336718477784910&forward= HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336718477784910&forward=&C=1
Request Chain 108
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336718477784910&img=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336718477784910&img=1&__user_check__=1&sync_id=317b4e59-2b7a-11ec-b27f-1ee5b9e10106
Request Chain 112
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=5142336718477784910&expires=30 HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5142336718477784910&expires=30
Request Chain 113
  • https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=21653&userid=YWW48wAAALL47QP7
Request Chain 158
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8&gdpr=&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8&gdpr=&gdpr_consent= HTTP 302
  • https://px.steelhousemedia.com/tdsync?tdid=04d7bca9-6a52-4353-be00-36bc94ac014e&shguid=32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8

161 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request account.php
www.workingadvantage.com/
Redirect Chain
  • https://e.email.workingadvantage.com/click/EYWxseXNvbi5sb3phbm9Ac3dlZGlzaC5vcmc/CeyJtaWQiOiIxNjMzMzU5OTY2MTQ0ZjE4MjJhNGI1OWQ2IiwiY3QiOiJlYmctd2EtZmMyZmIyM2M4NjllZWIwNTA5NDMxZTdmMGVmYWMzYWEtMSIsInJk...
  • https://www.workingadvantage.com/hotels.php?sub=destination&id=3&utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&frombulletin=1&clthash=93134d199a252ae4af2c1b37ad1079e880aa...
  • https://www.workingadvantage.com/hotels.php?sub=destination&id=3&utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&clthash=93134d199a252ae4af2c1b37ad1079e880aac559&uid=132356...
  • https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
290 KB
61 KB
Document
General
Full URL
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c93c4bd92a045a3b0286dbf2479915dad14ef11b9a586d9b0fa38e72d443e5c0
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.workingadvantage.com
:scheme
https
:path
/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-type
text/html; charset=utf-8
x-content-type-options
nosniff
x-xss-protection
1; mode=block
strict-transport-security
max-age=5184000; includeSubDomains
x-frame-options
SAMEORIGIN
referrer-policy
unsafe-url
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
User-Agent
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
69d1bb89a9a5c49f-DUS
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
x-xss-protection
1; mode=block
strict-transport-security
max-age=5184000; includeSubDomains
x-frame-options
SAMEORIGIN
referrer-policy
unsafe-url
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
User-Agent
location
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
69d1bb85d9fcfae5-DUS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
li.js
www.workingadvantage.com/common_resources/js/
25 KB
5 KB
Script
General
Full URL
https://www.workingadvantage.com/common_resources/js/li.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e9228e9660ad4173083cb4d622c22d33c09a1e5a99967a8c5dae1ffcc9259782
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/common_resources/js/li.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Fri, 23 Jul 2021 18:54:32 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"6519-5c7ceef16ea00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f52c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
interaction_analytics.js
www.workingadvantage.com/common_resources/js/
5 KB
2 KB
Script
General
Full URL
https://www.workingadvantage.com/common_resources/js/interaction_analytics.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce90b8602f4c03d98edd426e4f219012297257690a293fefdc4f7224890701f0
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/common_resources/js/interaction_analytics.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Thu, 04 Feb 2021 14:41:46 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1438-5ba83b3f1be80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f55c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
init.js
initjs.rfk.workingadvantage.com/rfk/js/11273-152007103/
15 KB
7 KB
Script
General
Full URL
https://initjs.rfk.workingadvantage.com/rfk/js/11273-152007103/init.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.236.154.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-236-154-122.compute-1.amazonaws.com
Software
gunicorn/19.6.0 /
Resource Hash
71fefd9910d55cc985b4e37b50099474f5632a041e405bdcb09cebaa9a35fa68

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
cache-control
max-age=600
content-type
application/javascript
server
gunicorn/19.6.0
content-encoding
gzip
expires
Tue, 12 Oct 2021 16:43:55 GMT
launch-3ef1ffa7e1d7.min.js
assets.adobedtm.com/a281455e4dfe/1c19d10a0484/
520 KB
134 KB
Script
General
Full URL
https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/launch-3ef1ffa7e1d7.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
461f8bdb1fc92eff81d447bdcaaf81910be0875ed1eda757822aaa20a5e8198f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
gzip
last-modified
Tue, 05 Oct 2021 17:48:57 GMT
server
AkamaiNetStorage
etag
"4a3ee465a3c343fd0ea3e4937d6c57ef:1633456137.392993"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
136541
expires
Tue, 12 Oct 2021 17:33:54 GMT
reset.css
www.workingadvantage.com/css/
1 KB
1 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/reset.css?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d24d4a11bd569cd44e25a8c36341f9669fa448d55bbad6c993ac3362e852711
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/reset.css?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 05 Sep 2017 19:27:16 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"443-558763704cd00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f59c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
grid.css
www.workingadvantage.com/css/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/grid.css?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f45c73c0747a0f7b5e5eec6fbc6250a562a0a009b04012eaf80aa52d4e51a55a
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/grid.css?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Wed, 07 Jul 2021 13:26:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1161-5c6887b6ac500"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f5bc49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
site.css
www.workingadvantage.com/css/
56 KB
12 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/site.css?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c6ff2453e82bbbe81b215b46fa26be3e4b0265fa18f28f44908504f4abe4123
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/site.css?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 17 May 2021 14:55:21 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"dfce-5c287c855e840"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f5dc49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
jquery-ui-1.10.3.custom.min.css
www.workingadvantage.com/css/ui-lightness/
27 KB
6 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/ui-lightness/jquery-ui-1.10.3.custom.min.css?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dcf743efbf47f310fd9243d9aa78f4c3f6ee8ea260ad2f3d17a4fdda2479ab7
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/ui-lightness/jquery-ui-1.10.3.custom.min.css?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 05 Sep 2017 19:26:59 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"6a13-55876360166c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f5fc49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
chosen.min.css
www.workingadvantage.com/css/
11 KB
3 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/chosen.min.css?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
40073d8997c3dd31bc10edfd8601660cad988a7601170e17b19f4331eaf5c6e9
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/chosen.min.css?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 05 Sep 2017 19:27:16 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2d72-558763704cd00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f62c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
font-awesome.min.css
www.workingadvantage.com/css/
27 KB
7 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/font-awesome.min.css?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4bcb0f820377a5dc80f3f43d991c950d5442ad601328305c0b52785c984bce48
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/font-awesome.min.css?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 05 Sep 2017 19:27:18 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"6b38-5587637235180"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f63c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
menu_default.css
www.workingadvantage.com/css/
10 KB
3 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/menu_default.css?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
176bfb0e73f4480f870fdf93e5f45624e7fc171b7d4adbc10d6475a382efd604
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/menu_default.css?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Wed, 29 Jul 2020 12:58:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2700-5ab941b1dca80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f66c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
register_enroll.css
www.workingadvantage.com/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/register_enroll.css?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9c1d54cd634cba994b1fc6060948e0b843354b01aefd178a51dc9c91ce1a8c1
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/register_enroll.css?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Wed, 29 Jul 2020 12:58:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1d52-5ab941b1dca80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f6ac49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
css
fonts.googleapis.com/
2 KB
488 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Lato:300,400,900
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f10.1e100.net
Software
ESF /
Resource Hash
83a921154ba4d9cbb1666930210a10ea9757a344dd7774385ffa5af2ff2aabd4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 12 Oct 2021 15:59:38 GMT
server
ESF
date
Tue, 12 Oct 2021 16:33:54 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires
Tue, 12 Oct 2021 16:33:54 GMT
css
fonts.googleapis.com/
2 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Oswald
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f10.1e100.net
Software
ESF /
Resource Hash
731ee3bbaa9f2fd92879f9087c9fbbf7438d3a52595c6c8a8020bb2a69b7afd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 12 Oct 2021 15:30:46 GMT
server
ESF
date
Tue, 12 Oct 2021 16:33:54 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires
Tue, 12 Oct 2021 16:33:54 GMT
css
fonts.googleapis.com/
8 KB
870 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Nunito:300,400|Open+Sans:400,600
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f10.1e100.net
Software
ESF /
Resource Hash
6134f8469fa5e47ec82d8676bb730a48e5257ba7ab63c216caa8446eb899a8ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 12 Oct 2021 16:23:07 GMT
server
ESF
date
Tue, 12 Oct 2021 16:33:54 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires
Tue, 12 Oct 2021 16:33:54 GMT
jquery-3.5.1.min.js
www.workingadvantage.com/common_resources/js/
87 KB
32 KB
Script
General
Full URL
https://www.workingadvantage.com/common_resources/js/jquery-3.5.1.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/common_resources/js/jquery-3.5.1.min.js
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 31 Aug 2020 15:45:29 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"15d84-5ae2e4aba3840"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f6ec49f-DUS
jquery-ui-1.12.1.custom.min.js
www.workingadvantage.com/js/
248 KB
68 KB
Script
General
Full URL
https://www.workingadvantage.com/js/jquery-ui-1.12.1.custom.min.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f69ebbd9d36211cef558cb24f539fb4c6ad866dc603cdc8f588ee3f63dbe3b5d
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/jquery-ui-1.12.1.custom.min.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 08 Jul 2019 13:02:21 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3def0-58d2b0df7b140"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f72c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
jquery-migrate-3.0.0.min.js
www.workingadvantage.com/js/
7 KB
3 KB
Script
General
Full URL
https://www.workingadvantage.com/js/jquery-migrate-3.0.0.min.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a44b5727bd453959ba8f2ae37fd2359272b730ada09e80fb2a5bbffd086ef075
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/jquery-migrate-3.0.0.min.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 08 Jul 2019 13:02:21 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1bac-58d2b0df7b140"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f76c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
chosen.jquery.min.js
www.workingadvantage.com/js/
25 KB
7 KB
Script
General
Full URL
https://www.workingadvantage.com/js/chosen.jquery.min.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06708edc30f6877320af98a385a4350ad9769c1aca9d44f8a262acf0c6dfefbd
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/chosen.jquery.min.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 05 Sep 2017 19:28:01 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"6459-5587639b37240"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f79c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
site.js
www.workingadvantage.com/js/
68 KB
17 KB
Script
General
Full URL
https://www.workingadvantage.com/js/site.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
668aeb0f18d6cfd195670546ba5cc3d33de3fc6abfa5fc11364901fe2a6ad468
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/site.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 27 Jul 2021 14:39:10 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"11100-5c81bd5313f80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f7bc49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
menu_default.js
www.workingadvantage.com/js/
24 B
598 B
Script
General
Full URL
https://www.workingadvantage.com/js/menu_default.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9cd60e08308ac0d8d91d3cc2b6c4162607c6217b9e350e01854fbdbb70164747
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/menu_default.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
24
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 07 Jan 2019 14:44:02 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"18-57edf427f5080"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
application/javascript
vary
Accept-Encoding
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8c2f7fc49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
common.js
www.workingadvantage.com/js/
702 B
907 B
Script
General
Full URL
https://www.workingadvantage.com/js/common.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e86ebaabaa7bfc75d8972d7446fd9cd23b28f5891fbfa0839ae6d1701af0e08
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/common.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 05 Sep 2017 19:28:00 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2be-5587639a43000"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f85c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
countryprovinceselector.js
www.workingadvantage.com/js/
19 KB
4 KB
Script
General
Full URL
https://www.workingadvantage.com/js/countryprovinceselector.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3c681a83aa4ab7a79e1b747baad02372b9182c4c28c8227f74a713ab1e48921
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/countryprovinceselector.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 09 Sep 2019 14:07:09 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"4c9b-5921f4db67d40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f88c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
register_enroll_email_or_code.js
www.workingadvantage.com/js/
647 B
817 B
Script
General
Full URL
https://www.workingadvantage.com/js/register_enroll_email_or_code.js?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f9c44faecc50e0a4481d95801cf059a5b05d0ea70a096b204b9550ec9ce347a
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/js/register_enroll_email_or_code.js?ebgcbv=98
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 05 Sep 2017 19:28:00 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"287-5587639a43000"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8c2f8bc49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
1093992
cdnapisec.kaltura.com/p/1093992/sp/109399200/embedIframeJs/uiconf_id/23289491/partner_id/
76 KB
21 KB
Script
General
Full URL
https://cdnapisec.kaltura.com/p/1093992/sp/109399200/embedIframeJs/uiconf_id/23289491/partner_id/1093992?ebgcbv=98
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.225.94 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-225-94.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e4e27006ed29a6f6eb25ecda4d4b02edd01cb89079333f47a7c527761a5bf664

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-kaltura
dumpUrl
x-me
ny-nvp1-fplay-c0fc, ny-nvp1-fplay-c0fc
date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
gzip
x-kaltura-session
1049300672, 1634056157
content-length
21602
pragma
last-modified
Tue, 12 Oct 2021 16:29:17 GMT
server
nginx
etag
d4da89ea1f50ea9df8a5cb6eee395ff9
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=311
x-robots-tag
noindex
expires
Tue, 12 Oct 2021 16:39:05 GMT
api.js
www.workingadvantage.com/cdn-cgi/bm/cv/669835187/
35 KB
9 KB
Script
General
Full URL
https://www.workingadvantage.com/cdn-cgi/bm/cv/669835187/api.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
Security Headers
Name Value
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

:path
/cdn-cgi/bm/cv/669835187/api.js
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
text/javascript
vary
Accept-Encoding
cache-control
max-age=604800, public
cf-ray
69d1bb8ddb15c49f-DUS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
loading2.gif
www.workingadvantage.com/img/
2 KB
2 KB
Image
General
Full URL
https://www.workingadvantage.com/img/loading2.gif
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
448e99a570408c6cf2eda6133ec9ea7b86b8494120fc2ab35f7fbab75fefa5e8
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/loading2.gif
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1924
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 31 Mar 2014 19:04:34 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"784-4f5ebb8d61480"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
image/gif
vary
Accept-Encoding
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8ddb19c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
logo.png
www.workingadvantage.com/img/
8 KB
9 KB
Image
General
Full URL
https://www.workingadvantage.com/img/logo.png
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ebb8b0b73ecae21b1840d76dbf4f67f96ac8e821d437166e74400227766ae75d
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/logo.png
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
8509
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 10 Nov 2015 14:07:29 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"213d-524303aea0a40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8ddb1cc49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
redeem_a_reward_button.png
www.workingadvantage.com/img/
3 KB
3 KB
Image
General
Full URL
https://www.workingadvantage.com/img/redeem_a_reward_button.png
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4071d8dd8df954a09136ddea2d3ee4fb20514e64f34afd206c9da33b5bb7250
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/redeem_a_reward_button.png
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
2961
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 22 Aug 2016 18:02:59 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"b91-53aacdbbdfac0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8ddb1dc49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
enroll_featured.jpg
www.workingadvantage.com/img/
45 KB
45 KB
Image
General
Full URL
https://www.workingadvantage.com/img/enroll_featured.jpg
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33cb692469df42cfecaf7569e66269c79f04411746fa5a2ea33fe0ae8f001bfa
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/enroll_featured.jpg
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
45756
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
expires
Fri, 12 Nov 2021 16:33:54 GMT
last-modified
Tue, 14 Feb 2017 19:58:07 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"b2bc-54882fb8fb1c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
image/jpeg
vary
Accept-Encoding
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8ddb1ec49f-DUS
cf-bgj
h2pri
payment_option_logos.png
www.workingadvantage.com/img/
12 KB
13 KB
Image
General
Full URL
https://www.workingadvantage.com/img/payment_option_logos.png
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ff90e45faf4f1517337648274a38902d62cb6e0ee6dc5961a41383d348608fa
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/payment_option_logos.png
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
12229
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Thu, 25 Feb 2016 16:23:36 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"2fc5-52c9a9ab9b200"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8ddb22c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
email-decode.min.js
www.workingadvantage.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
929 B
Script
General
Full URL
https://www.workingadvantage.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

:path
/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 05 Oct 2021 10:51:03 GMT
server
cloudflare
etag
W/"615c2e17-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800 public
strict-transport-security
max-age=5184000; includeSubDomains
cf-ray
69d1bb8d8a2dc49f-DUS
vary
Accept-Encoding
expires
Thu, 14 Oct 2021 16:33:54 GMT
getSeal
seal.godaddy.com/
4 KB
2 KB
Script
General
Full URL
https://seal.godaddy.com/getSeal?sealID=3sWmy8slw8uXQfXoEpQqdaAxBbiNOJPDKWJ8kKHGPR6VEFMdHwSJDuWFLucG
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
173.201.201.4 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-173-201-201-4.ip.secureserver.net
Software
Apache /
Resource Hash
2731279a7d1a73e9f9337cb97c35568e9a86ccb378050fbaa06824b991642bd6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Expires
Tue, 12 Oct 2021 20:33:55 GMT
seal_chase_paymentech.png
www.workingadvantage.com/img/
22 KB
23 KB
Image
General
Full URL
https://www.workingadvantage.com/img/seal_chase_paymentech.png
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b4c3f4c48f128e247706a610fd46ac8164ca7bed2a6d6e3b0564b253348ed5f
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/seal_chase_paymentech.png
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
23031
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Thu, 12 Nov 2020 17:12:18 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"59f7-5b3ec039fa080"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8ddb25c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
seal_alert_logic.png
www.workingadvantage.com/img/
79 KB
80 KB
Image
General
Full URL
https://www.workingadvantage.com/img/seal_alert_logic.png
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe56b80ead65e2a7d73f02da98bfd21557555823ac2da75aae27e3966a8429df
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/seal_alert_logic.png
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
81182
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Thu, 12 Nov 2020 17:12:18 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"13d1e-5b3ec039fa080"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
image/png
vary
Accept-Encoding
cache-control
public, max-age=2678400
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8ddb29c49f-DUS
expires
Fri, 12 Nov 2021 16:33:54 GMT
logo.svg
www.workingadvantage.com/img/
7 KB
3 KB
Image
General
Full URL
https://www.workingadvantage.com/img/logo.svg
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c8b033cc69116a4670f6828ace15adda22d4d3ed1bb17e31daea73abbdfbede
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/logo.svg
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Mon, 27 Aug 2018 15:48:45 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1d49-5746ca90c5140"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=7776000
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8ddb2ec49f-DUS
expires
Mon, 10 Jan 2022 16:33:54 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 28 May 2021 01:40:41 GMT
Server
AkamaiNetStorage
ETag
"5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1634056434719
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1634056434719
388 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1634056434719
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.48.145.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-48-145-41.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a777550d5a9b973b62c267838163cea553c9891bc8a0774a5c4a9d3b03d805b6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v018-0434fb018.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
NVYfOYcbROg=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.workingadvantage.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
323
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v018-04ad88c1a.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
https://www.workingadvantage.com
X-TID
eWCeoegfSqk=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&ts=1634056434719
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
AppMeasurement.min.js
assets.adobedtm.com/extensions/EP6326e4d6b32f4a71ad5204459cc57d66/
33 KB
12 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EP6326e4d6b32f4a71ad5204459cc57d66/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/launch-3ef1ffa7e1d7.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
02e1c4508320ee6bc6b884c4de9a0d73e541b6735fa139cbd957a27f42c72140

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
gzip
last-modified
Thu, 16 Sep 2021 19:44:20 GMT
server
AkamaiNetStorage
etag
"b135e36e0ffbaaaebca4ed5a17a3a5c5:1631821460.47263"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
12201
expires
Tue, 12 Oct 2021 17:33:54 GMT
AppMeasurement_Module_ActivityMap.min.js
assets.adobedtm.com/extensions/EP6326e4d6b32f4a71ad5204459cc57d66/
3 KB
2 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EP6326e4d6b32f4a71ad5204459cc57d66/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/launch-3ef1ffa7e1d7.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a176b44662d7eb55562527b7df840e6eb620d9f326989674a16f0765dc94f360

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
gzip
last-modified
Thu, 16 Sep 2021 19:44:20 GMT
server
AkamaiNetStorage
etag
"92ba45f9116eed843514845165336fae:1631821460.690196"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
1594
expires
Tue, 12 Oct 2021 17:33:54 GMT
sync
live.rezync.com/
5 KB
5 KB
Script
General
Full URL
https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=709a910d70f1371b086451223dfeb219&zmpID=ebg-wa&cache_buster=1634056434777&k=ebg-wa-pixel-6542&custom3=account%3A%20enroll&custom4=register_enroll
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.248.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
lighttpd/1.4.33 /
Resource Hash
d3f8be3530b8336ab6c452acd55303585f6a08ae81713dff88b231ffc89c17ee

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
via
1.1 5bbaa27b453dc834289b91c14bbb4934.cloudfront.net (CloudFront)
server
lighttpd/1.4.33
x-amz-cf-pop
DUS51-P1
x-cache
Miss from cloudfront
content-type
application/javascript
content-length
4611
x-amz-cf-id
DrNLdqiFOQmJjbd-fsx3stLko9fluIVDTJjRNKAI5LBe1Uy0Qr3nOA==
bootstrap4.min.css
www.workingadvantage.com/css/bootstrap/
153 KB
23 KB
Stylesheet
General
Full URL
https://www.workingadvantage.com/css/bootstrap/bootstrap4.min.css
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/css/site.css?ebgcbv=98
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f7d6357a349f9b2e41547131f5dd5d1098529d07473a2b59220201c1602c8aa
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/css/bootstrap/bootstrap4.min.css
pragma
no-cache
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/css/site.css?ebgcbv=98
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/css/site.css?ebgcbv=98
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Tue, 28 Apr 2020 14:20:53 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"262f2-5a45a8a02bb40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb8d69f8c49f-DUS
form.css
ebgcc.brightpattern.com/clientweb/chat-client-v4/css/
3 KB
3 KB
Stylesheet
General
Full URL
https://ebgcc.brightpattern.com/clientweb/chat-client-v4/css/form.css
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
4471d3760ad27b466ca99f4e9ac126ee8d9eb24d7d9989561b12e40ca118dcf0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Last-Modified
Fri, 08 Oct 2021 20:26:04 GMT
Server
nginx/1.21.3
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2620
init.js
ebgcc.brightpattern.com/clientweb/chat-client-v4/js/
6 KB
7 KB
Script
General
Full URL
https://ebgcc.brightpattern.com/clientweb/chat-client-v4/js/init.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
ed953262370c9dd1f14474cc6d4c24d6f7ef4a2327f419acb656a02ee26b1ea6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Last-Modified
Fri, 08 Oct 2021 20:26:04 GMT
Server
nginx/1.21.3
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6602
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v20/
23 KB
23 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f3.1e100.net
Software
sffe /
Resource Hash
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.workingadvantage.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 11 Oct 2021 15:11:30 GMT
x-content-type-options
nosniff
age
91344
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23484
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:19:01 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 11 Oct 2022 15:11:30 GMT
lato-italic-webfont.woff
www.workingadvantage.com/css/fonts/
29 KB
30 KB
Font
General
Full URL
https://www.workingadvantage.com/css/fonts/lato-italic-webfont.woff
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/css/site.css?ebgcbv=98
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
962f868106ea626a1e0a64e7269fc0a017a46e8fbf995a9580caed4e29f58520
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://www.workingadvantage.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
font
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
:path
/css/fonts/lato-italic-webfont.woff
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/css/site.css?ebgcbv=98
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.workingadvantage.com/css/site.css?ebgcbv=98
Origin
https://www.workingadvantage.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
29984
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Wed, 05 Feb 2014 21:28:51 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"7520-4f1af71672ac0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
font/opentype
vary
Accept-Encoding
cache-control
public, max-age=7776000
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8deb38c49f-DUS
expires
Mon, 10 Jan 2022 16:33:54 GMT
S6u9w4BMUTPHh50XSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/
22 KB
22 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh50XSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,900
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f3.1e100.net
Software
sffe /
Resource Hash
7d4243c8e973ec0cfc707904891ae4e3efc03dbc8923acb9755f9a35c92269a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.workingadvantage.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 11 Oct 2021 07:34:56 GMT
x-content-type-options
nosniff
age
118738
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
22572
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:18:56 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 11 Oct 2022 07:34:56 GMT
TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiZQ.woff2
fonts.gstatic.com/s/oswald/v40/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/oswald/v40/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiZQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Oswald
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f3.1e100.net
Software
sffe /
Resource Hash
76db825b68979b9ea6cc55fa14373b7bf5e3beb7388cd2efa485938bb2a389fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.workingadvantage.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 11 Oct 2021 10:52:01 GMT
x-content-type-options
nosniff
age
106913
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16016
x-xss-protection
0
last-modified
Tue, 10 Aug 2021 00:16:44 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 11 Oct 2022 10:52:01 GMT
lato-bold-webfont.woff
www.workingadvantage.com/css/fonts/
32 KB
32 KB
Font
General
Full URL
https://www.workingadvantage.com/css/fonts/lato-bold-webfont.woff
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/css/site.css?ebgcbv=98
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2eec22fcd09b2b38293ffa6f773ffbe507618a06c2f422c077ae565b15f9e6a5
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://www.workingadvantage.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
font
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
:path
/css/fonts/lato-bold-webfont.woff
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/css/site.css?ebgcbv=98
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.workingadvantage.com/css/site.css?ebgcbv=98
Origin
https://www.workingadvantage.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
805
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
32392
x-xss-protection
1; mode=block
referrer-policy
unsafe-url
last-modified
Wed, 05 Feb 2014 21:28:48 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"7e88-4f1af71396400"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
content-type
font/opentype
vary
Accept-Encoding
cache-control
public, max-age=7776000
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
accept-ranges
bytes
cf-ray
69d1bb8deb3bc49f-DUS
expires
Mon, 10 Jan 2022 16:33:54 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 28 Sep 2021 21:34:48 GMT
server
Golfe2
age
1968
date
Tue, 12 Oct 2021 16:01:06 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19887
expires
Tue, 12 Oct 2021 18:01:06 GMT
gtm.js
www.googletagmanager.com/
121 KB
45 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-W9THHDH
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.72 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
a8ddfb56b3b9f5666bd993cd373085e7823fbf65b02c18fae3268088e3e4a1cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
45797
x-xss-protection
0
last-modified
Tue, 12 Oct 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 12 Oct 2021 16:33:54 GMT
913a7fd6-dc0a-49da-96d8-8f73cb55b75c.js
cdn.mouseflow.com/projects/
174 KB
58 KB
Script
General
Full URL
https://cdn.mouseflow.com/projects/913a7fd6-dc0a-49da-96d8-8f73cb55b75c.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.38 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
0c24d44bd1ca3b135fb6d91227588ff1ac7932b91886d4e751deefd2e681f940

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
content-encoding
gzip
last-modified
Tue, 05 Oct 2021 15:00:58 GMT
server
NetDNA-cache/2.2
etag
W/"f549f0cdf9b9d71:0"
x-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=86400
li.php
www.workingadvantage.com/common_resources/
2 B
669 B
XHR
General
Full URL
https://www.workingadvantage.com/common_resources/li.php
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://www.workingadvantage.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
empty
x-requested-with
XMLHttpRequest
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CvVersion%7C5.2.0; mbox=session#8263324637344f38ba3c56799395d35f#1634058295; at_check=true
content-length
398
:path
/common_resources/li.php
pragma
no-cache
x-newrelic-id
XA4PUldACQMDUlhRAQc=
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
*/*
cache-control
no-cache
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
POST
Accept
*/*
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
X-NewRelic-ID
XA4PUldACQMDUlhRAQc=
X-Requested-With
XMLHttpRequest
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
p3p
policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR OTR IND DSP IDC COR"
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
2
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
unsafe-url
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent
content-type
application/json
cache-control
no-store, no-cache, must-revalidate
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
set-cookie
gdpr_pp=1; expires=Thu, 11-Nov-2021 16:33:55 GMT; Max-Age=2592000; path=/
cf-ray
69d1bb8e5c70c49f-DUS
expires
Thu, 19 Nov 1981 08:52:00 GMT
dest5.html
entertainmentbenefitsgroupllc.demdex.net/ Frame 6FC3
7 KB
3 KB
Document
General
Full URL
https://entertainmentbenefitsgroupllc.demdex.net/dest5.html?d_nsid=0
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-233-208.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
entertainmentbenefitsgroupllc.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Encoding
gzip, deflate, br
Cookie
demdex=25786024725159799883330558477773717055
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding
gzip
Content-Type
text/html;charset=UTF-8
date
Tue, 12 Oct 2021 16:33:55 GMT
DCS
dcs-prod-irl1-1-v018-04f77650a.edge-irl1.demdex.com UNKNOWN
Expires
Thu, 01 Jan 1970 00:00:00 UTC
last-modified
Mon, 4 Oct 2021 13:53:51 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
vary
accept-encoding
X-TID
JU+jt5i4TnM=
Content-Length
2791
Connection
keep-alive
id
smetrics.workingadvantage.com/
48 B
521 B
XHR
General
Full URL
https://smetrics.workingadvantage.com/id?d_visid_ver=5.2.0&d_fieldgroup=A&mcorgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&mid=25777024114049483313329385723146651520&ts=1634056434946
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-188-95-229.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
3280fddc77938fefe1459e296dc764a9d4992e5bdb88e44ee97bf5fc6263f5d7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Tue, 12 Oct 2021 16:33:54 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-b4c7fdd79-8fnsh
vary
Origin
x-c
main-1540.I13d07b.M0-522
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript;charset=utf-8
content-length
48
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=YWW48wAAALL47QP7
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=25786024725159799883330558477773717055
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YWW48wAAALL47QP7
42 B
945 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YWW48wAAALL47QP7
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.48.145.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-48-145-41.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v018-0387a5f78.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
t74saiuWR70=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YWW48wAAALL47QP7
Date
Tue, 12 Oct 2021 16:33:55 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
delivery
starget.workingadvantage.com/rest/v1/
2 KB
1 KB
XHR
General
Full URL
https://starget.workingadvantage.com/rest/v1/delivery?client=entertainmentbenefit&sessionId=8263324637344f38ba3c56799395d35f&version=2.6.1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.203.190.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-203-190-43.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
6b948c8eeaf6d655462a6ee94b49c8f71364bee54be38d05839a98156aed11a5

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.workingadvantage.com
date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
access-control-allow-credentials
true
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
x-request-id
977503cf0a34d0ce69956493c02b4915
content-type
application/json;charset=UTF-8
munchkin.js
munchkin.marketo.net/160/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/160/munchkin.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 19 Feb 2021 02:54:38 GMT
Server
AkamaiNetStorage
ETag
"19a9335fd71267d56e65bc19390f3100:1613703278.138281"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4811
Expires
Thu, 20 Jan 2022 16:33:54 GMT
visitWebPage
409-bcn-480.mktoresp.com/webevents/
2 B
311 B
Ping
General
Full URL
https://409-bcn-480.mktoresp.com/webevents/visitWebPage?_mchNc=1634056434988&_mchCn=&_mchId=409-BCN-480&_mchTk=_mch-workingadvantage.com-1634056434987-71069&_mchHo=www.workingadvantage.com&_mchPo=&_mchRu=%2Faccount.php&_mchPc=https%3A&_mchVr=160&_mchEcid=B5F9FF2554F608410A4C98C6%40AdobeOrg%3A6%3A25777024114049483313329385723146651520&_mchHa=&_mchRe=&_mchQp=utm_campaign%3Dlas-vegas__-__utm_medium%3DOctober-4-2021-Hotels__-__utm_source%3DEmail__-__sub%3Denroll
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/160/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
d809ed8f-cc72-4283-8d07-fb5fbb023a09
collect
www.google-analytics.com/j/
4 B
24 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j94&a=69227517&t=pageview&_s=1&dl=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&ul=en-us&de=UTF-8&dt=Working%20Advantage%20-%20Employee%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=313909498&gjid=1706594278&cid=422947464.1634056435&tid=UA-4045288-1&_gid=1671322199.1634056435&_r=1&_slc=1&z=651574381
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount...
6479484.fls.doubleclick.net/ Frame 2C52
Redirect Chain
  • https://6479484.fls.doubleclick.net/activityi;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccou...
  • https://6479484.fls.doubleclick.net/activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%...
674 B
532 B
Document
General
Full URL
https://6479484.fls.doubleclick.net/activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9THHDH
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f6.1e100.net
Software
cafe /
Resource Hash
277cf807f42eed8f60976814590e4497436f31da773d951527e694cf3ae2e695
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
6479484.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Tue, 12 Oct 2021 16:33:55 GMT
expires
Tue, 12 Oct 2021 16:33:55 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
507
x-xss-protection
0
set-cookie
IDE=AHWqTUn-yQFnV1jgVOVoLkVmXcdPVzDSymSAaSFr5DgrtGrxCcFRGCYgWxUgmBtkbBQ; expires=Sun, 06-Nov-2022 16:33:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Tue, 12 Oct 2021 16:33:55 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://6479484.fls.doubleclick.net/activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
activityi;dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https...
9767737.fls.doubleclick.net/ Frame 2A7C
Redirect Chain
  • https://9767737.fls.doubleclick.net/activityi;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=htt...
  • https://9767737.fls.doubleclick.net/activityi;dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantag...
560 B
444 B
Document
General
Full URL
https://9767737.fls.doubleclick.net/activityi;dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9THHDH
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f6.1e100.net
Software
cafe /
Resource Hash
ac4f769636f28738dd7ceaf1ef01c558d9afb13c6f835c19456545ab7e26cda6
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
9767737.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Tue, 12 Oct 2021 16:33:55 GMT
expires
Tue, 12 Oct 2021 16:33:55 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
419
x-xss-protection
0
set-cookie
IDE=AHWqTUnyPE5XHHmIKAaiyfzHYlzCFfiK7ObbldTEYS4Y0RFEeJFm65jXnHzGQMxn0Lg; expires=Sun, 06-Nov-2022 16:33:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Tue, 12 Oct 2021 16:33:55 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://9767737.fls.doubleclick.net/activityi;dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
spx
dx.steelhousemedia.com/
16 KB
5 KB
Script
General
Full URL
https://dx.steelhousemedia.com/spx?dxver=4.0.0&shaid=23005&tdr=&plh=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&cb=59714136525195240
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.69.84.146 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-69-84-146.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
74c7b6645b4356f3320822f0688c472041604920f2a66875b6efcb0b32e0c329

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
connection
close
content-type
application/javascript;charset=utf-8
vary
accept-encoding,origin,access-control-request-headers,access-control-request-method,accept-encoding
expires
Thu, 01 Jan 1970 00:00:00 GMT
js
www.googletagmanager.com/gtag/
97 KB
39 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-701690947
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.72 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
a84e13a27c084cf2a04356271d26546bf528ae766513d59cdf7afcfa72a72b8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39471
x-xss-protection
0
last-modified
Tue, 12 Oct 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 12 Oct 2021 16:33:55 GMT
activityi;register_conversion=1;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_c...
6479484.fls.doubleclick.net/
0
0
Image
General
Full URL
https://6479484.fls.doubleclick.net/activityi;register_conversion=1;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

activityi;register_conversion=1;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww...
9767737.fls.doubleclick.net/
0
0
Image
General
Full URL
https://9767737.fls.doubleclick.net/activityi;register_conversion=1;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

collect
stats.g.doubleclick.net/j/
4 B
470 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j94&tid=UA-4045288-1&cid=422947464.1634056435&jid=313909498&gjid=1706594278&_gid=1671322199.1634056435&_u=IEBAAAAAAAAAAC~&z=784209331
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.177.15.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wr-in-f155.1e100.net
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 12 Oct 2021 16:33:55 GMT
content-type
text/plain
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
tc.min.js
c1.rfihub.net/js/
19 KB
6 KB
Script
General
Full URL
https://c1.rfihub.net/js/tc.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:01:39 GMT
content-encoding
gzip
last-modified
Tue, 12 Oct 2021 16:01:29 GMT
server
Jetty(9.3.29.v20201019)
age
1936
x-cache
Hit from cloudfront
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
x-amz-cf-pop
FRA56-P2
content-type
application/x-javascript
content-length
6162
x-amz-cf-id
RlKGDEm1R-hKxXPuU13-Rq2IT2RN7kBmXOowq2gLRMeGPoLGiaIsGA==
expires
Tue, 12 Oct 2021 17:01:39 GMT
/
com-workadv.netmng.com/
7 KB
3 KB
Script
General
Full URL
https://com-workadv.netmng.com/?aid=6323&siclientid=105193&url=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&p5=account%3A%20enroll&p6=register_enroll&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.38.167.35 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
openresty /
Resource Hash
7fdb1023cba50ed2dd86e2133c66c0444c2e082167e368a7bf68e95c465fd70c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 12 Oct 2021 16:33:28 GMT
Content-Encoding
gzip
Last-Modified
Sun, 10 Oct 2021 16:33:27 GMT
Server
openresty
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa PSAa OUR BUS COM NAV"
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript; charset=UTF-8
Expires
Sun, 10 Oct 2021 16:33:27 GMT
p13n.min.js
cdn.boomtrain.com/p13n/ebg-wa/
74 KB
24 KB
Script
General
Full URL
https://cdn.boomtrain.com/p13n/ebg-wa/p13n.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.66.248.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
12a707e11e2dc4d9b49d1a98cf484363b1549a6914a387a9c96d27679d285849

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id
PxVLvgspJsZrktpg1rzhaazEw7H7xS_4
Content-Encoding
gzip
ETag
W/"03cbd84e539f4c48d168f3c70ac3319e"
Age
1735
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Tue, 12 Oct 2021 01:28:05 GMT
Server
AmazonS3
Date
Tue, 12 Oct 2021 16:05:01 GMT
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 b85afd3a476827aadec8c79e8673c565.cloudfront.net (CloudFront)
Cache-Control
public, max-age=3600
X-Amz-Cf-Pop
DUS51-P1
X-Amz-Cf-Id
ixfbYA54HHLlLDkhdec3yzQovlF0hRx5fnzRz08DTWPtGPVvChPIrA==
ga-audiences
www.google.com/ads/
42 B
522 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-4045288-1&cid=422947464.1634056435&jid=313909498&_u=IEBAAAAAAAAAAC~&z=144972935
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.196 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
522 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-4045288-1&cid=422947464.1634056435&jid=313909498&_u=IEBAAAAAAAAAAC~&z=144972935
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f99.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
conversion_async.js
www.googleadservices.com/pagead/
37 KB
15 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
cafe /
Resource Hash
8e170827cf6b2dfdb810cef652d70f9cbd9ff58f4242cb735622833b5ff69bd3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14427
x-xss-protection
0
server
cafe
etag
14346040707932117602
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 12 Oct 2021 16:33:55 GMT
reflektion.js
d26opx5dl8t69i.cloudfront.net/js/
127 KB
53 KB
Script
General
Full URL
https://d26opx5dl8t69i.cloudfront.net/js/reflektion.js?t=907803
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.242.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2fac708a58ff36525a595affd83b9d385c1f261a4c279166864f99bf453e67bd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 21:43:23 GMT
content-encoding
gzip
age
1709433
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
53798
last-modified
Wed, 22 Sep 2021 21:40:51 GMT
server
AmazonS3
etag
"6cce5cdb79a755257ffa863284722f16"
x-amz-version-id
fRyFw77tz6nfPSzlhGqXQ9boWiANZF13
via
1.1 b628053fca1386b0c2ba37163842b26f.cloudfront.net (CloudFront)
cache-control
max-age=31556926
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
content-type
text/javascript
x-amz-cf-id
YGc9CxVoqDOknVP-39lGOpYuOpsIZ3BIqk5W1uRmgp4h0csgIHBy7g==
resolve
people.api.boomtrain.com/identify/
118 B
433 B
XHR
General
Full URL
https://people.api.boomtrain.com/identify/resolve?data=eyJjb29raWUiOnsiYnNpbiI6IiJ9LCJxdWVyeXN0cmluZyI6e30sImV4dGVybmFsX2lkcyI6eyJ6eW5jIjoiNGFkMTNjYmEtMGE0Yi00YThiLThkOGYtZWI1ZmRlY2RkNGU5OjE2MzQwNTY0MzQuOTkifX0%3D&site_id=ebg-wa
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.195.31.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-195-31-102.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2bbb691c9eaa2a9163d4da42af10729b164e0758678eab87344fe06915890dd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Server
nginx
Access-Control-Allow-Methods
GET,PUT,POST,DELETE
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Headers
X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length
118
s15495461041826
smetrics.workingadvantage.com/b/ss/entbenworking/1/JS-2.22.2-LBWB/
43 B
359 B
Image
General
Full URL
https://smetrics.workingadvantage.com/b/ss/entbenworking/1/JS-2.22.2-LBWB/s15495461041826?AQB=1&ndh=1&pf=1&t=12%2F9%2F2021%2016%3A33%3A55%202%200&sdid=519DB70141692538-64DBF745AD9A71FD&mid=25777024114049483313329385723146651520&aamlh=6&ce=UTF-8&ns=entertainmentbenefits&cdp=2&fpCookieDomainPeriods=2&pageName=account%3A%20enroll&g=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&cc=USD&ch=account&server=www.workingadvantage.com&v0=ga%7Cemail%7Coctober-4-2021-hotels%7Clas-vegas%7C%7C&events=event10%2Cevent67&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=account&h1=WorkingAdvantage&c4=enroll&v4=D%3Dc4&c6=desktop&c7=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3Doctober-4-2021-hotels%26utm_source%3Demail%26sub%3Denroll&c9=anonymous&v9=Tuesday%20-%2012%3A30PM&c10=register_enroll&c11=not%20logged%20in&c12=Working%20Advantage%20-%20Employee%20Discounts&c13=2498%7CWorkingAdvantage.com%20Site&v13=2498&c15=las-vegas&v15=D%3Dc15&c16=email&v16=D%3Dc16&c17=october-4-2021-hotels&v17=D%3Dc17&c29=wa&v37=D%3Dc11&c46=October%7C12%7C2021%7CTuesday%7C12%7C33%7CPM%7CWeekday%7CAfternoon&c47=account%3A%20enroll&v61=25777024114049483313329385723146651520&c66=%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3Doctober-4-2021-hotels%26utm_source%3Demail%26sub%3Denroll&c67=%2Faccount.php&c68=%3Futm_campaign%3Dlas-vegas%26utm_medium%3Doctober-4-2021-hotels%26utm_source%3Demail%26sub%3Denroll&c73=mje2ljezms4xmteumtmy&c74=wa%7Ccorp%7Caccount%7Csub%3Denroll&v85=D%3Dc7&v88=D%3Dc73&v96=D%3Dc47&v97=D%3Dc13&v98=D%3Dc46&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&AQE=1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-188-95-229.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
x-c
main-1540.I13d07b.M0-522
p3p
CP="This is not a P3P policy"
vary
*
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 13 Oct 2021 16:33:55 GMT
server
jag
xserver
anedge-b4c7fdd79-pfhjm
etag
3509109474471444480-4619694099477945565
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Mon, 11 Oct 2021 16:33:55 GMT
Cookie set ca.html
20835101p.rfihub.com/ Frame 51DE
3 KB
4 KB
Document
General
Full URL
https://20835101p.rfihub.com/ca.html?ver=9&rb=42748&ca=20835101&pid=&pname=&ptype=&cust4=account%3A%20enroll&cust5=register_enroll&cust6=&cust7=&cust8=&cust9=&cust10=&cust11=&cust12=&cust13=&cust14=&cust15=&cust16=&cust17=&cust18=&cust19=&pe=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&pf=&ra=3289683482349699
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
f3869c89358078d2880fe007bb19b723665863a50dd2ff2102948c9243489c2d

Request headers

Host
20835101p.rfihub.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie
rud=H4sIAAAAAAAAAOMSNjU0MTI2NjM3tDAxNze3MLE0NBDiM9SNNwrUtQjVTUt284yU4jU0MzYxMDUzMTY1NjECAFwxOw00AAAA; Path=/; Domain=.rfihub.com; Expires=Sun, 6 Nov 2022 16:33:55 GMT; Secure; SameSite=None eud=H4sIAAAAAAAAAJvFyGtoZmxiYGpmYmxqbG6yCo1_Co3_Co3_C40_iQmVPwuNvwiNvwqNvwmNvwtdPQsq_xYafxMrmn5uNPei8RcJo_IfofEB7kVxBiABAAA; Path=/; Domain=.rfihub.com; Expires=Sun, 6 Nov 2022 16:33:55 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNjU0MTI2NjM3tDAxNze3MLE0NBDiM9SNNwrUtQjVTUt284wEADE8CRQlAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Cache-Control
no-cache
Content-Type
text/html;charset=utf-8
Content-Length
2907
Server
Jetty(9.3.29.v20201019)
jquery-3.4.1.m.1588889810.js
d26opx5dl8t69i.cloudfront.net/js/
95 KB
33 KB
Script
General
Full URL
https://d26opx5dl8t69i.cloudfront.net/js/jquery-3.4.1.m.1588889810.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.242.229 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bed9883e3afc4f01beb8391653527dc2d5c8cfb3b1869dceebb7334142158fbf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sat, 28 Aug 2021 23:17:18 GMT
content-encoding
gzip
age
3863798
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
33438
last-modified
Thu, 07 May 2020 23:27:22 GMT
server
AmazonS3
etag
"61160be211038e73a64c8ba4e71d34a0"
x-amz-version-id
_4v6jx9BkibaPZt1vz0EmKTjiKsKT5tF
via
1.1 b628053fca1386b0c2ba37163842b26f.cloudfront.net (CloudFront)
cache-control
max-age=31556926
x-amz-cf-pop
DUS51-P1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
T0xReEtkpLHN_WXPQooygLup-_coujIHzuh9qThhOD7LsKnPjk5GXQ==
an
alweb.rfk.workingadvantage.com/rfkj/1/11273-152007103/
44 B
163 B
Image
General
Full URL
https://alweb.rfk.workingadvantage.com/rfkj/1/11273-152007103/an?data=1,uO9GsO8W8z8Mcz4Jc3AJcz8Jtz4yb29Qt28W8BtLsCJFrCswgmhSomVQomtB82QwhmRMr6ZVpmkwh6BPoSZRrDhP8yMytmBA8zEycjkOc30Tcj0PbjlGbm4PbjhBbj5MbjtVqnkNdSkSu6VypCVIsP0Vu3pKbj4ScPgMdjoQcPkOdjcyb29EsO8W8DtTtOVTrT9HqmVDomhSomVQomtBbCdLri8I8DlOqi8W8yZxoSdLtmVQbD1Es3ZRt6RvoS5Js65FpSUZr65PbnpBpS5P9DlQrlZJpmhFtmQZjSdQrS9BsyQQbj8Mcz4Ji6ZQpmNP9DlQrlZPrTlOoSkZhmRxqmMCsTlyfmlKsCZIr28I8DhMsO8WcjoPd30RdzgPdj8RcOMyt6dP8zENdzcQc3kSd3cRczkPb29SoO8WciMys6cyez4I8DpMoO8WciMyt31M8zENdzcQc3kSd3cOd3oNb29Qc6Ayez4ScPgMdjoQcPkNe34I8DgM8zENdzcQc3kSd3cRczkPb29QsSAyez4ScPgMdjoQcPkNcP0I8DdFp28W8z4Mdj8KdP0Kd3wKcjkUc34KcPcNczcKomkUdzsQoS8OcPwObjoRbj8Mcz4Nc30Ubz0Ncj8Pd28I8Cdz8zEOe3sUdyMyoTgyez4ScPgMd3kRdPcKc3kI8D9zoO8WczkSej8I8CdPs28WuO9y8zEMb29Q8zEMb29Ps28Wc2MyoO8Wc7QI8DhW8zEMb29DpmYyeDIyoO8W8Bdxry16sC5KoSBPoSYyb29Quy8WbjwI8CBM8zEycz4Sbz4PciUNcj4KcjcO8yMyry8W8Blj8yMysy8W8Adxr6BCrT9Kqm4yb29W8zEyjCZQnRdRs71LsDhBp29Zb29Romwyey8Oq7kSdmNxs3hDoTkyb29ys7cyeBIyqPxFonxAdSkTejtE8yMydPBMe3oPpzARe3tQ8yMyqSJIdjAMs3lCoCdM8BQI8DdO8zFrcjoMc2MNcz0MniMytTcyeBINdz0Mb34Oc31tb29A8zEys6cyb29coSIyez4QdPAI8C9PsO8W8z4Nci8I8ANIsO8WdPkRb29csTcyezwScyMys78yey9Aqn9BoTgyb29OsTkyey8N8yMyoSdH8zEyrzRvpScIpzRDoONPfj4IoPQOejwVb7hOfjAMb79Kfj8NdyNQsPQOc38Ncj0NcyUNdzcPb6gZs6cIsTkZcjJKfndyciNCfndyb7cZciNzfj8Mcj4It3QOc34Ucj8MdyUMc3kQeSUZsDsNb6oZsDsIsPQNb6cZczsTdONQfj8Mcz4Mdj0Tbz0Td3syb29Q8zENdzcQc3kSd3cRczsUb29SomNRpi8WuO9zrSVQpnxQ8zFX8DdQrT9B8zFX8CtOrTlMnSBA8zEyczgVe28I8CBA8zEyc29ZvnRZ&C=1,uO8AuSxZb2hXt7QI97JAviNRsSlO8zENb28AuSxZb2hXl7QI97JAviNRsSlO8zENb28AuSxZb2hXt7QI97JAviNFrCBQqDcyez4I8yhXq7QI97JQviMAuShZb7pFpnsyez4I8yhXq7QI97JkviMAuShZb79PtjENb71SqmlT8zENb28AuSxZb2hXt7QI97JAviNSqndFt28WciMy97JEviMAuRhZb2hXp7QIp7gNs7gMs3EO8zENb28AuSxZb2hXl7QI97JAviNAt31Qcn0Wc28WciMy97JEviMAuRhZb2hXp7QIp7gMt31Fez0yez4I8yhXq7QI97JkviMAuShZb71zez4yez4I8ChE8zEycjkOc30Tcj0P8yMyp28W8D1z8DQ,&N=1,uO9OsTkyey8N8DQ,&t=1634056435280
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.88.197.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-197-125.compute-1.amazonaws.com
Software
gunicorn/19.6.0 /
Resource Hash
d1c4aa4fc27ca65d42b693b60f19546c4a50c002394c364dbbef45710858df7a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
last-modified
Wed, 19 May 2021 07:43:58 GMT
server
gunicorn/19.6.0
content-length
44
content-type
image/gif
dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=*;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage....
adservice.google.com/ddm/fls/z/ Frame 2A7C
42 B
515 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=*;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll
Requested by
Host: 9767737.fls.doubleclick.net
URL: https://9767737.fls.doubleclick.net/activityi;dc_pre=CImX8MqmxfMCFamoUQodGQQIGQ;src=9767737;type=retarget;cat=wa-si0;ord=5294812947727;gtm=2wgab0;auiddc=1250080874.1634056435;u6=www.workingadvantage.com%2Faccount.php;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://9767737.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bounce
secure.adnxs.com/ Frame 2C52
Redirect Chain
  • https://secure.adnxs.com/seg?add=8083872&t=2
  • https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D8083872%26t%3D2
43 B
1 KB
Image
General
Full URL
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D8083872%26t%3D2
Requested by
Host: 6479484.fls.doubleclick.net
URL: https://6479484.fls.doubleclick.net/activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://6479484.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 12 Oct 2021 16:33:55 GMT
X-Proxy-Origin
216.131.111.132; 216.131.111.132; 690.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid
2af59f0e-1a71-4a95-b89a-d3c41309c04e
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 12 Oct 2021 16:33:55 GMT
X-Proxy-Origin
216.131.111.132; 216.131.111.132; 690.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid
0fbd04cc-6a11-4ece-a3c3-ae3723ef2228
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D8083872%26t%3D2
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vega...
adservice.google.com/ddm/fls/z/ Frame 2C52
42 B
107 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=*;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll
Requested by
Host: 6479484.fls.doubleclick.net
URL: https://6479484.fls.doubleclick.net/activityi;dc_pre=CKeN8MqmxfMCFf8NBgAdz9kDmA;src=6479484;type=retarget;cat=worki0;ord=868065363683;gtm=2wgab0;auiddc=1250080874.1634056435;ps=1;~oref=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://6479484.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/701690947/
2 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/701690947/?random=1634056435299&cv=9&fst=1634056435299&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaab0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&tiba=Working%20Advantage%20-%20Employee%20Discounts&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
efeb8735a2b346afbd6ce49309ec76edc93a180260fd440f3a2ac5c72fb23417
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1116
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
init
n2.mouseflow.com/
0
324 B
XHR
General
Full URL
https://n2.mouseflow.com/init?v=17.51&p=913a7fd6-dc0a-49da-96d8-8f73cb55b75c&s=1675ed90a245adc918914ced52fbfc6a&page=1012547168f21021628e2aac9f5dccaff0e8adc7&ret=0&u=5aa0262bc22514c139a8e7a7699b58cb&href=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&url=%2Faccount.php%3Fsub%3Denroll%26utm_source%3Demail%26utm_medium%3Doctober-4-2021-hotels%26utm_campaign%3Dlas-vegas&ref=&title=Working%20Advantage%20-%20Employee%20Discounts&res=1600x1200&tz=0&to=0&dnt=0&ori=&dw=1600&dh=1200&time=409&pxr=1&gdpr=0&vars=utm_source%3DEmail%26utm_medium%3DOctober-4-2021-Hotels%26utm_campaign%3Dlas-vegas
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
207.244.84.210 Alexandria, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
Mouseflow /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
server
Mouseflow
x-recorder
rec-15-us
content-type
text/plain; charset=Windows-1252
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
0
expires
-1
RC99c39b8088f34dd0a7fed9a34a10c2e6-source.min.js
assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/
1019 B
846 B
Script
General
Full URL
https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/RC99c39b8088f34dd0a7fed9a34a10c2e6-source.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
eb90498ac805d7551af4b858423bcff08c87b99caad9320a4b27e7a1b664feb1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
last-modified
Tue, 05 Oct 2021 17:48:58 GMT
server
AkamaiNetStorage
etag
"592ad25a395ffaf4aa8ecf588b05bd76:1633456138.17857"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
574
expires
Tue, 12 Oct 2021 17:33:55 GMT
page-lib.min.js
ebgcc.brightpattern.com/clientweb/chat-client-v4/build/
16 KB
8 KB
Script
General
Full URL
https://ebgcc.brightpattern.com/clientweb/chat-client-v4/build/page-lib.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
a573a5c7e757fc9ff9bb66611d63178290d28423fa744badb37f71459e8910bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Oct 2021 20:26:04 GMT
Server
nginx/1.21.3
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains
countryprovince.php
www.workingadvantage.com/
39 KB
4 KB
XHR
General
Full URL
https://www.workingadvantage.com/countryprovince.php
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0fd47cbb9eb97c56ea50c860db6359d34448da5bbeb28fedad3e81d03cd39a5
Security Headers
Name Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://www.workingadvantage.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
empty
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; at_check=true; AMCVS_B5F9FF2554F608410A4C98C6%40AdobeOrg=1; _mkto_trk=id:409-BCN-480&token:_mch-workingadvantage.com-1634056434987-71069; _ga=GA1.2.422947464.1634056435; _gid=GA1.2.1671322199.1634056435; _gat=1; s_ecid=MCMID%7C25777024114049483313329385723146651520; _gcl_au=1.1.1250080874.1634056435; mbox=session#8263324637344f38ba3c56799395d35f#1634058296|PC#8263324637344f38ba3c56799395d35f.37_0#1697301236; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CMCMID%7C25777024114049483313329385723146651520%7CMCAAMLH-1634661234%7C6%7CMCAAMB-1634661234%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1634063635s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18920%7CvVersion%7C5.2.0; gdpr_pp=1; btIdentify=8ea39d24-2b6a-4253-8850-335555582698; _bti=%7B%22bsin%22%3A%22%22%7D; _bts=bbf93432-becf-4fdd-a378-1f2a7c3ecebe; sat_domain=A; prev_url_v2=https%253A%252F%252Fwww.workingadvantage.com%252Faccount.php%253Futm_campaign%253Dlas-vegas%2526utm_medium%253Doctober-4-2021-hotels%2526utm_source%253Demail%2526sub%253Denroll; gpv_v5=account%3A%20enroll; s_ptc=%5B%5BB%5D%5D; s_cc=true; __rutmb=152007103; __rutma=152007103-5j-a3-4e-1p-7yiu17e6xnbfnls09x6n-1634056435253.1634056435253.1634056435253.1.1.1; __ruid=152007103-5j-a3-4e-1p-7yiu17e6xnbfnls09x6n-1634056435253; __rcmp=0!bj1fZ2MsZj1nYyxzPTEsYz0yOTg5LHRyPTkwLHJuPTIxNix0cz0yMDIxMTAxMi4xNjMzLGQ9cGMsc3U9MTtuPXNiMSxmPXNiLHM9MSxjPTIwMTEsdD0yMDE4MTIwNi4wMDU0O249cncxLGY9cncscz0xLGM9Mjc3Nyx0PTIwMjEwNTA3LjA3NDc~; __rslct=rw%2Csb; __rpckx=0!eyJ0NyI6eyIxIjoxNjM0MDU2NDM1MjUzfSwidDd2Ijp7IjEiOjE2MzQwNTY0MzUyNTN9LCJpdGltZSI6IjIwMjExMDEyLjE2MzMifQ~~; __rpck=0!eyJwcm8iOiJkaXJlY3QiLCJidCI6eyIwIjp0cnVlLCIxIjowLCIyIjpudWxsLCIzIjoxfSwiQyI6e30sIk4iOnt9fQ~~; mf_user=5aa0262bc22514c139a8e7a7699b58cb|; mf_913a7fd6-dc0a-49da-96d8-8f73cb55b75c=1675ed90a245adc918914ced52fbfc6a|1012547168f21021628e2aac9f5dccaff0e8adc7.6931915432.1634056435351|1634056434971||0|||0|17.51|3.25804
content-length
25
:path
/countryprovince.php
pragma
no-cache
x-newrelic-id
XA4PUldACQMDUlhRAQc=
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type
application/x-www-form-urlencoded
accept
*/*
cache-control
no-cache
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
POST
X-NewRelic-ID
XA4PUldACQMDUlhRAQc=
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
strict-transport-security
max-age=5184000; includeSubDomains
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
unsafe-url
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent
content-type
text/xml; charset=ISO-8859-4
cache-control
no-store, no-cache, must-revalidate
content-security-policy
default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
cf-ray
69d1bb911a29c49f-DUS
expires
Thu, 19 Nov 1981 08:52:00 GMT
mwEmbedFrame.php
cdnapisec.kaltura.com/html5/html5lib/v2.90/
189 KB
57 KB
Script
General
Full URL
https://cdnapisec.kaltura.com/html5/html5lib/v2.90/mwEmbedFrame.php?&wid=_1093992&uiconf_id=23289491&cache_st=1504033729&entry_id=1_vcy14csy&playerId=kaltura_player_1504033729&forceMobileHTML5=true&urid=2.90&protocol=https&callback=mwi_kalturaplayer15040337290
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.225.94 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-225-94.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
62f8fb423450f9330d747f2c7c361193eae6e0944178cf38b8935b31613df85c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-me
ny-nvp1-fplay-8f55
date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
server
nginx
etag
02d3e8937242eed4c0dc6b5c95de14f0
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=301
x-robots-tag
noindex
content-length
58500
expires
Tue, 12 Oct 2021 16:38:56 GMT
quant.js
secure.quantserve.com/
24 KB
9 KB
Script
General
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.189 , United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
2d452ca7bf499867307ebfa48373084a42e1f56ec0a26e5bb2e12f01888c3cc9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
etag
"XUylRaJiJNdi08iU32oNYQ=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Tue, 19 Oct 2021 16:33:55 GMT
result
www.workingadvantage.com/cdn-cgi/bm/cv/
0
523 B
XHR
General
Full URL
https://www.workingadvantage.com/cdn-cgi/bm/cv/result?req_id=69d1bb89a9a5c49f
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.21.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-fetch-mode
cors
origin
https://www.workingadvantage.com
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
empty
cookie
PHPSESSID=kruofgnr6ocnvifl70vh505jkh; WORKINGADVANTAGE=!hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=; __cf_bm=hVGjk7YR_nQ.YVGG3DclOuFNd64yP6TTtN_4AZIAWJw-1634056433-0-AUynp7ECX6qKcBKSqqWBT78+LF/Ar38e3+Gorfg3czeTfN16E7InvwhnVwcCl/+dnyghf2agYw6jAxiRJZFPQOU=; __rsu=1; at_check=true; AMCVS_B5F9FF2554F608410A4C98C6%40AdobeOrg=1; _mkto_trk=id:409-BCN-480&token:_mch-workingadvantage.com-1634056434987-71069; _ga=GA1.2.422947464.1634056435; _gid=GA1.2.1671322199.1634056435; _gat=1; s_ecid=MCMID%7C25777024114049483313329385723146651520; _gcl_au=1.1.1250080874.1634056435; mbox=session#8263324637344f38ba3c56799395d35f#1634058296|PC#8263324637344f38ba3c56799395d35f.37_0#1697301236; AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg=-1124106680%7CMCIDTS%7C18913%7CMCMID%7C25777024114049483313329385723146651520%7CMCAAMLH-1634661234%7C6%7CMCAAMB-1634661234%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1634063635s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18920%7CvVersion%7C5.2.0; gdpr_pp=1; btIdentify=8ea39d24-2b6a-4253-8850-335555582698; _bti=%7B%22bsin%22%3A%22%22%7D; _bts=bbf93432-becf-4fdd-a378-1f2a7c3ecebe; sat_domain=A; prev_url_v2=https%253A%252F%252Fwww.workingadvantage.com%252Faccount.php%253Futm_campaign%253Dlas-vegas%2526utm_medium%253Doctober-4-2021-hotels%2526utm_source%253Demail%2526sub%253Denroll; gpv_v5=account%3A%20enroll; s_ptc=%5B%5BB%5D%5D; s_cc=true; __rutmb=152007103; __rutma=152007103-5j-a3-4e-1p-7yiu17e6xnbfnls09x6n-1634056435253.1634056435253.1634056435253.1.1.1; __ruid=152007103-5j-a3-4e-1p-7yiu17e6xnbfnls09x6n-1634056435253; __rcmp=0!bj1fZ2MsZj1nYyxzPTEsYz0yOTg5LHRyPTkwLHJuPTIxNix0cz0yMDIxMTAxMi4xNjMzLGQ9cGMsc3U9MTtuPXNiMSxmPXNiLHM9MSxjPTIwMTEsdD0yMDE4MTIwNi4wMDU0O249cncxLGY9cncscz0xLGM9Mjc3Nyx0PTIwMjEwNTA3LjA3NDc~; __rslct=rw%2Csb; __rpckx=0!eyJ0NyI6eyIxIjoxNjM0MDU2NDM1MjUzfSwidDd2Ijp7IjEiOjE2MzQwNTY0MzUyNTN9LCJpdGltZSI6IjIwMjExMDEyLjE2MzMifQ~~; __rpck=0!eyJwcm8iOiJkaXJlY3QiLCJidCI6eyIwIjp0cnVlLCIxIjowLCIyIjpudWxsLCIzIjoxfSwiQyI6e30sIk4iOnt9fQ~~; mf_user=5aa0262bc22514c139a8e7a7699b58cb|; mf_913a7fd6-dc0a-49da-96d8-8f73cb55b75c=1675ed90a245adc918914ced52fbfc6a|1012547168f21021628e2aac9f5dccaff0e8adc7.6931915432.1634056435351|1634056434971||0|||0|17.51|3.25804
content-length
552
:path
/cdn-cgi/bm/cv/result?req_id=69d1bb89a9a5c49f
pragma
no-cache
x-newrelic-id
XA4PUldACQMDUlhRAQc=
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type
application/json
accept
*/*
cache-control
no-cache
:authority
www.workingadvantage.com
referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
:scheme
https
sec-fetch-site
same-origin
:method
POST
X-NewRelic-ID
XA4PUldACQMDUlhRAQc=
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=5184000; includeSubDomains
vary
Accept-Encoding
set-cookie
__cf_bm=U4h6qVXEELXq_iaBxwxoERS1Te13O3YxBlVTA7UkLcQ-1634056435-0-AV1BkHnHhn4CfnTGuURLP0/9KZTpTaevFSR2pB+cgp4yTx0oKgR9MGORlLhZQ3bpxE9i8D6cnzU5jJgUaK2ALapKWr2wMNK3++hxQLys3PUPA9PwRHNy2b0rcR7IPWNmyLgc5hcWRJgmSgIW1jU+O097yQrx8nTqaboQoiAyZMQu; path=/; expires=Tue, 12-Oct-21 17:03:55 GMT; domain=.workingadvantage.com; HttpOnly; Secure; SameSite=None
cf-ray
69d1bb918b21c49f-DUS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
load.php
cdnapisec.kaltura.com/html5/html5lib/v2.90/ Frame C107
3 MB
691 KB
Script
General
Full URL
https://cdnapisec.kaltura.com/html5/html5lib/v2.90/load.php?debug=false&lang=en&modules=Hlsjs%2CPolyfill_Set%2CacCheck%2CacPreview%2Cbase64_decode%2Cbase64_encode%2Cclass%2CcontrolBarContainer%2CcurrentTimeLabel%2CdurationLabel%2CexpandToggleBtn%2Cid3Tag%2CkAnalony%2Ckdark%2CkeyboardShortcuts%2CkgitGuard%2ClargePlayBtn%2CliveStream%2CmatchMedia%2CmorePlugins%2CnativeBridge%2CplayPauseBtn%2Cpolyfill_Array_filter%2CqualitySettings%2CreportError%2Cscreenfull%2Cscrubber%2CsideBarContainer%2CsourceSelector%2CstatisticsPlugin%2CtopBarContainer%2CunMuteOverlayButton%2Cutf8_encode%2CvolumeControl%7Cjquery.client%2Ccolor%2Ccookie%2Cdebouncedresize%2ChoverIntent%2CmessageBox%2CmwEmbedUtil%2CmwExtension%2CnaturalSize%7Cjquery.ui.core%2Cmouse%2Cposition%2Cslider%2Ctooltip%2CtouchPunch%2Cwidget%7Cmediawiki.Uri%2CUtilitiesTime%2CUtilitiesUrl%2Cclient%2CjqueryMsg%2Ckmenu%2Clanguage%2Cutil%7Cmediawiki.util.tmpl%7Cmw.EmbedPlayer%2CEmbedPlayerImageOverlay%2CEmbedPlayerKplayer%2CEmbedPlayerNative%2CEmbedPlayerNativeComponent%2CEmbedTypes%2CKAnalytics%2CKBaseButton%2CKBaseComponent%2CKBasePlugin%2CKBaseSmartContainer%2CKCuePoints%2CKDPMapping%2CKEntryLoader%2CKWidgetSupport%2CKalturaIframePlayerSetup%2CMediaElement%2CMediaPlayer%2CMediaPlayers%2CMediaSource%2CPlayerElement%2CPlayerElementFlash%2CPlayerElementHTML%2CPluginManager%7Cmw.MwEmbedSupport.style&pskwidgetpath=..%2Fkwidget-ps%2F&skin=no-theme&version=20210805T073204Z&*&protocol=https&wid=_1093992
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.225.94 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-225-94.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f07a8bec2143aba541175e64caca4da75c723e53f09fa39854d47631bb9453b5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-me
ny-nvp1-fplay-8c81
date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
last-modified
Thu, 07 Oct 2021 17:18:40 GMT
server
nginx
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=2162693, s-maxage=2592000
x-robots-tag
noindex
content-length
705478
expires
Sat, 06 Nov 2021 17:18:48 GMT
truncated
/ Frame C107
159 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
791fd110609c55ba57308b2b152520619e48cda3ef61de34ba7b4ed7b4d87b98

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type
image/png
/
www.google.com/pagead/1p-user-list/701690947/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/701690947/?random=1634056435299&cv=9&fst=1634054400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaab0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&tiba=Working%20Advantage%20-%20Employee%20Discounts&async=1&fmt=3&is_vtc=1&random=3544366319&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.196 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/701690947/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/701690947/?random=1634056435299&cv=9&fst=1634054400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaab0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&tiba=Working%20Advantage%20-%20Employee%20Discounts&async=1&fmt=3&is_vtc=1&random=3544366319&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.99 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f99.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rules-p-zhY3S1asLzBpZ.js
rules.quantcount.com/
2 B
355 B
Script
General
Full URL
https://rules.quantcount.com/rules-p-zhY3S1asLzBpZ.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.248.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 15:54:47 GMT
via
1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
server
AmazonS3
age
2347
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
cross-origin-resource-policy
cross-origin
x-cache
Hit from cloudfront
x-amz-cf-pop
DUS51-P1
content-length
2
x-amz-cf-id
kElJNLGqb-k3FbvgWZuTG44LyGOMd814LO6A40FH0J7ZWbg4oM7YFA==
cm
a.rfihub.com/ Frame 51DE
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTE0MjMzNjcxODQ3Nzc4NDkxMA==&forward=
  • https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEO-Cp6v-8t1bPKqOA3gwNmo&google_cver=1
42 B
1 KB
Image
General
Full URL
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEO-Cp6v-8t1bPKqOA3gwNmo&google_cver=1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEO-Cp6v-8t1bPKqOA3gwNmo&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
311
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame 51DE
0
580 B
Image
General
Full URL
https://ib.adnxs.com/setuid?entity=18&code=5142336718477784910
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 12 Oct 2021 16:33:55 GMT
X-Proxy-Origin
216.131.111.132; 216.131.111.132; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid
c0fa6535-0310-4b5a-a711-79af068b3511
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cm
p.rfihub.com/ Frame 51DE
Redirect Chain
  • https://stags.bluekai.com/site/4722?id=5142336718477784910&redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fbk_uuid%3D%24_BK_UUID%26forward%3D
  • https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
42 B
1 KB
Image
General
Full URL
https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
Date
Tue, 12 Oct 2021 16:33:55 GMT
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
tap.php
pixel.rubiconproject.com/ Frame 51DE
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=5142336718477784910
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
78e3bdce5107450057bade54d54a0a7e
Content-Type
image/gif
ibs:dpid=1121&dpuuid=5142336718477784910&redir=
dpm.demdex.net/ Frame 51DE
42 B
945 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5142336718477784910&redir=
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.48.145.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-48-145-41.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v018-0b11b7be7.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
/cceWveAT34=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC
/
ps.eyeota.net/match/bounce/ Frame 51DE
Redirect Chain
  • https://p.rfihub.com/cm?pub=24472&in=1
  • https://ps.eyeota.net/match?uid=5142336718477784910&bid=omt9pi0
  • https://ps.eyeota.net/match/bounce/?uid=5142336718477784910&bid=omt9pi0
70 B
440 B
Image
General
Full URL
https://ps.eyeota.net/match/bounce/?uid=5142336718477784910&bid=omt9pi0
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.122.214.165 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-122-214-165.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Content-Type
image/gif
Content-Length
70
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location
/match/bounce/?uid=5142336718477784910&bid=omt9pi0
Date
Tue, 12 Oct 2021 16:33:55 GMT
Content-Length
0
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
cksync.php
contextual.media.net/ Frame 51DE
46 B
696 B
Image
General
Full URL
https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=5142336718477784910
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.140.74 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-140-74.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=604800
server
Apache
date
Tue, 12 Oct 2021 16:33:55 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
46
x-mnet-hl2
E
expires
Tue, 12 Oct 2021 16:33:55 GMT
serving
bs.serving-sys.com/ Frame 51DE
0
105 B
Image
General
Full URL
https://bs.serving-sys.com/serving?cn=um&dpid=12&rtu=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D17945%26userid%3D%5B%25tp_UserID%25%5D
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.93.158.246 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-93-158-246.eu-central-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-length
0
p3p
CP="NOI DEVa OUR BUS UNI"
362358.gif
idsync.rlcdn.com/ Frame 51DE
Redirect Chain
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5142336718477784910&referrer=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOcto...
  • https://p.rfihub.com/cm?pub=39342&in=0&userid=4ad13cba-0a4b-4a8b-8d8f-eb5fdecdd4e9%3A1634056434.99&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D4ad13cba-0a4b-4a8b-8d8f-eb5fdecdd4e9...
  • https://idsync.rlcdn.com/501709.gif?partner_uid=4ad13cba-0a4b-4a8b-8d8f-eb5fdecdd4e9%3A1634056434.99
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEIN2WvV2eok7RRYGYwPGeQ0&google_cver=1
42 B
300 B
Image
General
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEIN2WvV2eok7RRYGYwPGeQ0&google_cver=1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 12 Oct 2021 16:33:55 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
clear
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEIN2WvV2eok7RRYGYwPGeQ0&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
289
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
bpi.rtactivate.com/tag/ Frame 51DE
43 B
109 B
Image
General
Full URL
https://bpi.rtactivate.com/tag/?id=11017&user_id=5142336718477784910
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.200.156.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-200-156-204.compute-1.amazonaws.com
Software
awselb/2.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
server
awselb/2.0
content-length
43
content-type
image/gif
rum
dsum-sec.casalemedia.com/ Frame 51DE
Redirect Chain
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336718477784910&forward=
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336718477784910&forward=&C=1
43 B
1006 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336718477784910&forward=&C=1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-232.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 12 Oct 2021 16:33:55 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 12 Oct 2021 16:33:55 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 12 Oct 2021 16:33:55 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5142336718477784910&forward=&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
295
Expires
Tue, 12 Oct 2021 16:33:55 GMT
360947.gif
idsync.rlcdn.com/ Frame 51DE
42 B
418 B
Image
General
Full URL
https://idsync.rlcdn.com/360947.gif?partner_uid=5142336718477784910
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 12 Oct 2021 16:33:55 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
clear
content-length
42
rocketfuel_sync
x.dlx.addthis.com/e/ Frame 51DE
43 B
191 B
Image
General
Full URL
https://x.dlx.addthis.com/e/rocketfuel_sync?na_exid=5142336718477784910
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-191.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=2628000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
cache-control
max-age=0, no-cache, no-store
expires
Tue, 12 Oct 2021 16:33:55 GMT
content-length
43
strict-transport-security
max-age=2628000
content-type
image/gif
partner
sync.search.spotxchange.com/ Frame 51DE
Redirect Chain
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336718477784910&img=1
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336718477784910&img=1&__user_check__=1&sync_id=317b4e59-2b7a-11ec-b27f-1ee5b9e10106
43 B
549 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5142336718477784910&img=1&__user_check__=1&sync_id=317b4e59-2b7a-11ec-b27f-1ee5b9e10106
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
138
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Server
nginx
Location
/partner?adv_id=7180&uid=5142336718477784910&img=1&__user_check__=1&sync_id=317b4e59-2b7a-11ec-b27f-1ee5b9e10106
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
113
Connection
keep-alive
Content-Length
0
sync
partners.tremorhub.com/ Frame 51DE
43 B
183 B
Image
General
Full URL
https://partners.tremorhub.com/sync?UIRF=5142336718477784910&r=gh59EDyTCOhI
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.206.168.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-206-168-194.compute-1.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
server
Apache-Coyote/1.1
p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type
image/gif
g.pixel
aa.agkn.com/adscores/ Frame 51DE
43 B
238 B
Image
General
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=5142336718477784910
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.169.90.17 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-169-90-17.eu-west-2.compute.amazonaws.com
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
server
AAWebServer
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
usermatch.gif
beacon.krxd.net/ Frame 51DE
0
338 B
Image
General
Full URL
https://beacon.krxd.net/usermatch.gif?partner_id=rfuel&partner_user_id=5142336718477784910
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.48.23.163 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-48-23-163.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
cache-control
private, no-cache, no-store
x-request-time
D=32 t=1634056435
x-served-by
beacon-n005-dub-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync
x.bidswitch.net/ul_cb/ Frame 51DE
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=5142336718477784910&expires=30
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5142336718477784910&expires=30
43 B
495 B
Image
General
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5142336718477784910&expires=30
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.127.209.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-209-187.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5142336718477784910&expires=30
Date
Tue, 12 Oct 2021 16:33:55 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
cm
p.rfihub.com/ Frame 51DE
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
  • https://p.rfihub.com/cm?in=1&pub=21653&userid=YWW48wAAALL47QP7
42 B
1 KB
Image
General
Full URL
https://p.rfihub.com/cm?in=1&pub=21653&userid=YWW48wAAALL47QP7
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://20835101p.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
via
1.1 varnish
server
Varnish
x-timer
S1634056436.908449,VS0,VE0
x-served-by
cache-hhn4068-HHN
x-cache
HIT
location
https://p.rfihub.com/cm?in=1&pub=21653&userid=YWW48wAAALL47QP7
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
/
com-workadv.netmng.com/
3 KB
2 KB
Script
General
Full URL
https://com-workadv.netmng.com/?vid=bmky98yq7hrus&referer=&browserPixelRatio=1&browserWidth=1600&browserHeight=1200&aid=6323&siclientid=105193&url=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&p5=account%3A%20enroll&p6=register_enroll&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=&function=browser_check&nmfp=1&r=118fe3
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.38.167.35 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
openresty /
Resource Hash
33aff076a0cc91f96dd5ead2aed0ba9be83f5638155a8c0e7794c685f6bddf8c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 12 Oct 2021 16:33:28 GMT
Content-Encoding
gzip
Last-Modified
Sun, 10 Oct 2021 16:33:28 GMT
Server
openresty
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa PSAa OUR BUS COM NAV"
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript; charset=UTF-8
Expires
Sun, 10 Oct 2021 16:33:28 GMT
chat-widget.min.js
ebgcc.brightpattern.com/clientweb/chat-client-v4/build/
215 KB
64 KB
Script
General
Full URL
https://ebgcc.brightpattern.com/clientweb/chat-client-v4/build/chat-widget.min.js?cache-control=1337
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
d562166d55f4a91e0051cbaf6f164730b7f3b11f01d1560607c7740eabc067a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Oct 2021 20:26:04 GMT
Server
nginx/1.21.3
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains
index.php
stats.kaltura.com/api_v3/
48 B
646 B
XHR
General
Full URL
https://stats.kaltura.com/api_v3/index.php?service=stats&apiVersion=3.1&expiry=86400&clientTag=kwidget%3Av2.90&format=1&ignoreNull=1&action=collect&event:eventType=2&event:clientVer=2.90&event:currentPoint=0&event:duration=99&event:eventTimestamp=1634056435666&event:isFirstInSession=false&event:objectType=KalturaStatsEvent&event:partnerId=1093992&event:sessionId=bc2f98e7-377e-b4b0-158a-f4839e8fb3dd&event:uiconfId=23289491&event:seek=false&event:entryId=1_vcy14csy&event:historyEvents=010000000000000000000000-1-1&event:widgetId=_1093992&event:referrer=https%253A%252F%252Fwww.workingadvantage.com%252Faccount.php&hasKanalony=true&kalsig=9e7c4a24c948b79e561cc0b31543718d
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.165.115.120 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-115-120.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
5c16626c2d303648ca08a0c058cf0049eca5c1449f4b25995386032b5dd82880

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:56 GMT
Server
nginx
X-Kava-Me
ip-172-30-37-200
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Expose-Headers
Server,Content-Length,Content-Range,Date
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Origin,Range,Accept-Encoding,Referer,Cache-Control,User-Agent,Content-Type
Expires
Tue, 12 Oct 2021 16:33:55 GMT
260
cfvod.kaltura.com/p/1093992/sp/109399200/thumbnail/entry_id/1_vcy14csy/version/100031/width/460/height/ Frame C107
29 KB
30 KB
Image
General
Full URL
https://cfvod.kaltura.com/p/1093992/sp/109399200/thumbnail/entry_id/1_vcy14csy/version/100031/width/460/height/260
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.66.140.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
openresty /
Resource Hash
de451150b977bde62d4f17739f9969b72fa6ef56bdb6ec135798b772bf2e6a86

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Kaltura
cached-thumb-exists,d38dc87d52428da6f44a34d955809da5
X-Me
ny-nvp1-fthumb-4731
Date
Tue, 12 Oct 2021 16:21:21 GMT
Via
1.1 02cd8164e89a1598d410a9198582d47d.cloudfront.net (CloudFront)
Age
2635
X-Cache
Hit from cloudfront
X-Vod-Session
2095827525
X-Proxy-Me
nvp1-vod-proxy-green-55b5f8d76b-mvzv8
Connection
keep-alive
Content-Length
29591
Pragma
Last-Modified
Tue, 29 Aug 2017 18:53:05 GMT
Server
openresty
X-Proxy-Session
43e2b88825d048a7b9fa05c88c1a0fa4
X-Vod-Me
nvp1-vod-packager-5d9d96788f-d9mfr
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600, max-stale=0
X-Amz-Cf-Pop
FRA60-P4
Accept-Ranges
bytes
X-Kaltura-Session
753679900, 1633887676
X-Amz-Cf-Id
TVNAqAGSiQDmivXL-cEZTDtlBLzP_8cIyPCmL7kdF3QdTAOnReShUg==
Expires
Tue, 12 Oct 2021 16:50:00 GMT
icomoon.woff
cdnapisec.kaltura.com/html5/html5lib/v2.90//skins/kdark/fonts/ Frame C107
14 KB
14 KB
Font
General
Full URL
https://cdnapisec.kaltura.com/html5/html5lib/v2.90//skins/kdark/fonts/icomoon.woff?2021-08-05T07:31:40Z
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.225.94 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-225-94.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f736e25921404b6af52d9d645965a6f88db506d6dda0d96125f79a1f46aba2bc

Request headers

Referer
https://www.workingadvantage.com/
Origin
https://www.workingadvantage.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-me
ny-nvp1-fplay-e041
date
Tue, 12 Oct 2021 16:33:55 GMT
last-modified
Thu, 05 Aug 2021 07:32:04 GMT
server
nginx
etag
"3744-5c8caea55e500"
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=2300964
accept-ranges
bytes
x-robots-tag
noindex
content-length
14148
expires
Mon, 08 Nov 2021 07:43:19 GMT
index.php
analytics.kaltura.com/api_v3/
48 B
646 B
XHR
General
Full URL
https://analytics.kaltura.com/api_v3/index.php?service=analytics&apiVersion=3.1&expiry=86400&clientTag=kwidget%3Av2.90&format=1&ignoreNull=1&action=trackEvent&entryId=1_vcy14csy&partnerId=1093992&eventType=1&sessionId=bc2f98e7-377e-b4b0-158a-f4839e8fb3dd&eventIndex=1&bufferTime=0&actualBitrate=-1&flavorId=-1&referrer=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php&deliveryType=hls&sessionStartTime=null&uiConfId=23289491&clientVer=2.90&position=0&playbackType=vod&kalsig=ba55f5170e8287a68737f80ca3de2ca3
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.165.115.120 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-115-120.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
f2fc57ad9df7f41e38a595be72e9dc191a9b8d63ed07fec8c6a7ca326527ded9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:56 GMT
Server
nginx
X-Kava-Me
ip-172-30-36-249
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Expose-Headers
Server,Content-Length,Content-Range,Date
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Origin,Range,Accept-Encoding,Referer,Cache-Control,User-Agent,Content-Type
Expires
Tue, 12 Oct 2021 16:33:55 GMT
index.php
stats.kaltura.com/api_v3/
48 B
646 B
XHR
General
Full URL
https://stats.kaltura.com/api_v3/index.php?service=stats&apiVersion=3.1&expiry=86400&clientTag=kwidget%3Av2.90&format=1&ignoreNull=1&action=collect&event:eventType=1&event:clientVer=2.90&event:currentPoint=0&event:duration=99&event:eventTimestamp=1634056435802&event:isFirstInSession=false&event:objectType=KalturaStatsEvent&event:partnerId=1093992&event:sessionId=bc2f98e7-377e-b4b0-158a-f4839e8fb3dd&event:uiconfId=23289491&event:seek=false&event:entryId=1_vcy14csy&event:historyEvents=110000000000000000000000-2-2&event:widgetId=_1093992&event:referrer=https%253A%252F%252Fwww.workingadvantage.com%252Faccount.php&hasKanalony=true&kalsig=db62c9e45bb1998947d9e9db62d464fd
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.165.115.120 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-115-120.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e109fdbb766821b34282c79e213de1f82679891b4c693b50bbdf2de097dbdbfa

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:56 GMT
Server
nginx
X-Kava-Me
ip-172-30-37-146
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Expose-Headers
Server,Content-Length,Content-Range,Date
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Origin,Range,Accept-Encoding,Referer,Cache-Control,User-Agent,Content-Type
Expires
Tue, 12 Oct 2021 16:33:55 GMT
track
events.api.boomtrain.com/event/
2 B
248 B
XHR
General
Full URL
https://events.api.boomtrain.com/event/track
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.54.221.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-221-90.compute-1.amazonaws.com
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
server
nginx
allow
GET, HEAD, OPTIONS, POST
access-control-allow-methods
GET, PUT, POST, DELETE
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
X-Requested-With, Content-Type, Authorization, x-app-id
content-length
2
s15924534708602
smetrics.workingadvantage.com/b/ss/entbenworking/1/JS-2.22.2-LBWB/
43 B
253 B
Image
General
Full URL
https://smetrics.workingadvantage.com/b/ss/entbenworking/1/JS-2.22.2-LBWB/s15924534708602?AQB=1&ndh=1&pf=1&t=12%2F9%2F2021%2016%3A33%3A55%202%200&mid=25777024114049483313329385723146651520&aamlh=6&ce=UTF-8&ns=entertainmentbenefits&cdp=2&fpCookieDomainPeriods=2&g=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&cc=USD&server=www.workingadvantage.com&c6=desktop&v9=Tuesday%20-%2012%3A30PM&c29=wa&c46=October%7C12%7C2021%7CTuesday%7C12%7C33%7CPM%7CWeekday%7CAfternoon&v81=reflektion%20experience%20selected&pe=lnk_o&pev2=rfk&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&lrt=53&AQE=1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-188-95-229.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
x-content-type-options
nosniff
x-c
main-1540.I13d07b.M0-522
p3p
CP="This is not a P3P policy"
vary
*
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Wed, 13 Oct 2021 16:33:55 GMT
server
jag
xserver
anedge-b4c7fdd79-tlxmd
etag
3509109475453829120-4619956700220910543
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Mon, 11 Oct 2021 16:33:55 GMT
RC4c249ae6eb834f3481a5808daa1fa12c-source.min.js
assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/
496 B
567 B
Script
General
Full URL
https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/RC4c249ae6eb834f3481a5808daa1fa12c-source.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a1bc6c9e5651486220976007f7b0003ddb7995cc56e8dfb429a380c6a4f0b339

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
last-modified
Tue, 05 Oct 2021 17:48:58 GMT
server
AkamaiNetStorage
etag
"592ad25a395ffaf4aa8ecf588b05bd76:1633456138.17857"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
295
expires
Tue, 12 Oct 2021 17:33:55 GMT
RCa74f93b2a9844c559b33b24b12dec6e8-source.min.js
assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/
492 B
570 B
Script
General
Full URL
https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/RCa74f93b2a9844c559b33b24b12dec6e8-source.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
250f1e045c9be2031eefd4d3ad369cf83421dd6eb38a5dab9c4e3075d449b69b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
last-modified
Tue, 05 Oct 2021 17:48:58 GMT
server
AkamaiNetStorage
etag
"592ad25a395ffaf4aa8ecf588b05bd76:1633456138.17857"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
298
expires
Tue, 12 Oct 2021 17:33:55 GMT
RCc2397d04bf364fbf9c479b26f4f89af4-source.min.js
assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/
409 B
532 B
Script
General
Full URL
https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/RCc2397d04bf364fbf9c479b26f4f89af4-source.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e5ae9b316fcbb2ed2bfb7c729e4a18906ce1ae86281d61442ff8f510a55ac91c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
last-modified
Tue, 05 Oct 2021 17:48:58 GMT
server
AkamaiNetStorage
etag
"592ad25a395ffaf4aa8ecf588b05bd76:1633456138.17857"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
261
expires
Tue, 12 Oct 2021 17:33:55 GMT
RCaebef32d48d84459b4cf19acbda9386d-source.min.js
assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/
1 KB
816 B
Script
General
Full URL
https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/RCaebef32d48d84459b4cf19acbda9386d-source.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
9dca999e9382d3b62d34c995637a84d71c8e732e2e78fb38c7a0eeaa6ff401b2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
last-modified
Tue, 05 Oct 2021 17:48:58 GMT
server
AkamaiNetStorage
etag
"592ad25a395ffaf4aa8ecf588b05bd76:1633456138.17857"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
544
expires
Tue, 12 Oct 2021 17:33:55 GMT
siteseal_gd_3_h_l_m.gif
seal.godaddy.com/images/3/en/
4 KB
4 KB
Image
General
Full URL
https://seal.godaddy.com/images/3/en/siteseal_gd_3_h_l_m.gif
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
173.201.201.4 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-173-201-201-4.ip.secureserver.net
Software
Apache /
Resource Hash
1449346947ba3d2266f702cc5488e1a0fb75ef67cdb105d5dbe178eff0af14b2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:55 GMT
Cache-Control
max-age=86400
Expires
Wed, 13 Oct 2021 16:33:55 GMT
Server
Apache
Accept-Ranges
bytes
Content-Length
3827
Content-Type
image/gif
pixel;r=1617232571;rf=0;a=p-zhY3S1asLzBpZ;url=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denrol...
pixel.quantserve.com/
35 B
372 B
Image
General
Full URL
https://pixel.quantserve.com/pixel;r=1617232571;rf=0;a=p-zhY3S1asLzBpZ;url=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll;uht=2;fpan=1;fpa=P0-1844199152-1634056435871;pbc=;ns=0;ce=1;qjs=1;qv=00a3769c-20210929173447;cm=;gdpr=0;ref=;d=workingadvantage.com;je=0;sr=1600x1200x24;dst=0;et=1634056435871;tzo=0;ogl=
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.189 , United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:55 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
RC68c132235d834acaa4f19f1eaf4f4f73-source.min.js
assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/
298 B
452 B
Script
General
Full URL
https://assets.adobedtm.com/a281455e4dfe/1c19d10a0484/bc23466eca0d/RC68c132235d834acaa4f19f1eaf4f4f73-source.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.141.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-141-223.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a41cd53ee007f390f168f20d2a90e282e9632e6dd2ce1148c40d8b44a9bc076f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:55 GMT
content-encoding
gzip
last-modified
Tue, 05 Oct 2021 17:48:58 GMT
server
AkamaiNetStorage
etag
"592ad25a395ffaf4aa8ecf588b05bd76:1633456138.17857"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.workingadvantage.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
181
expires
Tue, 12 Oct 2021 17:33:55 GMT
configuration
ebgcc.brightpattern.com/clientweb/api/v1/ Frame
0
0
Preflight
General
Full URL
https://ebgcc.brightpattern.com/clientweb/api/v1/configuration?tenantUrl=ebgcc.brightpattern.com&domain=www.workingadvantage.com&appId=05363aaa62214ab49d457fb6ae0dc5e4
Protocol
HTTP/1.1
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization
Origin
https://www.workingadvantage.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Server
nginx/1.21.3
Date
Tue, 12 Oct 2021 16:33:56 GMT
Content-Length
0
Connection
keep-alive
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Allow-Methods
GET, POST
Access-Control-Allow-Headers
Accept, Origin, Content-type, Authorization
Access-Control-Allow-Credentials
true
Allow
GET, HEAD, POST, TRACE, OPTIONS
Strict-Transport-Security
max-age=31536000; includeSubDomains
snippet.css
ebgcc.brightpattern.com/clientweb/chat-client-v4/css/
9 KB
9 KB
Stylesheet
General
Full URL
https://ebgcc.brightpattern.com/clientweb/chat-client-v4/css/snippet.css
Requested by
Host: ebgcc.brightpattern.com
URL: https://ebgcc.brightpattern.com/clientweb/chat-client-v4/build/chat-widget.min.js?cache-control=1337
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
1eae87c50589775a5471dcc9fee06fb6d545e5c758f5fbb6ab1d97fcd846c76e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:56 GMT
Last-Modified
Fri, 08 Oct 2021 20:26:04 GMT
Server
nginx/1.21.3
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8986
configuration
ebgcc.brightpattern.com/clientweb/api/v1/
14 KB
14 KB
XHR
General
Full URL
https://ebgcc.brightpattern.com/clientweb/api/v1/configuration?tenantUrl=ebgcc.brightpattern.com&domain=www.workingadvantage.com&appId=05363aaa62214ab49d457fb6ae0dc5e4
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
58f60bb9964c615bbb12602b6563c6d459dbd15ea6787c455293375842774784
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Authorization
MOBILE-API-140-327-PLAIN appId="05363aaa62214ab49d457fb6ae0dc5e4", clientId="undefined"
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:56 GMT
Server
nginx/1.21.3
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Methods
GET, POST
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Accept, Origin, Content-type, Authorization
Content-Length
14023
/
zn5bxs0kfcxmozrm9-ebg.siteintercept.qualtrics.com/WRSiteInterceptEngine/
7 KB
4 KB
Script
General
Full URL
https://zn5bxs0kfcxmozrm9-ebg.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_5BxS0KFcxMOzRM9&t=1634056436165
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
2fb74ff7bf2ea2be57773603e160779a154f835debb53d9edc93221b5eca47c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
280678
cf-polished
origSize=8435
edge-control
max-age=604800
x-envoy-upstream-service-time
4
vary
Accept-Encoding
timing-allow-origin
*
cf-bgj
minify
server
cloudflare
x-powered-by
Express
etag
W/"20f3-irKLrpvQusIKhhPWQW9iYQ58YUs"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600, s-maxage=604800
cf-ray
69d1bb963820fadf-DUS
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
nr-spa-1210.min.js
js-agent.newrelic.com/
41 KB
16 KB
Script
General
Full URL
https://js-agent.newrelic.com/nr-spa-1210.min.js
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ae2fc8f8e0697701399521441a03445a3c11d79719accd0099f41687c1536c49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id
S2ZWAVF_bOLxH9dSP4fxyD9xCbMCwnq9
content-encoding
gzip
etag
"d5eff122d09ab2c851fb1780f0287cbf"
x-amz-request-id
MAGTRK8AS2TWBKPD
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
15563
x-amz-id-2
gGMYV8OIO2MSmkGqcvQY50hjTAfzx2UFXcJLvXe01HcBlULlecvkeuKWxnp+aqSyj4XtQUwDL8o=
x-served-by
cache-hhn4020-HHN
last-modified
Tue, 22 Jun 2021 22:47:08 GMT
server
AmazonS3
x-timer
S1634056436.182874,VS0,VE0
date
Tue, 12 Oct 2021 16:33:56 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
9320
f30ac265f9
bam-cell.nr-data.net/1/
49 B
925 B
Script
General
Full URL
https://bam-cell.nr-data.net/1/f30ac265f9?a=10369366&v=1210.e2a3f80&to=ZFUGY0tVWRdVB0ENVl0fMUVQG14KUAFNSklbQA%3D%3D&rst=3734&ck=1&ref=https://www.workingadvantage.com/account.php&ap=178&be=2319&fe=3705&dc=2897&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1634056432461,%22n%22:0,%22f%22:1721,%22dn%22:1722,%22dne%22:1722,%22c%22:1722,%22s%22:1722,%22ce%22:1722,%22rq%22:1722,%22rp%22:2097,%22rpe%22:2248,%22dl%22:2101,%22di%22:2888,%22ds%22:2895,%22de%22:2898,%22dc%22:3702,%22l%22:3704,%22le%22:3706%7D,%22navigation%22:%7B%7D%7D&fp=2423&fcp=2663&at=SBIFFQNPShk%3D&jsonp=NREUM.setToken
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:56 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-NewRelic-App-Data
PxQGQlVTAAQBXFFTFR0VMQFTYkEDCBADUxZRDVZkG3xWEU0YdQhAEgVCVAkDEWQcfgEVFk51XhUUUEJQCgMRQBxSFlIUCRoKA1EOVXRMB05WAhtDAAULUQdVBFFTBlZfVlQDV0BKBQNcEV0/
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Transfer-Encoding
chunked
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
access-control-allow-credentials
true
CF-Ray
69d1bb966b41fad8-DUS
12.0694c394c89326ddb6fe.chunk.js
siteintercept.qualtrics.com/dxjsmodule/
55 KB
17 KB
Script
General
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/12.0694c394c89326ddb6fe.chunk.js?Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web&Q_BRANDID=www.workingadvantage.com
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31364854b8b38cfa23c163773331d62f9658a3431e768636dd7da1c00d325bfa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
492486
cf-polished
origSize=57116
cf-ray
69d1bb9678bcfadf-DUS
edge-control
max-age=604800
x-envoy-upstream-service-time
20
vary
Accept-Encoding
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 06 Oct 2021 21:55:21 GMT
server
cloudflare
etag
W/"df1c-17c579a9528"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cf-bgj
minify
Targeting.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/
4 KB
1 KB
XHR
General
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_5BxS0KFcxMOzRM9&Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7d1acf17b186d7f2d346e5eec2ea702d0e22673b74f622c8386e81c4873f9a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-envoy-upstream-service-time
11
strict-transport-security
max-age=31536000; includeSubDomains; preload
timing-allow-origin
*
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
trace-id
9d57aad6a9905f2a
cf-ray
69d1bb96c960fadf-DUS
CoreModule.js
siteintercept.qualtrics.com/dxjsmodule/
99 KB
31 KB
Script
General
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web&Q_BRANDID=ebg
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5e9f8af2b56cdc55e6b99815370665abf86efe4882c1ae9ca3a95bbf61bbbfa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
492480
cf-polished
origSize=101807
cf-ray
69d1bb97bb63fadf-DUS
edge-control
max-age=604800
x-envoy-upstream-service-time
11
vary
Accept-Encoding
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 06 Oct 2021 21:55:21 GMT
server
cloudflare
etag
W/"18daf-17c579a9528"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cf-bgj
minify
4.d8e10f498578e92e442a.chunk.js
siteintercept.qualtrics.com/dxjsmodule/
2 KB
900 B
Script
General
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/4.d8e10f498578e92e442a.chunk.js?Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web&Q_BRANDID=ebg
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65b71746ce7505960de7d4f1f3f67ea8b444662dd248623373a3d076e7f814b6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
492480
cf-polished
origSize=2539
cf-ray
69d1bb980c17fadf-DUS
edge-control
max-age=604800
x-envoy-upstream-service-time
44
vary
Accept-Encoding
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 06 Oct 2021 21:55:21 GMT
server
cloudflare
etag
W/"9eb-17c579a9528"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cf-bgj
minify
1.c88c795093457e879938.chunk.js
siteintercept.qualtrics.com/dxjsmodule/
28 KB
6 KB
Script
General
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/1.c88c795093457e879938.chunk.js?Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web&Q_BRANDID=ebg
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67658c5e6d5c6330ae519306d8a2911554c6f5b0286f754b4d49d3890e2e7ee3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
492480
cf-polished
origSize=29269
cf-ray
69d1bb980c1bfadf-DUS
edge-control
max-age=604800
x-envoy-upstream-service-time
24
vary
Accept-Encoding
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 06 Oct 2021 21:55:21 GMT
server
cloudflare
etag
W/"7255-17c579a9528"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cf-bgj
minify
FeedbackButtonModule.js
siteintercept.qualtrics.com/dxjsmodule/
64 KB
23 KB
Script
General
Full URL
https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web&Q_BRANDID=ebg
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
a52353c2f4c441c1f50d634fcf160da6abaa62f36ad3a90e6e457b367479a0dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
492477
cf-polished
origSize=66052
cf-ray
69d1bb981c1ffadf-DUS
edge-control
max-age=604800
x-envoy-upstream-service-time
9
vary
Accept-Encoding
last-modified
Wed, 06 Oct 2021 21:55:21 GMT
server
cloudflare
x-powered-by
Express
etag
W/"10204-17c579a9528"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800
timing-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
cf-bgj
minify
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/
2 KB
1 KB
XHR
General
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_eCZGzmPdtkUq0EB&Version=19&Q_ORIGIN=https://www.workingadvantage.com&Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ba84c5184c13f11bdafdd5e4a6b7f1799dee6458e527b2bf41a33df40a34c70
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
280671
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
x-envoy-upstream-service-time
13
vary
Accept-Encoding
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
cf-ray
69d1bb983ec8c4d6-DUS
servershortname
expires
Thu, 02 Oct 2031 08:54:12 GMT
Asset.php
siteintercept.qualtrics.com/WRSiteInterceptEngine/
2 KB
665 B
XHR
General
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_5mPBvFDb3REP0dT&Version=7&Q_InterceptID=SI_eCZGzmPdtkUq0EB&Q_ORIGIN=https://www.workingadvantage.com&Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f2f94807597fa1cb903f7e33ba6fe0f09522edc921465a1cc952ed4176403a80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
280672
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control
max-age=604800
x-envoy-upstream-service-time
10
vary
Accept-Encoding
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials
false
cf-ray
69d1bb983ecac4d6-DUS
servershortname
expires
Fri, 03 Oct 2031 14:42:06 GMT
/
siteintercept.qualtrics.com/WRSiteInterceptEngine/
45 B
224 B
XHR
General
Full URL
https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_5mPBvFDb3REP0dT&Q_SIID=SI_eCZGzmPdtkUq0EB&Q_ASID=AS_56381657&Q_CLIENTVERSION=1.62.0&Q_CLIENTTYPE=web&r=1634056436580
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-envoy-upstream-service-time
4
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
45
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
trace-id
cba56f23c3b36e71
cf-ray
69d1bb98aff8c4d6-DUS
wr-dialog-close-btn-black.png
siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/
256 B
510 B
Image
General
Full URL
https://siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-black.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2547640cd989b80083eb3ade2a4993c1776a1229cfffd41adeb0fef3e86eaf2b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
14928593
cf-polished
origSize=757
p3p
CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
cf-bgj
imgq:85,h2pri
vary
Accept-Encoding
content-length
256
last-modified
Tue, 08 Dec 2020 23:54:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
cache-control
max-age=315360000, public
accept-ranges
bytes
cf-ray
69d1bb98ad40fadf-DUS
servershortname
expires
Tue, 24 Dec 2030 03:57:36 GMT
availability
ebgcc.brightpattern.com/clientweb/api/v1/ Frame
0
0
Preflight
General
Full URL
https://ebgcc.brightpattern.com/clientweb/api/v1/availability?tenantUrl=ebgcc.brightpattern.com&domain=www.workingadvantage.com&appId=05363aaa62214ab49d457fb6ae0dc5e4
Protocol
HTTP/1.1
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization
Origin
https://www.workingadvantage.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Server
nginx/1.21.3
Date
Tue, 12 Oct 2021 16:33:56 GMT
Content-Length
0
Connection
keep-alive
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Allow-Methods
GET, POST
Access-Control-Allow-Headers
Accept, Origin, Content-type, Authorization
Access-Control-Allow-Credentials
true
Allow
GET, HEAD, POST, TRACE, OPTIONS
Strict-Transport-Security
max-age=31536000; includeSubDomains
iceservers
ebgcc.brightpattern.com/clientweb/api/v1/ Frame
0
0
Preflight
General
Full URL
https://ebgcc.brightpattern.com/clientweb/api/v1/iceservers?tenantUrl=ebgcc.brightpattern.com&domain=www.workingadvantage.com&appId=05363aaa62214ab49d457fb6ae0dc5e4
Protocol
HTTP/1.1
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization
Origin
https://www.workingadvantage.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Server
nginx/1.21.3
Date
Tue, 12 Oct 2021 16:33:56 GMT
Content-Length
0
Connection
keep-alive
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Allow-Methods
GET, POST
Access-Control-Allow-Headers
Accept, Origin, Content-type, Authorization
Access-Control-Allow-Credentials
true
Allow
GET, HEAD, POST, TRACE, OPTIONS
Strict-Transport-Security
max-age=31536000; includeSubDomains
availability
ebgcc.brightpattern.com/clientweb/api/v1/
32 B
483 B
XHR
General
Full URL
https://ebgcc.brightpattern.com/clientweb/api/v1/availability?tenantUrl=ebgcc.brightpattern.com&domain=www.workingadvantage.com&appId=05363aaa62214ab49d457fb6ae0dc5e4
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
b1adacbdcd9a1302ebf82abb4695066528a693b75d7f75a110f1834b18c94cec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Authorization
MOBILE-API-140-327-PLAIN appId="05363aaa62214ab49d457fb6ae0dc5e4", clientId="undefined"
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:56 GMT
Server
nginx/1.21.3
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Methods
GET, POST
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Accept, Origin, Content-type, Authorization
Content-Length
32
iceservers
ebgcc.brightpattern.com/clientweb/api/v1/
14 B
465 B
XHR
General
Full URL
https://ebgcc.brightpattern.com/clientweb/api/v1/iceservers?tenantUrl=ebgcc.brightpattern.com&domain=www.workingadvantage.com&appId=05363aaa62214ab49d457fb6ae0dc5e4
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.101.26.126 , United States, ASN33411 (BRIGHTPATTERNSC, US),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
c942d9ddbaf0a866c828a904b734915c84ec8b1137b04a698325500b40a2f238
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Authorization
MOBILE-API-140-327-PLAIN appId="05363aaa62214ab49d457fb6ae0dc5e4", clientId="undefined"
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Tue, 12 Oct 2021 16:33:56 GMT
Server
nginx/1.21.3
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Methods
GET, POST
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://www.workingadvantage.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Accept, Origin, Content-type, Authorization
Content-Length
14
100
cfvod.kaltura.com/p/1093992/sp/109399200/thumbnail/entry_id/1_vcy14csy/version/100031/width/100/height/undefined/vid_slices/ Frame C107
133 KB
134 KB
Image
General
Full URL
https://cfvod.kaltura.com/p/1093992/sp/109399200/thumbnail/entry_id/1_vcy14csy/version/100031/width/100/height/undefined/vid_slices/100
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.66.140.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
openresty /
Resource Hash
627e571d76a1633f6ac725b3d619d3ca2add0737c75fe167db775a237e40b1f2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Kaltura
cached-thumb-exists,6fd1f887bb7c0d26e1d5a13cb5714b0c
X-Me
ny-nvp1-fthumb-e2c7
Date
Tue, 12 Oct 2021 16:21:22 GMT
Via
1.1 02cd8164e89a1598d410a9198582d47d.cloudfront.net (CloudFront)
Age
2635
X-Cache
Hit from cloudfront
X-Vod-Session
1321281862
X-Proxy-Me
nvp1-vod-proxy-green-55b5f8d76b-5hl82
Connection
keep-alive
Content-Length
136085
Pragma
Last-Modified
Wed, 16 Aug 2017 18:31:54 GMT
Server
openresty
X-Proxy-Session
b41176cb3e581fb07b2e47d3287173c6
X-Vod-Me
nvp1-vod-packager-5d9d96788f-7nh2m
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600, max-stale=0
X-Amz-Cf-Pop
FRA60-P4
Accept-Ranges
bytes
X-Kaltura-Session
1823614870, 1633948093
X-Amz-Cf-Id
lcQg-vW0i6IL4N6SgnKmT0FKFZwQR0vUyMovmtd6C99VS10bBLXrUA==
Expires
Tue, 12 Oct 2021 16:50:01 GMT
an
alweb.rfk.workingadvantage.com/rfkj/1/11273-152007103/
44 B
162 B
Image
General
Full URL
https://alweb.rfk.workingadvantage.com/rfkj/1/11273-152007103/an?&C=1,uO8AuSxZb2hXl7QI97JAviNAt39Mt35Mez4yez4I8ChE8zEycjkOc30Tcj0P8yMyp28W8D1z8DQ,&N=1,uO9OsTkyey8N8DQ,&t=1634056436860
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.88.197.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-88-197-125.compute-1.amazonaws.com
Software
gunicorn/19.6.0 /
Resource Hash
d1c4aa4fc27ca65d42b693b60f19546c4a50c002394c364dbbef45710858df7a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:56 GMT
last-modified
Wed, 19 May 2021 07:43:58 GMT
server
gunicorn/19.6.0
content-length
44
content-type
image/gif
html
n2.mouseflow.com/
0
325 B
XHR
General
Full URL
https://n2.mouseflow.com/html?website=913a7fd6-dc0a-49da-96d8-8f73cb55b75c&session=1675ed90a245adc918914ced52fbfc6a&page=1012547168f21021628e2aac9f5dccaff0e8adc7&gz=1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
207.244.84.210 Alexandria, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
Mouseflow /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:57 GMT
server
Mouseflow
x-recorder
rec-09-us
content-type
text/plain; charset=Windows-1252
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
0
expires
-1
f30ac265f9
bam-cell.nr-data.net/events/1/
24 B
512 B
XHR
General
Full URL
https://bam-cell.nr-data.net/events/1/f30ac265f9?a=10369366&v=1210.e2a3f80&to=ZFUGY0tVWRdVB0ENVl0fMUVQG14KUAFNSklbQA%3D%3D&rst=4613&ck=1&ref=https://www.workingadvantage.com/account.php
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type
text/plain

Response headers

Date
Tue, 12 Oct 2021 16:33:57 GMT
CF-Cache-Status
DYNAMIC
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.workingadvantage.com
access-control-allow-credentials
true
Connection
keep-alive
CF-Ray
69d1bb9bbdf1fad8-DUS
Content-Length
24
st
px.steelhousemedia.com/
2 KB
2 KB
Script
General
Full URL
https://px.steelhousemedia.com/st?ga_tracking_id=UA-4045288-1&ga_client_id=422947464.1634056435&shpt=Working%20Advantage%20-%20Employee%20Discounts&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22UA-4045288-1%22%2C%22ga_client_id%22%3A%22422947464.1634056435%22%2C%22shpt%22%3A%22Working%20Advantage%20-%20Employee%20Discounts%22%2C%22dcm_cid%22%3A%22422947464.1634056435%22%2C%22dcm_gid%22%3A%221671322199.1634056435%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A1%2C%22getTrackingIdByGA%22%3A%22FAILED%22%2C%22getTrackingIdByOther1%22%3A%22FAILED%22%2C%22getTrackingIdByOther2%22%3A%22OK%22%2C%22getClientIdByGA%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=422947464.1634056435&dcm_gid=1671322199.1634056435&dxver=4.0.0&shaid=23005&plh=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&cb=59714136525195240&shadditional=googletagmanager%3Dtrue%2C%2Csh_conversion%3DSHBLOCK&shpn=Access%20to%20Working%20Advantage%20is%20limited%20to%20registered%20employees%20of%20participating%20Companies&shps=AccesstoWorkingAdvantageislimitedtoregisteredemployeesofparticipatingCompanies&shpc=
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
44.225.29.129 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-225-29-129.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
eb6ea27172834f43d0f4b39a47baaa91dd4533ee06288767616c3819d455f385

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 12 Oct 2021 16:33:58 GMT
content-encoding
gzip
connection
close
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
content-type
application/javascript;charset=utf-8
gs
ww.steelhousemedia.com/
144 B
733 B
Script
General
Full URL
https://ww.steelhousemedia.com/gs
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
44.238.130.186 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-238-130-186.us-west-2.compute.amazonaws.com
Software
istio-envoy /
Resource Hash
9668b1f443dc5794cfbf60e458f51c62ec2f067fa34d7c49d4e5c43905b08826

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Tue, 12 Oct 2021 16:33:58 GMT
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
istio-envoy
access-control-allow-methods
GET, POST, OPTIONS
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-envoy-upstream-service-time
0
connection
close
content-type
application/javascript;charset=utf-8
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
content-length
144
x-application-context
application:prod:8080
dom
n2.mouseflow.com/
0
324 B
XHR
General
Full URL
https://n2.mouseflow.com/dom?gz=1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
207.244.84.210 Alexandria, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
Mouseflow /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:58 GMT
server
Mouseflow
x-recorder
rec-04-us
content-type
text/plain; charset=Windows-1252
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
0
expires
-1
st
px.steelhousemedia.com/
4 KB
2 KB
Script
General
Full URL
https://px.steelhousemedia.com/st?ga_tracking_id=UA-4045288-1&ga_client_id=422947464.1634056435&shpt=Working%20Advantage%20-%20Employee%20Discounts&ga_info=%7B%22status%22%3A%22OK%22%2C%22ga_tracking_id%22%3A%22UA-4045288-1%22%2C%22ga_client_id%22%3A%22422947464.1634056435%22%2C%22shpt%22%3A%22Working%20Advantage%20-%20Employee%20Discounts%22%2C%22dcm_cid%22%3A%22422947464.1634056435%22%2C%22dcm_gid%22%3A%221671322199.1634056435%22%2C%22execution_workflow%22%3A%7B%22iteration%22%3A1%2C%22getTrackingIdByGA%22%3A%22FAILED%22%2C%22getTrackingIdByOther1%22%3A%22FAILED%22%2C%22getTrackingIdByOther2%22%3A%22OK%22%2C%22getClientIdByGA%22%3A%22OK%22%2C%22shpt%22%3A%22OK%22%2C%22dcm_gid%22%3A%22OK%22%7D%7D&dcm_cid=422947464.1634056435&dcm_gid=1671322199.1634056435&dxver=4.0.0&shaid=23005&plh=https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll&shadditional=googletagmanager%3Dtrue%2C%2Csh_conversion%3DSHBLOCK&shpn=Access%20to%20Working%20Advantage%20is%20limited%20to%20registered%20employees%20of%20participating%20Companies&shps=AccesstoWorkingAdvantageislimitedtoregisteredemployeesofparticipatingCompanies&shpc=&cb=1634056438078559&shguid=edb132a5-140d-3e19-bae0-883fdca3676b&shgts=1634056438757
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
44.225.29.129 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-225-29-129.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
bb009653a5189ce35dfdf27f5e1673d61141fe7ab60676a23f894bbde8faa950

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 12 Oct 2021 16:33:59 GMT
content-encoding
gzip
connection
close
p3p
CP="NON DSP COR NID CURa ADMa DEVa PSAa PSDa OUR STP UNI COM NAV INT STA PRE"
content-type
application/javascript;charset=utf-8
tdsync
px.steelhousemedia.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8&gdpr=&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=steelhouse&ttd_tpi=1&ttd_puid=32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8&gdpr=&gdpr_consent=
  • https://px.steelhousemedia.com/tdsync?tdid=04d7bca9-6a52-4353-be00-36bc94ac014e&shguid=32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8
0
303 B
Image
General
Full URL
https://px.steelhousemedia.com/tdsync?tdid=04d7bca9-6a52-4353-be00-36bc94ac014e&shguid=32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
44.225.29.129 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-225-29-129.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 12 Oct 2021 16:33:59 GMT
connection
close
access-control-allow-headers
Accept, Content-Type, x-requested-with, X-Custom-Header
access-control-allow-methods
GET, POST, OPTIONS
x-application-context
application:awsprod,confluent:9025

Redirect headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:59 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://px.steelhousemedia.com/tdsync?tdid=04d7bca9-6a52-4353-be00-36bc94ac014e&shguid=32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
277
/
insight.adsrvr.org/track/evnt/
70 B
261 B
Image
General
Full URL
https://insight.adsrvr.org/track/evnt/?adv=43q8xun&ct=0:eygtemm&fmt=3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.19.133.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-19-133-118.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:33:59 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
dom
n2.mouseflow.com/
0
323 B
XHR
General
Full URL
https://n2.mouseflow.com/dom?gz=1
Requested by
Host: www.workingadvantage.com
URL: https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
207.244.84.210 Alexandria, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
Mouseflow /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.workingadvantage.com/account.php?utm_campaign=las-vegas&utm_medium=October-4-2021-Hotels&utm_source=Email&sub=enroll
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Tue, 12 Oct 2021 16:34:00 GMT
server
Mouseflow
x-recorder
rec-03-us
content-type
text/plain; charset=Windows-1252
access-control-allow-origin
https://www.workingadvantage.com
cache-control
no-cache
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
0
expires
-1

Verdicts & Comments Add Verdict or Comment

305 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| onbeforexrselect boolean| originAgentCluster function| _js_ebgurl string| css function| setCookie function| getCookie function| jQueryWait function| display_campaign function| adjust_header object| scripts string| LI_AFFILIATE_ID object| li_info object| kWidgetWrapper object| InteractionAnalytics object| InteractionAnalyticsUtility object| EBGData object| rfk string| rfk_product_base_path object| ebg object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in function| AdobePrivacy object| _sdiToolkit object| targetGlobalSettings object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| trackReflektion function| url object| NREUM object| newrelic function| __nr_require function| $ function| jQuery boolean| mapLoaded function| objectKeys function| initCombinedSearch object| HomeProducts function| setCityName function| convert_vendor_fields function| vendor_copy_information function| validate_salesforce_form function| firstalert undefined| firstalert_callback function| firstalert_select function| popup_seats function| link_provinces function| generateVideo function| number_format function| appendScriptUrl undefined| geocoder undefined| directionsService undefined| directionsDisplay undefined| mapInstance function| generateMap object| HOME_SEARCH_SETTINGS function| initPlaceHomeAutocomplete function| attachCopyFunction function| copyToClipboard function| blank function| unblank function| seeMore function| currency function| wasFromHere function| initQuickFind function| customFilterAND function| getKeywords function| loadDynamicAdzerkBanners function| loadDynamicAdzerkBannersAPI function| checkBgImg function| OpenResponsiveModal function| validateADAForm function| submitADAForm function| openContentModal function| goBack function| getHTTPObject function| getEventTarget function| selectOption function| EBGCountry function| EBGProvince function| EBGCountryProvinceSelector string| logIfInIframe string| MWEMBED_VERSION string| SCRIPT_LOADER_URL object| KWidget object| kWidget function| kIsIOS function| kSupportsHTML5 function| kGetFlashVersion function| kSupportsFlash function| kalturaIframeEmbed function| kOutputFlashObject function| kIsHTML5FallForward function| kIframeWithoutApi function| kDirectDownloadFallback function| kGetKalturaEmbedSettings function| kGetKalturaPlayerList function| kCheckAddScript function| kAddScript function| kPageHasAudioOrVideoTags function| kLoadJsRequestSet function| kOverideJsFlashEmbed function| kDoIframeRewriteList function| kEmbedSettingsToUrl function| kGetAdditionalTargetCss function| kAppendCssUrl function| kAppendScriptUrl function| kFlashVars2Object function| kFlashVarsToUrl function| kFlashVarsToString function| kServiceConfigToUrl function| kRunMwDomReady function| restoreKalturaKDPCallback object| DomReady object| mw object| preMwEmbedReady object| preMwEmbedConfig function| md5 function| jsCallbackReady string| ebg_resources_domain string| ebg_cdn_domain object| search_items string| GoogleAnalyticsObject function| ga object| dataLayer object| _mfq function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| a0_0x433e function| a0_0x3d7e boolean| mouseflowDisableKeyLogging object| mouseflowHeatmap object| mouseflow object| MunchkinTracker object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| google_tag_manager number| adobe_request_count function| OPT593_Desktop_placeholder function| _rfi string| z string| y function| bt object| _bt function| gtag object| RfkParams object| __core-js_shared__ object| s_i_entbenworking function| extend function| RocketfuelBCPInclude function| RocketfuelBCPClass function| RocketfuelUtils object| RocketfuelBCP function| ownKeys function| _objectSpread function| _defineProperty string| RFK_DEPLOY_TIME object| su_fs boolean| adobepageviewfired function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| SERVICE_PATTERN_CHAT_CONFIG function| getThisScriptObject object| selfScriptTag function| extractOriginFromUrl string| chatPath function| loadScripts boolean| initialized function| ready object| __CF$cv$params string| sPostData object| oCountryProvinceSelector object| mwi_kalturaplayer15040337290 object| _qevents function| quantserve function| __qc object| ezt object| _qoptions function| qtrack object| _i1 object| platform function| kWidget_mediaReady_cb0 function| RFKgnan object| oNewCountry function| seal_getFlashVersion function| seal_useFlash function| seal_installSeal function| verifySeal string| dcm_cid undefined| dcm_tid string| dcm_gid object| zRequests string| key function| chatApiSessionBuildSessionFromSessionId function| chatApiSessionCheckSessionExists function| chatApiSessionCreateSession function| chatApiSessionCreateSessionHandler function| chatApiSessionCreateSessionHandlerHelpers function| escapeHTML function| escapeRecursive function| isValidHrefAttribute function| isValidProtocol function| isValidHost function| isValidEmailAddress function| chatApiSessionHandleEvents function| chatApiSessionHandleHistoryEvents function| chatApiSessionPrepareRequest function| chatApiSessionPrintToConsole function| chatApiSessionSendXhr function| chatApiSessionStartPoll object| chatApiSessionVariables function| clientChatPageConfigurationChat function| clientChatPageConnection function| clientChatPageGenerateInputs function| clientChatPageGetConnectRequestData function| clientChatPageGetUrlVars function| clientChatPageInitDragAndDrop function| clientChatPageMakeId function| clientChatPageOnFormSubmit function| clientChatPageOnMessage function| clientChatPageOnReady object| persistentChat function| clientChatPageSafeEndSession function| clientChatPageSafeEndSessionConfirm function| clientChatPageShowForm function| clientChatPageUpdateScrollbar function| clientChatPageUploadFiles object| clientChatPageVariables function| clientChatUiAppendLog function| clientChatUiChatMessageTyping function| clientChatUiEscapeHtml function| clientChatUiI18n function| clientChatUiMsgKeyPress function| clientChatUiNotTyping function| clientChatUiPrepareEvent function| clientChatUiSendLocation function| clientChatUiSendMessage function| clientChatUiSendNavigation object| clientChatUiVariables object| callbackUtilService object| commonUtilService object| commonConstants object| htmlUtilService function| buildProactiveOfferPreview function| proactiveChatStarter object| proactiveOfferService function| scaleProactiveOffer object| widgetConfiguration function| chatCompareUrl function| constructorConfigurationPreview function| constructorHelpers function| constructorPreviewCode function| chatPreview function| chatSnippet function| snippetBuild function| snippetChatUrl function| snippetCheckAddFrame function| snippetCheckAvailability function| snippetCheckDeviceSupport function| loadCobrowsingSolution function| removeCobrowsingPopup function| showCobrowsingStartPopup function| snippetConfigurationSnippet function| snippetDraggable function| snippetHandleAvailability function| snippetHelperFunctions function| snippetKeepOpenedState function| snippetOnInitialize function| snippetOpenChat function| snippetShowNotification object| snippetSurfly object| snippetTogetherJs function| snippetVariables function| updateChatStyles object| cobrowsingSolution object| QSI object| WAFQualtricsWebpackJsonP-cloud-1.62.0 object| _qsie function| mapName function| mapSku function| mapCategory function| mapCartValue object| oid function| mapCartQuantity object| irongate

70 Cookies

Domain/Path Name / Value
www.workingadvantage.com/ Name: PHPSESSID
Value: kruofgnr6ocnvifl70vh505jkh
www.workingadvantage.com/ Name: WORKINGADVANTAGE
Value: !hv//LHfH1J86Tp7TyRfNZ4y0D2cw9hQEaZvkOK9qnnIb3LJSan5NdLntLjGq+jeH5aqqvQhTsOh66qA=
www.workingadvantage.com/ Name: __rsu
Value: 1
.workingadvantage.com/ Name: at_check
Value: true
.demdex.net/ Name: demdex
Value: 25786024725159799883330558477773717055
.workingadvantage.com/ Name: AMCVS_B5F9FF2554F608410A4C98C6%40AdobeOrg
Value: 1
.workingadvantage.com/ Name: _mkto_trk
Value: id:409-BCN-480&token:_mch-workingadvantage.com-1634056434987-71069
.workingadvantage.com/ Name: _ga
Value: GA1.2.422947464.1634056435
.workingadvantage.com/ Name: _gid
Value: GA1.2.1671322199.1634056435
.workingadvantage.com/ Name: _gat
Value: 1
.workingadvantage.com/ Name: s_ecid
Value: MCMID%7C25777024114049483313329385723146651520
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YWW48wAAALL47QP7
.workingadvantage.com/ Name: _gcl_au
Value: 1.1.1250080874.1634056435
.rezync.com/ Name: zync-uuid
Value: 4ad13cba-0a4b-4a8b-8d8f-eb5fdecdd4e9:1634056434.99
.workingadvantage.com/ Name: mbox
Value: session#8263324637344f38ba3c56799395d35f#1634058296|PC#8263324637344f38ba3c56799395d35f.37_0#1697301236
.dpm.demdex.net/ Name: dpm
Value: 25786024725159799883330558477773717055
.workingadvantage.com/ Name: AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg
Value: -1124106680%7CMCIDTS%7C18913%7CMCMID%7C25777024114049483313329385723146651520%7CMCAAMLH-1634661234%7C6%7CMCAAMB-1634661234%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1634063635s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18920%7CvVersion%7C5.2.0
www.workingadvantage.com/ Name: gdpr_pp
Value: 1
.workingadvantage.com/ Name: btIdentify
Value: 8ea39d24-2b6a-4253-8850-335555582698
.workingadvantage.com/ Name: _bts
Value: bbf93432-becf-4fdd-a378-1f2a7c3ecebe
.workingadvantage.com/ Name: prev_url_v2
Value: https%253A%252F%252Fwww.workingadvantage.com%252Faccount.php%253Futm_campaign%253Dlas-vegas%2526utm_medium%253Doctober-4-2021-hotels%2526utm_source%253Demail%2526sub%253Denroll
.workingadvantage.com/ Name: gpv_v5
Value: account%3A%20enroll
.workingadvantage.com/ Name: s_cc
Value: true
.doubleclick.net/ Name: IDE
Value: AHWqTUn-yQFnV1jgVOVoLkVmXcdPVzDSymSAaSFr5DgrtGrxCcFRGCYgWxUgmBtkbBQ
.workingadvantage.com/ Name: __rutmb
Value: 152007103
.workingadvantage.com/ Name: __rutma
Value: 152007103-5j-a3-4e-1p-7yiu17e6xnbfnls09x6n-1634056435253.1634056435253.1634056435253.1.1.1
.workingadvantage.com/ Name: __ruid
Value: 152007103-5j-a3-4e-1p-7yiu17e6xnbfnls09x6n-1634056435253
.workingadvantage.com/ Name: __rcmp
Value: 0!bj1fZ2MsZj1nYyxzPTEsYz0yOTg5LHRyPTkwLHJuPTIxNix0cz0yMDIxMTAxMi4xNjMzLGQ9cGMsc3U9MTtuPXNiMSxmPXNiLHM9MSxjPTIwMTEsdD0yMDE4MTIwNi4wMDU0O249cncxLGY9cncscz0xLGM9Mjc3Nyx0PTIwMjEwNTA3LjA3NDc~
.workingadvantage.com/ Name: __rslct
Value: rw%2Csb
.workingadvantage.com/ Name: __rpckx
Value: 0!eyJ0NyI6eyIxIjoxNjM0MDU2NDM1MjUzfSwidDd2Ijp7IjEiOjE2MzQwNTY0MzUyNTN9LCJpdGltZSI6IjIwMjExMDEyLjE2MzMifQ~~
.workingadvantage.com/ Name: __rpck
Value: 0!eyJwcm8iOiJkaXJlY3QiLCJidCI6eyIwIjp0cnVlLCIxIjowLCIyIjpudWxsLCIzIjoxfSwiQyI6e30sIk4iOnt9fQ~~
.workingadvantage.com/ Name: mf_user
Value: 5aa0262bc22514c139a8e7a7699b58cb|
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNjU0MTI2NjM3tDAxNze3MLE0NBDiM9SNNwrUtQjVTUt284yU4jU0MzYxMDUzMTY1NjECAFwxOw00AAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNjU0MTI2NjM3tDAxNze3MLE0NBDiM9SNNwrUtQjVTUt284wEADE8CRQlAAAA
.adnxs.com/ Name: uuid2
Value: 2391767138253318588
.workingadvantage.com/ Name: __cf_bm
Value: U4h6qVXEELXq_iaBxwxoERS1Te13O3YxBlVTA7UkLcQ-1634056435-0-AV1BkHnHhn4CfnTGuURLP0/9KZTpTaevFSR2pB+cgp4yTx0oKgR9MGORlLhZQ3bpxE9i8D6cnzU5jJgUaK2ALapKWr2wMNK3++hxQLys3PUPA9PwRHNy2b0rcR7IPWNmyLgc5hcWRJgmSgIW1jU+O097yQrx8nTqaboQoiAyZMQu
.adnxs.com/ Name: anj
Value: dTM7k!M4/8CxrEQF']wIg2In>sd1aB!]tbP6j2F-XstGt!@DhL$nK`d
com-workadv.netmng.com/ Name: evo5_WORKINGADVANTAGE
Value: bmky98yq7hrus%7CO%7CS3pkbFlqTXJXVkZrTVhwcU9FbzNhRVZZY0ZWUmRXMWpiMU5sZVhSbGRXbGxhR3QwTVVKa2JFRnZlVEZDVG5wWk9FeDFaVTFMYzJWbFowUmpZbXBuTTBzMFVGaGpRa1JhZDFGT1VHbFJSRlpaU1RBMVdtNVpPR3hZZFRrNVp6RlJZMDRyT1VGUmNHSXlPRkJSYjBGU2NVMU9OSGM1VUVKc1RGQkVRbll4TVUxc2FTOVJkME12VWxkbGRrazVNRmRLVG5CcmJrOU9PSFJRYm5WblZHZ3hWREpDZEdSemVGSkxaVVZWYURKRGR6TXZiR2hZTnpOUWRVOTZjblZ4YkVOTDpIejRwUHRlMWRmOG1wRTFqbnpPTUp3PT0%3D
live.rezync.com/ Name: sd-session-id
Value: .eJwVykELgjAYgOG_Et_Zwza1mdDRRpCTZBHzIlYD55yFmwSK_z07vbzwLFB_1GibQQ0eUj9OKoBnr7dzkC7g9GyVgRRiHJEw3FOcRJTSJDpgBGsATjmn30OtX3-9e2ySs5PJBe-kzXzOMiQ1QlK0-iJaUzDpq_sZV7bsJSkNZ7e46DKSz9cvFxJtnQphjrCuP6AaMLw.FEdKcw.af_4KJsNzbgexT9aE-gBwacFDzE
.workingadvantage.com/ Name: _bti
Value: %7B%22app_id%22%3A%22ebg-wa%22%2C%22bsin%22%3A%226Fg3wQfmsdVG2d%2Bds7V47mvXc7ywb3YbweAi3qORb8dY3ZMG7y8RT6F4W4pOm7hL3mXxER4%2BVDADuuRJQ28JWw%3D%3D%22%7D
.casalemedia.com/ Name: CMID
Value: YWW48y-owisTYMUiOmBxmgAA
.casalemedia.com/ Name: CMPS
Value: 3218
.spotxchange.com/ Name: audience
Value: 317b4dfb-2b7a-11ec-b27f-1ee5b9e10106
.rlcdn.com/ Name: rlas3
Value: iJNXXxglXu3fgq5I1vgkLonn+ha+ZOMjLDO5uduurJk=
.media.net/ Name: visitor-id
Value: 2770580359242025000V10
.media.net/ Name: data-rk
Value: 5142336718477784910~~3
.media.net/ Name: gdpr_status
Value: 1
.casalemedia.com/ Name: CMPRO
Value: 1105
.casalemedia.com/ Name: CMRUM3
Value: 396165b8f327605142336718477784910
.casalemedia.com/ Name: CMST
Value: YWW482FluPMA
.bidswitch.net/ Name: tuuid
Value: ab7f3ac5-eeb6-41b7-954d-5950cd1222c2
.bidswitch.net/ Name: c
Value: 1634056435
.bidswitch.net/ Name: tuuid_lu
Value: 1634056435
.quantserve.com/ Name: mc
Value: 6165b8f3-d7ea3-b35d8-3726e
.eyeota.net/ Name: mako_uid
Value: 17c755a78ae-46920000010f5f9e
.eyeota.net/ Name: SERVERID
Value: 24478~DM
.workingadvantage.com/ Name: __qca
Value: P0-1844199152-1634056435871
.rlcdn.com/ Name: pxrc
Value: CPPxlosGEgYIuuoBEAA=
.krxd.net/ Name: _kuid_
Value: OarG3O4H
.rfihub.com/ Name: smd
Value: H4sIAAAAAAAAADPiNTQzNjEwNTMxNrU0MgMAx1Yjag8AAAA
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAAFPiVIl38o4PDfV0yeI1NDM2MTA1MzE2tTQxmcWIxDc2N1mFxj-Fxn-Fxv-Fxp_EhMqfhcZfhMZfhcbfhMbfha6eBZV_C42_iRVNPzeae9H4k4SNTBJTDI2TkxJ1DRJNknRNEi2SdC1SLNJ0U5NM01JSk1NSTFItreCaTPQsLWcJIxlibmmxSBjV0EdofACMdQ5UfwEAAA
.rfihub.com/ Name: euds
Value: H4sIAAAAAAAAAFPiVIl38o4PDfV0aWIxMklMMTROTkrUNUg0SdI1SbRI0rVIsUjTTU0yTUtJTU5JMUm1tDI0MzYxMDUzMTbRs7QEAOqeV9hAAAAA
.workingadvantage.com/ Name: s_ptc
Value: 1.72%5E%5E0.00%5E%5E0.00%5E%5E0.00%5E%5E0.38%5E%5E0.15%5E%5E1.60%5E%5E0.00%5E%5E3.71
www.workingadvantage.com/ Name: QSI_HistorySession
Value: https%3A%2F%2Fwww.workingadvantage.com%2Faccount.php%3Futm_campaign%3Dlas-vegas%26utm_medium%3DOctober-4-2021-Hotels%26utm_source%3DEmail%26sub%3Denroll~1634056436431
.workingadvantage.com/ Name: mf_913a7fd6-dc0a-49da-96d8-8f73cb55b75c
Value: 1675ed90a245adc918914ced52fbfc6a|1012547168f21021628e2aac9f5dccaff0e8adc7.6931915432.1634056435351|1634056434971|2071166924_67066748.1889642278_-823469111.-64687999_1430747|0|||0|17.51|3.25804
.steelhousemedia.com/ Name: guid
Value: 32d9c6d8-2b7a-11ec-b7e9-f9f09d1ca0f8
.px.steelhousemedia.com/ Name: tt
Value: H4sIAAAAAAAAAKtW8guKNzI2MDCNN7IwtlCyMtBRQuYamhmbGJiamRhbGpka6SiVKVkBSYQWc0tjoJZaAPG9kmpGAAAA
.steelhousemedia.com/ Name: rt
Value: "MjMwMDU6MTYzNDA1NjQzOQ=="
.adsrvr.org/ Name: TDID
Value: 04d7bca9-6a52-4353-be00-36bc94ac014e
.adsrvr.org/ Name: TDCPM
Value: CAEYBSABKAIyCwiq5vuumuqGOhAFOAE.

1 Console Messages

Source Level URL
Text
other warning URL: https://cdnapisec.kaltura.com/p/1093992/sp/109399200/embedIframeJs/uiconf_id/23289491/partner_id/1093992?ebgcbv=98(Line 30)
Message:
Allow attribute will take precedence over 'allowfullscreen'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; media-src * blob:; style-src * 'unsafe-inline';
Strict-Transport-Security max-age=5184000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20835101p.rfihub.com
409-bcn-480.mktoresp.com
6479484.fls.doubleclick.net
9767737.fls.doubleclick.net
a.rfihub.com
aa.agkn.com
adservice.google.com
alweb.rfk.workingadvantage.com
analytics.kaltura.com
assets.adobedtm.com
bam-cell.nr-data.net
beacon.krxd.net
bpi.rtactivate.com
bs.serving-sys.com
c1.rfihub.net
cdn.boomtrain.com
cdn.mouseflow.com
cdnapisec.kaltura.com
cfvod.kaltura.com
cm.everesttech.net
cm.g.doubleclick.net
com-workadv.netmng.com
contextual.media.net
d26opx5dl8t69i.cloudfront.net
dpm.demdex.net
dsum-sec.casalemedia.com
dx.steelhousemedia.com
e.email.workingadvantage.com
ebgcc.brightpattern.com
entertainmentbenefitsgroupllc.demdex.net
events.api.boomtrain.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
idsync.rlcdn.com
initjs.rfk.workingadvantage.com
insight.adsrvr.org
js-agent.newrelic.com
live.rezync.com
match.adsrvr.org
munchkin.marketo.net
n2.mouseflow.com
p.rfihub.com
partners.tremorhub.com
people.api.boomtrain.com
pixel.quantserve.com
pixel.rubiconproject.com
ps.eyeota.net
px.steelhousemedia.com
rules.quantcount.com
seal.godaddy.com
secure.adnxs.com
secure.quantserve.com
siteintercept.qualtrics.com
smetrics.workingadvantage.com
stags.bluekai.com
starget.workingadvantage.com
stats.g.doubleclick.net
stats.kaltura.com
sync-tm.everesttech.net
sync.search.spotxchange.com
ww.steelhousemedia.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.workingadvantage.com
x.bidswitch.net
x.dlx.addthis.com
zn5bxs0kfcxmozrm9-ebg.siteintercept.qualtrics.com
104.111.215.191
104.111.225.94
104.111.234.67
104.17.208.240
104.17.209.240
104.18.21.78
108.177.15.155
142.250.181.226
142.250.184.196
142.250.184.227
142.250.185.162
142.250.185.166
142.250.185.194
142.250.185.72
142.250.186.106
142.250.186.46
15.188.95.229
151.101.194.49
151.101.2.137
162.247.243.146
172.217.18.98
172.217.18.99
173.201.201.4
18.169.90.17
18.200.233.208
18.203.190.43
18.66.140.77
18.66.242.229
18.66.248.13
18.66.248.33
18.66.248.60
18.66.97.36
185.94.180.125
192.28.147.68
193.0.160.128
199.101.26.126
199.38.167.35
2.21.140.74
2.21.141.223
2.21.141.232
207.244.84.210
23.111.9.38
3.122.214.165
3.127.209.187
34.195.31.102
35.165.115.120
35.244.174.68
37.252.172.37
37.252.172.38
44.225.29.129
44.238.130.186
52.19.133.118
52.200.156.204
52.206.168.194
52.48.145.41
52.48.23.163
52.54.221.90
54.194.191.134
54.236.154.122
54.69.84.146
54.88.197.125
54.93.158.246
69.173.144.165
76.223.111.131
91.228.74.189
96.47.20.26
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429
02e1c4508320ee6bc6b884c4de9a0d73e541b6735fa139cbd957a27f42c72140
06708edc30f6877320af98a385a4350ad9769c1aca9d44f8a262acf0c6dfefbd
0c24d44bd1ca3b135fb6d91227588ff1ac7932b91886d4e751deefd2e681f940
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
12a707e11e2dc4d9b49d1a98cf484363b1549a6914a387a9c96d27679d285849
1449346947ba3d2266f702cc5488e1a0fb75ef67cdb105d5dbe178eff0af14b2
176bfb0e73f4480f870fdf93e5f45624e7fc171b7d4adbc10d6475a382efd604
1d24d4a11bd569cd44e25a8c36341f9669fa448d55bbad6c993ac3362e852711
1eae87c50589775a5471dcc9fee06fb6d545e5c758f5fbb6ab1d97fcd846c76e
1f7d6357a349f9b2e41547131f5dd5d1098529d07473a2b59220201c1602c8aa
250f1e045c9be2031eefd4d3ad369cf83421dd6eb38a5dab9c4e3075d449b69b
2547640cd989b80083eb3ade2a4993c1776a1229cfffd41adeb0fef3e86eaf2b
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2731279a7d1a73e9f9337cb97c35568e9a86ccb378050fbaa06824b991642bd6
277cf807f42eed8f60976814590e4497436f31da773d951527e694cf3ae2e695
2b4c3f4c48f128e247706a610fd46ac8164ca7bed2a6d6e3b0564b253348ed5f
2bbb691c9eaa2a9163d4da42af10729b164e0758678eab87344fe06915890dd7
2d452ca7bf499867307ebfa48373084a42e1f56ec0a26e5bb2e12f01888c3cc9
2eec22fcd09b2b38293ffa6f773ffbe507618a06c2f422c077ae565b15f9e6a5
2fac708a58ff36525a595affd83b9d385c1f261a4c279166864f99bf453e67bd
2fb74ff7bf2ea2be57773603e160779a154f835debb53d9edc93221b5eca47c4
31364854b8b38cfa23c163773331d62f9658a3431e768636dd7da1c00d325bfa
3280fddc77938fefe1459e296dc764a9d4992e5bdb88e44ee97bf5fc6263f5d7
33aff076a0cc91f96dd5ead2aed0ba9be83f5638155a8c0e7794c685f6bddf8c
33cb692469df42cfecaf7569e66269c79f04411746fa5a2ea33fe0ae8f001bfa
3ff90e45faf4f1517337648274a38902d62cb6e0ee6dc5961a41383d348608fa
40073d8997c3dd31bc10edfd8601660cad988a7601170e17b19f4331eaf5c6e9
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4471d3760ad27b466ca99f4e9ac126ee8d9eb24d7d9989561b12e40ca118dcf0
448e99a570408c6cf2eda6133ec9ea7b86b8494120fc2ab35f7fbab75fefa5e8
461f8bdb1fc92eff81d447bdcaaf81910be0875ed1eda757822aaa20a5e8198f
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bcb0f820377a5dc80f3f43d991c950d5442ad601328305c0b52785c984bce48
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4
58f60bb9964c615bbb12602b6563c6d459dbd15ea6787c455293375842774784
5c16626c2d303648ca08a0c058cf0049eca5c1449f4b25995386032b5dd82880
6134f8469fa5e47ec82d8676bb730a48e5257ba7ab63c216caa8446eb899a8ce
627e571d76a1633f6ac725b3d619d3ca2add0737c75fe167db775a237e40b1f2
62f8fb423450f9330d747f2c7c361193eae6e0944178cf38b8935b31613df85c
65b71746ce7505960de7d4f1f3f67ea8b444662dd248623373a3d076e7f814b6
668aeb0f18d6cfd195670546ba5cc3d33de3fc6abfa5fc11364901fe2a6ad468
67658c5e6d5c6330ae519306d8a2911554c6f5b0286f754b4d49d3890e2e7ee3
6b948c8eeaf6d655462a6ee94b49c8f71364bee54be38d05839a98156aed11a5
6ba84c5184c13f11bdafdd5e4a6b7f1799dee6458e527b2bf41a33df40a34c70
6dcf743efbf47f310fd9243d9aa78f4c3f6ee8ea260ad2f3d17a4fdda2479ab7
71fefd9910d55cc985b4e37b50099474f5632a041e405bdcb09cebaa9a35fa68
731ee3bbaa9f2fd92879f9087c9fbbf7438d3a52595c6c8a8020bb2a69b7afd6
74c7b6645b4356f3320822f0688c472041604920f2a66875b6efcb0b32e0c329
76db825b68979b9ea6cc55fa14373b7bf5e3beb7388cd2efa485938bb2a389fb
791fd110609c55ba57308b2b152520619e48cda3ef61de34ba7b4ed7b4d87b98
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c8b033cc69116a4670f6828ace15adda22d4d3ed1bb17e31daea73abbdfbede
7d4243c8e973ec0cfc707904891ae4e3efc03dbc8923acb9755f9a35c92269a6
7e86ebaabaa7bfc75d8972d7446fd9cd23b28f5891fbfa0839ae6d1701af0e08
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
7fdb1023cba50ed2dd86e2133c66c0444c2e082167e368a7bf68e95c465fd70c
83a921154ba4d9cbb1666930210a10ea9757a344dd7774385ffa5af2ff2aabd4
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e170827cf6b2dfdb810cef652d70f9cbd9ff58f4242cb735622833b5ff69bd3
962f868106ea626a1e0a64e7269fc0a017a46e8fbf995a9580caed4e29f58520
9668b1f443dc5794cfbf60e458f51c62ec2f067fa34d7c49d4e5c43905b08826
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1
9c6ff2453e82bbbe81b215b46fa26be3e4b0265fa18f28f44908504f4abe4123
9cd60e08308ac0d8d91d3cc2b6c4162607c6217b9e350e01854fbdbb70164747
9dca999e9382d3b62d34c995637a84d71c8e732e2e78fb38c7a0eeaa6ff401b2
9f9c44faecc50e0a4481d95801cf059a5b05d0ea70a096b204b9550ec9ce347a
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0fd47cbb9eb97c56ea50c860db6359d34448da5bbeb28fedad3e81d03cd39a5
a176b44662d7eb55562527b7df840e6eb620d9f326989674a16f0765dc94f360
a1bc6c9e5651486220976007f7b0003ddb7995cc56e8dfb429a380c6a4f0b339
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a4071d8dd8df954a09136ddea2d3ee4fb20514e64f34afd206c9da33b5bb7250
a41cd53ee007f390f168f20d2a90e282e9632e6dd2ce1148c40d8b44a9bc076f
a44b5727bd453959ba8f2ae37fd2359272b730ada09e80fb2a5bbffd086ef075
a52353c2f4c441c1f50d634fcf160da6abaa62f36ad3a90e6e457b367479a0dc
a573a5c7e757fc9ff9bb66611d63178290d28423fa744badb37f71459e8910bb
a777550d5a9b973b62c267838163cea553c9891bc8a0774a5c4a9d3b03d805b6
a84e13a27c084cf2a04356271d26546bf528ae766513d59cdf7afcfa72a72b8f
a8ddfb56b3b9f5666bd993cd373085e7823fbf65b02c18fae3268088e3e4a1cf
ac4f769636f28738dd7ceaf1ef01c558d9afb13c6f835c19456545ab7e26cda6
ae2fc8f8e0697701399521441a03445a3c11d79719accd0099f41687c1536c49
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1adacbdcd9a1302ebf82abb4695066528a693b75d7f75a110f1834b18c94cec
bb009653a5189ce35dfdf27f5e1673d61141fe7ab60676a23f894bbde8faa950
bed9883e3afc4f01beb8391653527dc2d5c8cfb3b1869dceebb7334142158fbf
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
c3c681a83aa4ab7a79e1b747baad02372b9182c4c28c8227f74a713ab1e48921
c7d1acf17b186d7f2d346e5eec2ea702d0e22673b74f622c8386e81c4873f9a2
c93c4bd92a045a3b0286dbf2479915dad14ef11b9a586d9b0fa38e72d443e5c0
c942d9ddbaf0a866c828a904b734915c84ec8b1137b04a698325500b40a2f238
c9c1d54cd634cba994b1fc6060948e0b843354b01aefd178a51dc9c91ce1a8c1
ce90b8602f4c03d98edd426e4f219012297257690a293fefdc4f7224890701f0
d1c4aa4fc27ca65d42b693b60f19546c4a50c002394c364dbbef45710858df7a
d3f8be3530b8336ab6c452acd55303585f6a08ae81713dff88b231ffc89c17ee
d562166d55f4a91e0051cbaf6f164730b7f3b11f01d1560607c7740eabc067a0
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
de451150b977bde62d4f17739f9969b72fa6ef56bdb6ec135798b772bf2e6a86
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e109fdbb766821b34282c79e213de1f82679891b4c693b50bbdf2de097dbdbfa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e27006ed29a6f6eb25ecda4d4b02edd01cb89079333f47a7c527761a5bf664
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5ae9b316fcbb2ed2bfb7c729e4a18906ce1ae86281d61442ff8f510a55ac91c
e9228e9660ad4173083cb4d622c22d33c09a1e5a99967a8c5dae1ffcc9259782
eb6ea27172834f43d0f4b39a47baaa91dd4533ee06288767616c3819d455f385
eb90498ac805d7551af4b858423bcff08c87b99caad9320a4b27e7a1b664feb1
ebb8b0b73ecae21b1840d76dbf4f67f96ac8e821d437166e74400227766ae75d
ed953262370c9dd1f14474cc6d4c24d6f7ef4a2327f419acb656a02ee26b1ea6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efeb8735a2b346afbd6ce49309ec76edc93a180260fd440f3a2ac5c72fb23417
f07a8bec2143aba541175e64caca4da75c723e53f09fa39854d47631bb9453b5
f2f94807597fa1cb903f7e33ba6fe0f09522edc921465a1cc952ed4176403a80
f2fc57ad9df7f41e38a595be72e9dc191a9b8d63ed07fec8c6a7ca326527ded9
f3869c89358078d2880fe007bb19b723665863a50dd2ff2102948c9243489c2d
f45c73c0747a0f7b5e5eec6fbc6250a562a0a009b04012eaf80aa52d4e51a55a
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f5e9f8af2b56cdc55e6b99815370665abf86efe4882c1ae9ca3a95bbf61bbbfa
f69ebbd9d36211cef558cb24f539fb4c6ad866dc603cdc8f588ee3f63dbe3b5d
f736e25921404b6af52d9d645965a6f88db506d6dda0d96125f79a1f46aba2bc
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3
fe56b80ead65e2a7d73f02da98bfd21557555823ac2da75aae27e3966a8429df