apply.freedomfinancialnet.com Open in urlscan Pro
34.134.212.62 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://beatracks.com/qs=r-addidaebeiegkcgaffejhcfakdhbjkdafcgihabababagbadfhaccackfiaciigacbcihbacb
Effective URL:
https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=6...
Submission: On July 14 via manual (July 14th 2022, 4:59:02 pm UTC) from US — Scanned from US

Summary HTTP 160 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 61 IPs in 9 countries across 68 domains to perform 160 HTTP transactions. The main IP is 34.134.212.62, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is apply.freedomfinancialnet.com.
TLS certificate: Issued by R3 on June 29th 2022. Valid for: 3 months.

This is the only time apply.freedomfinancialnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	193.151.90.231 193.151.90.231	29066 (VELIANET-...) (VELIANET-AS velia.net Internetdienste GmbH)
2	23.250.1.134 23.250.1.134	55286 (SERVER-MANIA) (SERVER-MANIA)
5	2607:f8b0:400... 2607:f8b0:4006:821::2008	15169 (GOOGLE) (GOOGLE)
1	13.225.214.129 13.225.214.129	16509 (AMAZON-02) (AMAZON-02)
2	34.207.39.23 34.207.39.23	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700::68... 2606:4700::6812:1e97	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	34.192.2.145 34.192.2.145	14618 (AMAZON-AES) (AMAZON-AES)
1 1	3.212.2.215 3.212.2.215	14618 (AMAZON-AES) (AMAZON-AES)
21	34.134.212.62 34.134.212.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2607:f8b0:400... 2607:f8b0:4006:81e::200a	15169 (GOOGLE) (GOOGLE)
5	2600:9000:210... 2600:9000:210b:5a00:12:94b3:c380:93a1	16509 (AMAZON-02) (AMAZON-02)
13	23.208.216.220 23.208.216.220	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2607:f8b0:400... 2607:f8b0:4006:807::2003	15169 (GOOGLE) (GOOGLE)
1	13.225.63.88 13.225.63.88	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2 5	3.230.219.164 3.230.219.164	14618 (AMAZON-AES) (AMAZON-AES)
3	2600:9000:21d... 2600:9000:21dd:e000:1c:7f1a:6680:93a1	16509 (AMAZON-02) (AMAZON-02)
6	151.101.129.44 151.101.129.44	54113 (FASTLY) (FASTLY)
1	2600:9000:210... 2600:9000:210b:f800:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
3 20	185.167.164.42 185.167.164.42	198622 (ADFORM) (ADFORM)
1	185.167.164.47 185.167.164.47	198622 (ADFORM) (ADFORM)
7	23.49.248.16 23.49.248.16	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	54.230.163.70 54.230.163.70	16509 (AMAZON-02) (AMAZON-02)
1	13.226.39.20 13.226.39.20	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	142.251.40.162 142.251.40.162	15169 (GOOGLE) (GOOGLE)
1 1	2600:1f18:730... 2600:1f18:730:b110:af35:be39:7aa6:3548	14618 (AMAZON-AES) (AMAZON-AES)
1	52.22.224.209 52.22.224.209	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42::300 2a04:4e42::300	54113 (FASTLY) (FASTLY)
5 11	2607:f8b0:400... 2607:f8b0:4006:81e::2002	15169 (GOOGLE) (GOOGLE)
12	2607:f8b0:400... 2607:f8b0:4006:81e::2004	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:809::200e	15169 (GOOGLE) (GOOGLE)
1	141.226.224.32 141.226.224.32	200478 (TABOOLA-AS) (TABOOLA-AS)
1	2607:f8b0:400... 2607:f8b0:4004:c09::9b	15169 (GOOGLE) (GOOGLE)
2 3	52.204.250.135 52.204.250.135	14618 (AMAZON-AES) (AMAZON-AES)
1	23.217.46.28 23.217.46.28	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	18.157.91.41 18.157.91.41	16509 (AMAZON-02) (AMAZON-02)
1 1	199.187.193.185 199.187.193.185	47043 (SMARTADSE...) (SMARTADSERVER)
1 2	3.218.90.66 3.218.90.66	14618 (AMAZON-AES) (AMAZON-AES)
1	63.251.28.219 63.251.28.219	13789 (INTERNAP-...) (INTERNAP-BLK3)
2 2	35.211.178.172 35.211.178.172	15169 (GOOGLE) (GOOGLE)
2	54.234.88.163 54.234.88.163	14618 (AMAZON-AES) (AMAZON-AES)
1 3	104.18.18.126 104.18.18.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	50.57.31.206 50.57.31.206	19994 (RACKSPACE) (RACKSPACE)
1 2	18.214.54.215 18.214.54.215	14618 (AMAZON-AES) (AMAZON-AES)
1	34.229.3.43 34.229.3.43	14618 (AMAZON-AES) (AMAZON-AES)
2 2	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
2 3	107.178.254.65 107.178.254.65	15169 (GOOGLE) (GOOGLE)
3 3	142.250.65.162 142.250.65.162	15169 (GOOGLE) (GOOGLE)
1 1	52.20.189.152 52.20.189.152	14618 (AMAZON-AES) (AMAZON-AES)
2 3	34.196.96.235 34.196.96.235	14618 (AMAZON-AES) (AMAZON-AES)
2	184.50.205.90 184.50.205.90	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1 1	52.17.154.165 52.17.154.165	16509 (AMAZON-02) (AMAZON-02)
1	52.218.112.139 52.218.112.139	16509 (AMAZON-02) (AMAZON-02)
2 2	141.94.171.215 141.94.171.215	16276 (OVH) (OVH)
3 4	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1	75.101.130.249 75.101.130.249	14618 (AMAZON-AES) (AMAZON-AES)
2 3	68.67.178.15 68.67.178.15	29990 (ASN-APPNEX) (ASN-APPNEX)
1	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	13.225.214.93 13.225.214.93	16509 (AMAZON-02) (AMAZON-02)
2 3	54.81.7.162 54.81.7.162	14618 (AMAZON-AES) (AMAZON-AES)
2 2	54.81.154.5 54.81.154.5	14618 (AMAZON-AES) (AMAZON-AES)
1 1	13.225.63.112 13.225.63.112	16509 (AMAZON-02) (AMAZON-02)
1 1	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1 1	23.195.108.221 23.195.108.221	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	18.194.91.60 18.194.91.60	16509 (AMAZON-02) (AMAZON-02)
1 1	64.58.232.176 64.58.232.176	13649 (ASN-VINS) (ASN-VINS)
1	64.58.232.177 64.58.232.177	13649 (ASN-VINS) (ASN-VINS)
3 4	141.95.98.65 141.95.98.65	16276 (OVH) (OVH)
1 1	68.67.160.75 68.67.160.75	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	35.190.24.218 35.190.24.218	15169 (GOOGLE) (GOOGLE)
1	23.200.173.61 23.200.173.61	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	95.216.101.186 95.216.101.186	24940 (HETZNER-AS) (HETZNER-AS)
2 2	2600:9000:21d... 2600:9000:21da:1c00:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
3 3	107.178.246.49 107.178.246.49	15169 (GOOGLE) (GOOGLE)
1	46.19.11.36 46.19.11.36	51790 (SIEL) (SIEL)
1	52.200.119.241 52.200.119.241	14618 (AMAZON-AES) (AMAZON-AES)
1 2	52.223.22.214 52.223.22.214	16509 (AMAZON-02) (AMAZON-02)
1	141.226.224.48 141.226.224.48	200478 (TABOOLA-AS) (TABOOLA-AS)
160	61

1 193.151.90.231 (Frankfurt am Main, Germany) 1 redirects

ASN29066 (VELIANET-AS velia.net Internetdienste GmbH, DE)
PTR: fliptrek.com

beatracks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.250.1.134 (Buffalo, United States)

ASN55286 (SERVER-MANIA, CA)

bayareaace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:821::2008 (New York, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.214.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-129.ewr50.r.cloudfront.net

static.traversedlp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.207.39.23 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-207-39-23.compute-1.amazonaws.com

script.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1e97 (United States)

ASN13335 (CLOUDFLARENET, US)

signals.aimtell.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.192.2.145 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-192-2-145.compute-1.amazonaws.com

api.traversedlp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.212.2.215 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-2-215.compute-1.amazonaws.com

ifatrk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 34.134.212.62 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.212.134.34.bc.googleusercontent.com

apply.freedomfinancialnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::200a (New York, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:210b:5a00:12:94b3:c380:93a1 (United States)

ASN16509 (AMAZON-02, US)

images.ctfassets.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 23.208.216.220 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-208-216-220.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:807::2003 (New York, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.63.88 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-88.ewr53.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.230.219.164 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-230-219-164.compute-1.amazonaws.com

api.trustedform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:21dd:e000:1c:7f1a:6680:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.trustedform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.129.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:210b:f800:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 185.167.164.42 (Denmark) 3 redirects

ASN198622 (ADFORM, DK)

a1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a1.seadform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmp.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.167.164.47 (Denmark)

ASN198622 (ADFORM, DK)

s2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.49.248.16 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-49-248-16.deploy.static.akamaitechnologies.com

analytics.tiktok.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.230.163.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-163-70.ewr53.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.39.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-39-20.ewr53.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.162 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b110:af35:be39:7aa6:3548 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.22.224.209 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-224-209.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::300 (United States)

ASN54113 (FASTLY, US)

pips.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2607:f8b0:4006:81e::2002 (New York, United States) 5 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2607:f8b0:4006:81e::2004 (New York, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:809::200e (New York, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.224.32 (United States)

ASN200478 (TABOOLA-AS, IL)

cds.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::9b (Ashburn, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.204.250.135 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-250-135.compute-1.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ice.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.217.46.28 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-217-46-28.deploy.static.akamaitechnologies.com

ad.yieldlab.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.157.91.41 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-91-41.eu-central-1.compute.amazonaws.com

ih.adscale.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.187.193.185 (Canada) 1 redirects

ASN47043 (SMARTADSERVER, CA)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.218.90.66 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-218-90-66.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.251.28.219 (United States)

ASN13789 (INTERNAP-BLK3, US)

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.211.178.172 (North Charleston, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.234.88.163 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-234-88-163.compute-1.amazonaws.com

e1.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.18.126 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 50.57.31.206 (United States) 1 redirects

ASN19994 (RACKSPACE, US)

uipglob.semasio.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.214.54.215 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-214-54-215.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.229.3.43 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.60.146 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.178.254.65 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.65.162 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.20.189.152 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-189-152.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.196.96.235 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-96-235.compute-1.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.50.205.90 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-50-205-90.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.17.154.165 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-154-165.eu-west-1.compute.amazonaws.com

api.adrtx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.112.139 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1.amazonaws.com

s3-eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 141.94.171.215 (France) 2 redirects

ASN16276 (OVH, FR)
PTR: pikafka-eu-9.cloudy.ovh

pixel.onaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.33.220.150 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 75.101.130.249 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-75-101-130-249.compute-1.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.67.178.15 (Secaucus, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 633.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.214.93 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-93.ewr50.r.cloudfront.net

pdw-adf.userreport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.81.7.162 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-7-162.compute-1.amazonaws.com

a.audrte.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.81.154.5 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-154-5.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.63.112 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-112.ewr53.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Sankt Georgen im Schwarzwald, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.195.108.221 (Edison, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-195-108-221.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.194.91.60 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-91-60.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.58.232.176 (United States) 1 redirects

ASN13649 (ASN-VINS, US)

global.ib-ibi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.58.232.177 (United States)

ASN13649 (ASN-VINS, US)
PTR: be31-199.crrt01.las04.flexential.net

ib.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 141.95.98.65 (France) 3 redirects

ASN16276 (OVH, FR)
PTR: ns3216659.ip-141-95-98.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.160.75 (Brooklyn, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.24.218 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 218.24.190.35.bc.googleusercontent.com

redirect.frontend.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.173.61 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-200-173-61.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.216.101.186 (Helsinki, Finland) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.186.101.216.95.clients.your-server.de

sync.1dmp.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21da:1c00:1b:5138:8a40:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.178.246.49 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 49.246.178.107.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.19.11.36 (Slovenia)

ASN51790 (SIEL, SI)
PTR: ilog.vsn.si

match.contentexchange.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.200.119.241 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-200-119-241.compute-1.amazonaws.com

bpi.rtactivate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.22.214 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.224.48 (United States)

ASN200478 (TABOOLA-AS, IL)

trc-events.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	freedomfinancialnet.com apply.freedomfinancialnet.com	433 KB
20	adform.net 3 redirects a1.adform.net — Cisco Umbrella Rank: 15682 s2.adform.net — Cisco Umbrella Rank: 5824 c1.adform.net — Cisco Umbrella Rank: 651 dmp.adform.net — Cisco Umbrella Rank: 4474	41 KB
15	doubleclick.net 8 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 67 stats.g.doubleclick.net — Cisco Umbrella Rank: 138 cm.g.doubleclick.net — Cisco Umbrella Rank: 223	11 KB
13	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 941	53 KB
12	google.com www.google.com — Cisco Umbrella Rank: 17	2 KB
9	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 1049 trc.taboola.com — Cisco Umbrella Rank: 702 pips.taboola.com — Cisco Umbrella Rank: 1502 cds.taboola.com — Cisco Umbrella Rank: 1391 trc-events.taboola.com — Cisco Umbrella Rank: 1612	23 KB
8	trustedform.com 2 redirects api.trustedform.com — Cisco Umbrella Rank: 20680 cdn.trustedform.com — Cisco Umbrella Rank: 23030	45 KB
7	tiktok.com analytics.tiktok.com — Cisco Umbrella Rank: 1039	73 KB
5	ctfassets.net images.ctfassets.net — Cisco Umbrella Rank: 4000	10 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 101	219 KB
4	id5-sync.com 3 redirects id5-sync.com — Cisco Umbrella Rank: 593	5 KB
4	adnxs.com 3 redirects secure.adnxs.com — Cisco Umbrella Rank: 436 ib.adnxs.com — Cisco Umbrella Rank: 257	4 KB
4	adsrvr.org 3 redirects match.adsrvr.org — Cisco Umbrella Rank: 399	2 KB
4	traversedlp.com static.traversedlp.com — Cisco Umbrella Rank: 27289 api.traversedlp.com — Cisco Umbrella Rank: 8144	5 KB
3	tapad.com 3 redirects pixel.tapad.com — Cisco Umbrella Rank: 500	597 B
3	audrte.com 2 redirects a.audrte.com — Cisco Umbrella Rank: 2561	5 KB
3	crwdcntrl.net 2 redirects sync.crwdcntrl.net — Cisco Umbrella Rank: 798	1 KB
3	pippio.com 2 redirects pippio.com — Cisco Umbrella Rank: 894	778 B
3	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 597	3 KB
3	360yield.com 2 redirects ad.360yield.com — Cisco Umbrella Rank: 692 ice.360yield.com — Cisco Umbrella Rank: 1936	1 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 69	20 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 3802 rp.liadm.com — Cisco Umbrella Rank: 2631 rp4.liadm.com — Cisco Umbrella Rank: 9695	12 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 164	53 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 698 script.hotjar.com — Cisco Umbrella Rank: 1004 vars.hotjar.com — Cisco Umbrella Rank: 1019	67 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 448	720 B
2	smaato.net 2 redirects s.ad.smaato.net — Cisco Umbrella Rank: 681	1 KB
2	1dmp.io 1 redirects sync.1dmp.io — Cisco Umbrella Rank: 11915	809 B
2	weborama.fr 2 redirects redirect.frontend.weborama.fr — Cisco Umbrella Rank: 9928	529 B
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 893	1 KB
2	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 213	2 KB
2	onaudience.com 2 redirects pixel.onaudience.com — Cisco Umbrella Rank: 4025	972 B
2	openx.net 1 redirects eu-u.openx.net — Cisco Umbrella Rank: 2337	385 B
2	bluekai.com tags.bluekai.com — Cisco Umbrella Rank: 538	855 B
2	krxd.net 1 redirects usermatch.krxd.net — Cisco Umbrella Rank: 1355 beacon.krxd.net — Cisco Umbrella Rank: 504	493 B
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 365	490 B
2	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 1095	1 KB
2	semasio.net 1 redirects uipglob.semasio.net — Cisco Umbrella Rank: 1232	1 KB
2	emxdgt.com e1.emxdgt.com — Cisco Umbrella Rank: 1061	196 B
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 315	1 KB
2	yahoo.com 1 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 290	489 B
2	adscale.de 2 redirects ih.adscale.de — Cisco Umbrella Rank: 3689	696 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	503 B
2	gstatic.com fonts.gstatic.com	75 KB
2	anura.io script.anura.io — Cisco Umbrella Rank: 42904	19 KB
2	bayareaace.com bayareaace.com	7 KB
1	rtactivate.com bpi.rtactivate.com — Cisco Umbrella Rank: 2037	109 B
1	contentexchange.me match.contentexchange.me — Cisco Umbrella Rank: 19875	49 B
1	teads.tv sync.teads.tv — Cisco Umbrella Rank: 1086	287 B
1	mookie1.com ib.mookie1.com — Cisco Umbrella Rank: 2577	421 B
1	ib-ibi.com 1 redirects global.ib-ibi.com — Cisco Umbrella Rank: 1994	500 B
1	mathtag.com 1 redirects pixel.mathtag.com — Cisco Umbrella Rank: 1130	627 B
1	adition.com 1 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1776	456 B
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 492	647 B
1	userreport.com pdw-adf.userreport.com — Cisco Umbrella Rank: 17567	444 B
1	pubmatic.com simage2.pubmatic.com — Cisco Umbrella Rank: 664	449 B
1	amazonaws.com s3-eu-west-1.amazonaws.com	390 B
1	adrtx.net 1 redirects api.adrtx.net — Cisco Umbrella Rank: 21183	406 B
1	exelator.com loadm.exelator.com — Cisco Umbrella Rank: 1395	324 B
1	stickyadstv.com ads.stickyadstv.com — Cisco Umbrella Rank: 732	670 B
1	smartadserver.com 1 redirects rtb-csync.smartadserver.com — Cisco Umbrella Rank: 663	669 B
1	rubiconproject.com token.rubiconproject.com — Cisco Umbrella Rank: 787	656 B
1	yieldlab.net ad.yieldlab.net — Cisco Umbrella Rank: 3240	522 B
1	seadform.net a1.seadform.net — Cisco Umbrella Rank: 18231	336 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 134	15 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 81	1 KB
1	ifatrk.com 1 redirects ifatrk.com	976 B
1	aimtell.com signals.aimtell.com — Cisco Umbrella Rank: 5171	334 B
1	beatracks.com 1 redirects beatracks.com	425 B
160	68

	Domain	Requested by
21	apply.freedomfinancialnet.com	bayareaace.com apply.freedomfinancialnet.com
13	tags.tiqcdn.com	apply.freedomfinancialnet.com tags.tiqcdn.com
12	c1.adform.net	1 redirects a1.adform.net c1.adform.net
12	www.google.com	apply.freedomfinancialnet.com
11	googleads.g.doubleclick.net	5 redirects www.googleadservices.com
7	analytics.tiktok.com	tags.tiqcdn.com analytics.tiktok.com
5	api.trustedform.com	2 redirects api.trustedform.com cdn.trustedform.com
5	images.ctfassets.net	apply.freedomfinancialnet.com cdn.trustedform.com
5	www.googletagmanager.com	bayareaace.com tags.tiqcdn.com www.googletagmanager.com
4	id5-sync.com	3 redirects c1.adform.net
4	dmp.adform.net	c1.adform.net
4	match.adsrvr.org	3 redirects c1.adform.net
4	trc.taboola.com	cdn.taboola.com
3	pixel.tapad.com	3 redirects
3	a.audrte.com	2 redirects c1.adform.net
3	secure.adnxs.com	2 redirects c1.adform.net
3	sync.crwdcntrl.net	2 redirects c1.adform.net
3	cm.g.doubleclick.net	3 redirects
3	pippio.com	2 redirects c1.adform.net
3	dsum-sec.casalemedia.com	1 redirects c1.adform.net
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com apply.freedomfinancialnet.com
3	a1.adform.net	2 redirects apply.freedomfinancialnet.com
3	cdn.trustedform.com	apply.freedomfinancialnet.com api.trustedform.com
3	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
3	api.traversedlp.com	static.traversedlp.com
2	eb2.3lift.com	1 redirects c1.adform.net
2	s.ad.smaato.net	2 redirects
2	sync.1dmp.io	1 redirects c1.adform.net
2	redirect.frontend.weborama.fr	2 redirects
2	pm.w55c.net	2 redirects
2	dpm.demdex.net	2 redirects
2	pixel.onaudience.com	2 redirects
2	eu-u.openx.net	1 redirects c1.adform.net
2	tags.bluekai.com	c1.adform.net
2	idsync.rlcdn.com	2 redirects
2	ps.eyeota.net	1 redirects c1.adform.net
2	uipglob.semasio.net	1 redirects c1.adform.net
2	e1.emxdgt.com	c1.adform.net
2	x.bidswitch.net	2 redirects
2	ups.analytics.yahoo.com	1 redirects c1.adform.net
2	ih.adscale.de	2 redirects
2	ad.360yield.com	1 redirects c1.adform.net
2	www.facebook.com	apply.freedomfinancialnet.com
2	cdn.taboola.com	tags.tiqcdn.com cdn.taboola.com
2	fonts.gstatic.com	fonts.googleapis.com
2	script.anura.io	bayareaace.com script.anura.io
2	bayareaace.com	bayareaace.com
1	trc-events.taboola.com	cdn.taboola.com
1	bpi.rtactivate.com	c1.adform.net
1	match.contentexchange.me	c1.adform.net
1	sync.teads.tv	c1.adform.net
1	ice.360yield.com	1 redirects
1	ib.adnxs.com	1 redirects
1	ib.mookie1.com	c1.adform.net
1	global.ib-ibi.com	1 redirects
1	pixel.mathtag.com	1 redirects
1	dsp.adfarm1.adition.com	1 redirects
1	aa.agkn.com	1 redirects
1	pdw-adf.userreport.com	c1.adform.net
1	simage2.pubmatic.com	c1.adform.net
1	beacon.krxd.net	c1.adform.net
1	s3-eu-west-1.amazonaws.com	c1.adform.net
1	api.adrtx.net	1 redirects
1	usermatch.krxd.net	1 redirects
1	loadm.exelator.com	c1.adform.net
1	ads.stickyadstv.com	c1.adform.net
1	rtb-csync.smartadserver.com	1 redirects
1	token.rubiconproject.com	c1.adform.net
1	ad.yieldlab.net	c1.adform.net
1	stats.g.doubleclick.net	www.google-analytics.com
1	a1.seadform.net	apply.freedomfinancialnet.com
1	cds.taboola.com	cdn.taboola.com
1	pips.taboola.com	cdn.taboola.com
1	rp4.liadm.com	apply.freedomfinancialnet.com
1	rp.liadm.com	1 redirects
1	www.googleadservices.com	www.googletagmanager.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	s2.adform.net	apply.freedomfinancialnet.com
1	b-code.liadm.com	tags.tiqcdn.com
1	static.hotjar.com	tags.tiqcdn.com
1	fonts.googleapis.com	apply.freedomfinancialnet.com
1	ifatrk.com	1 redirects
1	signals.aimtell.com
1	static.traversedlp.com	www.googletagmanager.com
1	beatracks.com	1 redirects
160	86

This site contains links to these domains. Also see Links.

Domain
www.bills.com
freedomfinancialnet.com

Subject Issuer	Validity	Valid
*.google-analytics.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.traversedlp.com Amazon	`2022-01-27` - `2023-02-25`	a year	crt.sh
script.anura.io Amazon	`2022-05-24` - `2023-06-22`	a year	crt.sh
aimtell.com Cloudflare Inc ECC CA-3	`2022-05-09` - `2023-05-08`	a year	crt.sh
apply.freedomdebtrelief.com R3	`2022-06-29` - `2022-09-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
images.ctfassets.net Amazon	`2022-02-17` - `2023-03-18`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.hotjar.com Amazon	`2021-11-25` - `2022-12-23`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-04-22` - `2022-07-21`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-28` - `2022-12-29`	a year	crt.sh
*.liadm.com Amazon	`2022-01-31` - `2023-03-01`	a year	crt.sh
*.tiktok.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-12-13` - `2023-01-13`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
*.seadform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-11-04`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.yieldlab.net DigiCert SHA2 Secure Server CA	`2022-01-14` - `2023-01-13`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.ads.stickyadstv.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-19` - `2023-05-19`	a year	crt.sh
*.exelator.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-08` - `2023-06-10`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2022-02-26` - `2023-03-01`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-03` - `2022-11-02`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2021-08-04` - `2022-09-04`	a year	crt.sh
*.userreport.com Amazon	`2022-01-19` - `2023-02-17`	a year	crt.sh
teads.tv R3	`2022-06-01` - `2022-08-30`	3 months	crt.sh
*.contentexchange.me Sectigo RSA Domain Validation Secure Server CA	`2022-05-31` - `2023-06-04`	a year	crt.sh
rtactivate.com Amazon	`2022-04-13` - `2023-05-12`	a year	crt.sh
*.emxdgt.com Go Daddy Secure Certificate Authority - G2	`2022-05-18` - `2023-06-19`	a year	crt.sh
*.trustedform.com Amazon	`2021-10-12` - `2022-11-09`	a year	crt.sh
cdn.trustedform.com Amazon	`2022-04-14` - `2023-05-13`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
Frame ID: E4A732A4E6C9D2096DF44CA15577B265
Requests: 113 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-1ada912494ba7fc7aca15fcef1c2a7ae.html
Frame ID: DF848B2E33DC0001088DCA140A8FB582
Requests: 1 HTTP requests in this frame

Frame: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Frame ID: 64527F8B59EA0FBE0FB15631A57A67A0
Requests: 46 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Freedom Financial Network

Page URL History Show full URLs

http://beatracks.com/qs=r-addidaebeiegkcgaffejhcfakdhbjkdafcgihabababagbadfhaccackfiaciigacbcihbacb HTTP 302
http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915... Page URL
https://ifatrk.com/?a=4&c=1815&s1=203930&s2=62b17f83386680b6d3979191555710fd&s3=41576_9260892_11 HTTP 302
https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

160
Requests

74 %
HTTPS

20 %
IPv6

68
Domains

86
Subdomains

61
IPs

9
Countries

1202 kB
Transfer

3370 kB
Size

111
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bills.com/privacypolicy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.bills.com/company/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://freedomfinancialnet.com/ContactUs
Title: Contact Us

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://beatracks.com/qs=r-addidaebeiegkcgaffejhcfakdhbjkdafcgihabababagbadfhaccackfiaciigacbcihbacb HTTP 302
http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50 Page URL
https://ifatrk.com/?a=4&c=1815&s1=203930&s2=62b17f83386680b6d3979191555710fd&s3=41576_9260892_11 HTTP 302
https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://beatracks.com/qs=r-addidaebeiegkcgaffejhcfakdhbjkdafcgihabababagbadfhaccackfiaciigacbcihbacb HTTP 302
http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50

Request Chain 48

https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.6229365290807762 HTTP 301
https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.6229365290807762

Request Chain 55

https://a1.adform.net/serving/scripts/trackpoint/async/ HTTP 301
https://s2.adform.net/banners/scripts/st/trackpoint-async.js

Request Chain 69

https://rp.liadm.com/j?dtstmp=1657817939169&aid=a-05iv&se=e30&duid=e5e630066617--01g7ytcf2weac9zb1q4jnxj5dt&tna=v2.4.0&pu=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&wpn=lc-bundle&refr=http%3A%2F%2Fbayareaace.com%2F&c=PHRpdGxlPkZyZWVkb20gRmluYW5jaWFsIE5ldHdvcms8L3RpdGxlPg HTTP 302
https://rp4.liadm.com/j?dtstmp=1657817939169&aid=a-05iv&se=e30&duid=e5e630066617--01g7ytcf2weac9zb1q4jnxj5dt&tna=v2.4.0&pu=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&wpn=lc-bundle&refr=http%3A%2F%2Fbayareaace.com%2F&c=PHRpdGxlPkZyZWVkb20gRmluYW5jaWFsIE5ldHdvcms8L3RpdGxlPg&i6=MmEwZDo1NjAwOjI0OjE1MDA6MTAxMTpiMGU3OjJjN2E6MTUyNQ%3D%3D&n3pc=true

Request Chain 71

https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.5544284264352011 HTTP 301
https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.5544284264352011

Request Chain 84

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/?random=1657817939307&cv=9&fst=1657817939307&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939307&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=276162609&resp=GooglemKTybQhCsO

Request Chain 85

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/?random=1657817939308&cv=9&fst=1657817939308&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939308&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=3913137529&resp=GooglemKTybQhCsO

Request Chain 90

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/?random=1657817939369&cv=9&fst=1657817939369&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939369&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=4235477428&resp=GooglemKTybQhCsO

Request Chain 91

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/?random=1657817939370&cv=9&fst=1657817939370&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=2539113144&resp=GooglemKTybQhCsO

Request Chain 92

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/?random=1657817939370&cv=9&fst=1657817939370&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=1566478221&resp=GooglemKTybQhCsO

Request Chain 94

https://a1.adform.net/Serving/TrackPoint/?pm=2544792&ADFPageName=Campaign%20Index%20-%20Page%20Loaded&ADFdivider=%7C&ord=310446637221&Set1=en-US%7Cen-US%7C1600x1200%7C24&CPref=http%3A%2F%2Fbayareaace.com%2F&ADFtpmode=2&itm=eyJic3oiOjEsInN2MyI6ImFwcGx5LmZyZWVkb21maW5hbmNpYWxuZXQuY29tIiwic3Y0IjoiMDE4MWZkYTYzYjI2MDAxNDA1OTExZGE2NDE1MjAzMDczMDBmZDA2YjAwYjA4Iiwic3Y1IjoiMGU5ZWM5NzAtZDQxYi00NGY4LTk3MWQtMjkyNmEyOGRhYWE4Iiwic3Y2IjoiZThmMmZkNDMtMTE3Ny00OGYwLWJjZjQtM2JjMDg2ZTYwOTk1In0&loc=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffili HTTP 302
https://a1.adform.net/Serving/TrackPoint/?CC=1&pm=2544792&ADFPageName=Campaign%20Index%20-%20Page%20Loaded&ADFdivider=%7C&ord=310446637221&Set1=en-US%7Cen-US%7C1600x1200%7C24&CPref=http%3A%2F%2Fbayareaace.com%2F&ADFtpmode=2&itm=eyJic3oiOjEsInN2MyI6ImFwcGx5LmZyZWVkb21maW5hbmNpYWxuZXQuY29tIiwic3Y0IjoiMDE4MWZkYTYzYjI2MDAxNDA1OTExZGE2NDE1MjAzMDczMDBmZDA2YjAwYjA4Iiwic3Y1IjoiMGU5ZWM5NzAtZDQxYi00NGY4LTk3MWQtMjkyNmEyOGRhYWE4Iiwic3Y2IjoiZThmMmZkNDMtMTE3Ny00OGYwLWJjZjQtM2JjMDg2ZTYwOTk1In0&loc=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffili

Request Chain 108

https://ad.360yield.com/match?publisher_dsp_id=42&external_user_id=2594886636168415069&Expiration=1659027539 HTTP 302
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=2594886636168415069&Expiration=1659027539

Request Chain 111

https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=2594886636168415069&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__ HTTP 302
https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=2594886636168415069&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__&nut&uu=248d370c4fc54f609ef4ce69cff966d4 HTTP 307
https://c1.adform.net/serving/cookie/match?party=9&uid=f82e736565e5d356f0b3f8c817fa4ef916c0d8ded7646199b46cf9e57eba21c0

Request Chain 112

https://rtb-csync.smartadserver.com/redir/?partnerid=22&partneruserid=2594886636168415069&redirurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d10%26cid%3DSMART_USER_ID HTTP 302
https://c1.adform.net/serving/cookie/match?party=10&cid=4869644335841745454

Request Chain 113

https://ups.analytics.yahoo.com/ups/55944/sync?uid=2594886636168415069&_origin=1 HTTP 302
https://ups.analytics.yahoo.com/ups/55944/sync?uid=2594886636168415069&_origin=1&verify=true

Request Chain 115

https://x.bidswitch.net/sync?dsp_id=70&user_id=2594886636168415069 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=70&user_id=2594886636168415069 HTTP 302
https://e1.emxdgt.com/put?d=d21&uid=56fe4e91-9b13-4706-8c22-ec018dad3a34&gdpr=&gdpr_consent=

Request Chain 116

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=2594886636168415069&expiration=1659027539 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=2594886636168415069&expiration=1659027539&C=1

Request Chain 117

https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=2594886636168415069&sInitiator=external HTTP 302
https://uipglob.semasio.net/adform/1/info2?sType=sync&sExtCookieId=2594886636168415069&sInitiator=external

Request Chain 118

https://ps.eyeota.net/match?uid=2594886636168415069&bid=9gdtmu1 HTTP 302
https://ps.eyeota.net/match/bounce/?uid=2594886636168415069&bid=9gdtmu1

Request Chain 120

https://idsync.rlcdn.com/398366.gif?partner_uid=2594886636168415069 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CJ6oGBIeChoIARCUdRoTMjU5NDg4NjYzNjE2ODQxNTA2ORAAGg0I05bBlgYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=499e95a30926cd48fadce2a071c5cd575691fc1f8b7ecda0c9a757e557deb681791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0OTllOTVhMzA5MjZjZDQ4ZmFkY2UyYTA3MWM1Y2Q1NzU2OTFmYzFmOGI3ZWNkYTBjOWE3NTdlNTU3ZGViNjgxNzkxNDI2YjU0MTdkY2UyMRAAGgwI05bBlgYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0OTllOTVhMzA5MjZjZDQ4ZmFkY2UyYTA3MWM1Y2Q1NzU2OTFmYzFmOGI3ZWNkYTBjOWE3NTdlNTU3ZGViNjgxNzkxNDI2YjU0MTdkY2UyMRAAGgwI05bBlgYSBAgCEABCAEoA&google_gid=CAESEJzI5RKt-K05Ew3QpdaWn7s&google_cver=1 HTTP 307
https://usermatch.krxd.net/um/v2?partner=liveramp_identity HTTP 302
https://pippio.com/api/sync?pid=709973&it=1&iv=O9QEdpPR

Request Chain 121

https://sync.crwdcntrl.net/map/c=6466/tp=ADFM/tpid=2594886636168415069/gdpr=/gdpr_consent= HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=2594886636168415069/gdpr=/gdpr_consent=

Request Chain 123

https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2594886636168415069 HTTP 302
https://eu-u.openx.net/w/1.0/sd?cc=1&id=537113484&val=2594886636168415069

Request Chain 124

https://api.adrtx.net/thirdparty/click?p=adfo HTTP 302
https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif

Request Chain 125

https://pixel.onaudience.com/?mapped=2594886636168415069&partner=68 HTTP 302
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/tpid=a4e00959540e9c68/gdpr=1/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D HTTP 302
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=75d436046e8c595c16c89502e56ad4e1&gdpr=1 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=1

Request Chain 127

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_cm&google_ula=1641347&party=1&google_hm=MjU5NDg4NjYzNjE2ODQxNTA2OQ HTTP 302
https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKUPihO4y4a5MoMWI0bz6BI&google_cver=1&google_ula=1641347,0

Request Chain 128

https://secure.adnxs.com/getuid?https://c1.adform.net/serving/cookie/match?party=3&id=$UID&redirect=1 HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc1.adform.net%2Fserving%2Fcookie%2Fmatch%3Fparty%3D3%26id%3D%24UID%26redirect%3D1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=3&id=7910631169925372168&redirect=1 HTTP 302
https://secure.adnxs.com/setuid?entity=91&code=2594886636168415069

Request Chain 132

https://a.audrte.com/a?adform_uid=2594886636168415069 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent= HTTP 302
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=&google_gid=CAESEIghbXpCQCQxXwOVz2NXvRI&google_cver=1 HTTP 302
https://a.audrte.com/p

Request Chain 133

https://dpm.demdex.net/ibs:dpid=1586&dpuuid=2594886636168415069&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1586&dpuuid=2594886636168415069&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=1007&cid=37317337400621328102228328483156673726&noredirect=1

Request Chain 134

https://aa.agkn.com/adscores/g.pixel?sid=9212269628&_puid=2594886636168415069 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1014&cid=214630604212376966005

Request Chain 135

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1049%26cid%3D%25%25COOKIE%25%25 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7120273835025954970

Request Chain 137

https://pixel.mathtag.com/sync/img?redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1066%26cid%3D%5BMM_UUID%5D HTTP 302
https://c1.adform.net/serving/cookie/match?party=1066&cid=d3e962d0-4b54-4e00-86ed-bd619ac707ab

Request Chain 138

https://pm.w55c.net/ping_match.gif?st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_ HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_ HTTP 302
https://c1.adform.net/serving/cookie/match?party=1084&cid=Ap0zggMp1Oc2b25

Request Chain 139

https://match.adsrvr.org/track/cmf/generic?ttd_pid=71ei9rr&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=71ei9rr&ttd_tpi=1 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1144&tdid=8ac6358c-a5a0-43a8-86ba-de53b54f2217

Request Chain 140

https://global.ib-ibi.com/image.sbmx?go=302927&pid=567&xid=2594886636168415069 HTTP 302
https://ib.mookie1.com/image.sbmx?go=302927&pid=567&xid=2594886636168415069

Request Chain 141

https://id5-sync.com/s/10/0.gif?puid=2594886636168415069 HTTP 302
https://id5-sync.com/c/10/10/2/1.gif?puid=2594886636168415069&gdpr=0&gdpr_consent= HTTP 302
https://ib.adnxs.com/getuid?https://id5-sync.com/c/10/2/1/2.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/10/2/1/2.gif?puid=7910631169925372168&gdpr=0&gdpr_consent= HTTP 302
https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOCK2cOvOHgoldKuo-DES6rlbCfh-ngMJUtFRMNA&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F10%2F124%2F0%2F3.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/cq/10/124/0/3.gif?puid=e979b045-41f0-4aad-bf24-0bf29b802d98&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

Request Chain 142

https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D HTTP 302
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D&bounce=1&random=2227959668 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1145&cid=.CsVKEd1tRpiGc1bJvUcHu

Request Chain 144

https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=2594886636168415069 HTTP 302
https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=2594886636168415069&cs=1

Request Chain 145

https://s.ad.smaato.net/c/?dspInit=1001213&dspCookie=2594886636168415069 HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001213&dspCookie=2594886636168415069&cookieCheck=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=44&external_user_id=a1f6cd4

Request Chain 146

https://pixel.tapad.com/idsync/ex/receive?partner_id=2032&partner_device_id=2594886636168415069&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2032&partner_device_id=2594886636168415069&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=620bde0d-d4a7-4eba-b5d3-03221e96e891%252Chttps%253A%252F%252Fc1.adform.net%252Fserving%252Fcookie%252Fmatch%253Fparty%253D2007%2526cid%253D620bde0d-d4a7-4eba-b5d3-03221e96e891&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=8ac6358c-a5a0-43a8-86ba-de53b54f2217&ttd_puid=620bde0d-d4a7-4eba-b5d3-03221e96e891%2Chttps%3A%2F%2Fc1.adform.net%2Fserving%2Fcookie%2Fmatch%3Fparty%3D2007%26cid%3D620bde0d-d4a7-4eba-b5d3-03221e96e891 HTTP 302
https://c1.adform.net/serving/cookie/match?party=2007&cid=620bde0d-d4a7-4eba-b5d3-03221e96e891

Request Chain 149

https://eb2.3lift.com/xuid?mid=7354&xuid=2594886636168415069&dongle=AD20 HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7354&xuid=2594886636168415069&dongle=AD20&gdpr=0&cmp_cs=&us_privacy=

160 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/
Redirect Chain

http://beatracks.com/qs=r-addidaebeiegkcgaffejhcfakdhbjkdafcgihabababagbadfhaccackfiaciigacbcihbacb
http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50

6 KB
7 KB

446ms
416ms

Document
text/html

23.250.1.134
SERVER-MANIA

General

Check archive.org

Show headers Download Go to

Full URL: http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50
Protocol: HTTP/1.1
Server: 23.250.1.134 Buffalo, United States, ASN55286 (SERVER-MANIA, CA),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash: 1007a1c62fd395647b6216220f5ad2119d31aebfded4bc897940dda41f4430c3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Thu, 14 Jul 2022 17:09:07 GMT
Server: nginx
Transfer-Encoding: chunked
X-Powered-By: PHP/7.3.33

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 14 Jul 2022 16:58:56 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By: PHP/5.4.16
location: http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 95 KB
37 KB 51ms
34ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MB79N3N

Requested by

Host: bayareaace.com
URL: http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9e15f2039b1402818b76d776dc46281f35fac541a921a0ec270ba9a9dbb1abd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: http://bayareaace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:57 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37117
x-xss-protection: 0
last-modified: Thu, 14 Jul 2022 16:05:25 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 14 Jul 2022 16:58:57 GMT

POST
H/1.1 200
OK fp.php Show response
bayareaace.com/ 0
194 B 199ms
199ms XHR
text/html 23.250.1.134
SERVER-MANIA

General

Check archive.org

Show headers Download Go to

Full URL: http://bayareaace.com/fp.php
Requested by: Host: bayareaace.com
URL: http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50
Protocol: HTTP/1.1
Server: 23.250.1.134 Buffalo, United States, ASN55286 (SERVER-MANIA, CA),
Reverse DNS
Software: nginx / PHP/7.3.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 14 Jul 2022 17:09:07 GMT
Server: nginx
Connection: keep-alive
X-Powered-By: PHP/7.3.33
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK retargeting.js Show response
static.traversedlp.com/v1/ 11 KB
4 KB 43ms
5ms Script
application/javascript 13.225.214.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.traversedlp.com/v1/retargeting.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MB79N3N
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-129.ewr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3ad3fefdb207753cf1f7f14c610030fd6b00660db09420776630d056c35a2c58

Request headers

accept-language: en-US,en;q=0.9
Referer: http://bayareaace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Thu, 14 Jul 2022 16:20:00 GMT
Content-Encoding: gzip
Last-Modified: Wed, 01 Jun 2022 20:20:14 GMT
Server: AmazonS3
Age: 2338
ETag: W/"c31ba40743566f87f00f822e3cefb390"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
x-amz-version-id: KLbodh6xIMdiUWAxenjc1ByBclqfTj74
Via: 1.1 7ae870cd25f69f522a5d075cc08767f0.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: EWR50-C1
Content-Type: application/javascript
X-Amz-Cf-Id: x-Yapk1FiMPfTI1d0XUntQVCpNVgCj6b_6GY1eaUWqnrWXxmZdSV1w==

GET
H2 200 request.js Show response
script.anura.io/ 50 KB
18 KB 118ms
71ms Script
application/javascript 34.207.39.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/request.js?instance=56309078&source=203930&campaign=28062&exid=62b17f83386680b6d3979191555710fd&934661928663

Requested by

Host: bayareaace.com
URL: http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.207.39.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-39-23.compute-1.amazonaws.com

Software

nginx /

Resource Hash

b1e25155d2112219ee29424611bdb42fce0fcfead7732e8c6a503e4c95f8ea0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: http://bayareaace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2 200 matches
signals.aimtell.com/ 43 B
334 B 73ms
27ms Image
image/gif 2606:4700::6812:1e97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://signals.aimtell.com/matches?token=f5d7c95ea0af0ed4512d414529c2dffa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1e97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: http://bayareaace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:57 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 72abce5c9e7e8c15-EWR
access-control-allow-headers: Content-Type, *
content-length: 43

GET
H2 200 cookie Show response
api.traversedlp.com/retargeting/v1/ 18 B
407 B 48ms
17ms XHR
application/json 34.192.2.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.traversedlp.com/retargeting/v1/cookie
Requested by: Host: static.traversedlp.com
URL: https://static.traversedlp.com/v1/retargeting.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.2.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-2-145.compute-1.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 306094011fa17d1eb215263299126f9f95f50a1c2235c991846ccfd1911a6dce

Request headers

accept-language: en-US,en;q=0.9
Referer: http://bayareaace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:57 GMT
server: nginx/1.20.0
etag: W/"12-86d81FY+WDtP4sdiTK7DKw"
vary: Accept-Encoding
p3p: CP="CAO PSAo CONo OUR OTRo BUS PHY ONL UNI COM NAV DEM STA"
access-control-allow-origin: http://bayareaace.com
access-control-expose-headers
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 18

POST
H2 200 enqueue Show response
api.traversedlp.com/retargetinginclusion/ 0
326 B 14ms
14ms XHR
text/plain 34.192.2.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.traversedlp.com/retargetinginclusion/enqueue
Requested by: Host: static.traversedlp.com
URL: https://static.traversedlp.com/v1/retargeting.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.2.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-2-145.compute-1.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://bayareaace.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: http://bayareaace.com
date: Thu, 14 Jul 2022 16:58:57 GMT
access-control-allow-credentials: true
server: nginx/1.20.0
p3p: CP="CAO PSAo CONo OUR OTRo BUS PHY ONL UNI COM NAV DEM STA"
vary: X-HTTP-Method-Override
access-control-expose-headers

OPTIONS
H2 200 enqueue
api.traversedlp.com/retargetinginclusion/ Frame 0
0 33ms
12ms Preflight
text/html 34.192.2.145
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.traversedlp.com/retargetinginclusion/enqueue
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.192.2.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-2-145.compute-1.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: http://bayareaace.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,authorization
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
access-control-allow-origin: http://bayareaace.com
access-control-expose-headers
allow: ACL,BIND,CHECKOUT,CONNECT,COPY,DELETE,GET,HEAD,LINK,LOCK,M-SEARCH,MERGE,MKACTIVITY,MKCALENDAR,MKCOL,MOVE,NOTIFY,PATCH,POST,PROPFIND,PROPPATCH,PURGE,PUT,REBIND,REPORT,SEARCH,SOURCE,SUBSCRIBE,TRACE,UNBIND,UNLINK,UNLOCK,UNSUBSCRIBE
content-length: 228
content-type: text/html; charset=utf-8
date: Thu, 14 Jul 2022 16:58:57 GMT
etag: W/"e4-6lFXkgJZ15OAZuBnvvjMtg"
p3p: CP="CAO PSAo CONo OUR OTRo BUS PHY ONL UNI COM NAV DEM STA"
server: nginx/1.20.0
vary: Accept-Encoding

GET
H2

200

Primary Request ffn_4mp1 Show response
apply.freedomfinancialnet.com/
Redirect Chain

https://ifatrk.com/?a=4&c=1815&s1=203930&s2=62b17f83386680b6d3979191555710fd&s3=41576_9260892_11
https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm...

35 KB
8 KB

383ms
266ms

Document
text/html

34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281

Requested by

Host: bayareaace.com
URL: http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

746e9296f4836e77d133c61ccbde902829bb2f9520de7701a716d8148c03ac8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: http://bayareaace.com/a71e8105f79c6ad8039c687fa047aa0d3/?sid1=41576_9260892_11&sid2=2272_303735915_0_0_0_4438614_50_1775_101760_9260892_10_1947&sid3=50
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 14 Jul 2022 16:58:58 GMT
etag: "8b23-Luctfo3F55esZooSfTg6X5MohSY"
strict-transport-security: max-age=15724800; includeSubDomains
vary: Accept-Encoding

Redirect headers

Cache-Control: private
Connection: close
Content-Length: 402
Content-Type: text/html; charset=utf-8
Date: Thu, 14 Jul 2022 16:58:58 GMT
Location: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
P3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

POST
H2 200 response.json
script.anura.io/ 43 B
398 B 302ms
281ms XHR
application/json 34.207.39.23
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/response.json

Requested by

Host: script.anura.io
URL: https://script.anura.io/request.js?instance=56309078&source=203930&campaign=28062&exid=62b17f83386680b6d3979191555710fd&934661928663

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.207.39.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-207-39-23.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://bayareaace.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
access-control-allow-methods: POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2 200 webpack-9c188a38e86455f4.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 4 KB
2 KB 34ms
33ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/webpack-9c188a38e86455f4.js

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

6f5757586f09df18c01d4088337777eb0811ca8148bd55dd47fe20bdc1ba33d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"1009-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 framework-63f178b04a9d87b4.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 127 KB
42 KB 36ms
36ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/framework-63f178b04a9d87b4.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

56181134088b2c4c736ca3bfbbde20d972ffdfdf5e45d8cbf1fd7efa5d3f5a55

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"1fc81-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 main-99469a66d7d08f8c.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 81 KB
25 KB 58ms
54ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/main-99469a66d7d08f8c.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

4b3e77d3f559db1f98aa30a4259ec83ec2bc331ced4953db19d815ad391ad6c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"142ee-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 _app-728b8915c13ec332.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/pages/ 890 KB
277 KB 58ms
55ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/pages/_app-728b8915c13ec332.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

4d2ee1d209ef3357e321b265e74369e1d16c63e024e9fb6cb695bbc579eeb181

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"de63c-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 2712-90d11556ddfd620e.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 40 KB
14 KB 61ms
58ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/2712-90d11556ddfd620e.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

0f62bfbc3e1a0bf22c38a2257c40201028707a4dc1ea76f690c2fefd4ef547e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"a14f-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 6456-efe9a794c056d16b.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 51 KB
15 KB 60ms
57ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/6456-efe9a794c056d16b.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

f5706fc18e80cc81f81e24d0b5eb7a41566cb681f6464b0bbf2fd81c15c24618

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"ca61-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 9144-d3aa0c7b16ca2a7b.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 25 KB
7 KB 58ms
55ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/9144-d3aa0c7b16ca2a7b.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

35c37816d291e9c8443f8616c2d663f3b953980dee0bdcdf2587f6a91877cc6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"63c9-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 %5Bcampaign%5D-a5743ee18b0f3136.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/pages/ 8 KB
3 KB 60ms
57ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/pages/%5Bcampaign%5D-a5743ee18b0f3136.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

37f1021b1b8355050d47ce9c21eaa7bcd824445e21f0691ad7403e8aff9371c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"1f1d-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 _buildManifest.js Show response
apply.freedomfinancialnet.com/_next/static/835f03b949c4f8e61631c6a06c4b7a70148d6011/ 6 KB
2 KB 61ms
58ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/835f03b949c4f8e61631c6a06c4b7a70148d6011/_buildManifest.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

b44a0bc72e8a00eb116add6082d59cac2da03ef3f5b7685cc7bf8fa8ec5b75ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"17a8-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 _ssgManifest.js Show response
apply.freedomfinancialnet.com/_next/static/835f03b949c4f8e61631c6a06c4b7a70148d6011/ 77 B
335 B 57ms
55ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/835f03b949c4f8e61631c6a06c4b7a70148d6011/_ssgManifest.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"4d-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes
content-length: 77

GET
H2 200 _middlewareManifest.js Show response
apply.freedomfinancialnet.com/_next/static/835f03b949c4f8e61631c6a06c4b7a70148d6011/ 92 B
350 B 61ms
59ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/835f03b949c4f8e61631c6a06c4b7a70148d6011/_middlewareManifest.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

de5341313a4dc5d982ca50ae4a491e84bc5e80b0f439d87f05fc3973c1b7e59a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"5c-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes
content-length: 92

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
1 KB 37ms
21ms Stylesheet
text/css 2607:f8b0:4006:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200a New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

384e668a765ad88ee27d4937f0baeef54171ac9ec18791e839640ebb6bc29fc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 14 Jul 2022 15:54:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 14 Jul 2022 16:58:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 14 Jul 2022 16:58:58 GMT

GET
H2 200 freedomNetLogo.svg
images.ctfassets.net/b32zuu6bt176/2NPI7B9FLgFOzZymwweN43/395a29c2c937fd2c8ea2cb3404e02e28/ 8 KB
3 KB 32ms
4ms Image
image/svg+xml 2600:9000:210b:5a00:12:94b3:c380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.ctfassets.net/b32zuu6bt176/2NPI7B9FLgFOzZymwweN43/395a29c2c937fd2c8ea2cb3404e02e28/freedomNetLogo.svg
Requested by: Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:210b:5a00:12:94b3:c380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Contentful Images API /
Resource Hash: 3326c545962466a3fb88f385a11aeab929d0285d8af2977212b1fb05ba22a827

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 05:51:28 GMT
content-encoding: gzip
last-modified: Wed, 10 Mar 2021 16:37:23 GMT
server: Contentful Images API
age: 40051
etag: W/"2836945a60f880116f667b166b572957"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: Vg7GVqKFTTBAurLDkom8ARCgpGjwJiD6ZIfXjYtKnYe2DwwueWyKcg==
via: 1.1 34d691c1cf360a32817ace92de30761c.cloudfront.net (CloudFront)

GET
H2 200 phone-blue.svg
images.ctfassets.net/b32zuu6bt176/L8ulczF39D0kQfjda8qjz/516b9e34b52df818100e87029010810a/ 1 KB
1002 B 43ms
15ms Image
image/svg+xml 2600:9000:210b:5a00:12:94b3:c380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.ctfassets.net/b32zuu6bt176/L8ulczF39D0kQfjda8qjz/516b9e34b52df818100e87029010810a/phone-blue.svg
Requested by: Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:210b:5a00:12:94b3:c380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Contentful Images API /
Resource Hash: b432670c18a754142653e11119034e5c944ce6ec998f2ddea0315c0347201834

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 12:03:27 GMT
content-encoding: gzip
last-modified: Mon, 12 Oct 2020 17:36:54 GMT
server: Contentful Images API
age: 17732
etag: W/"ef069d02c9c612b8a2e8b27f3e6c35a4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: TaGteZJhxq0SHq7tfLbhVlfi6HeMx9N7xQtzocN6I2usDe6oiI8RuA==
via: 1.1 34d691c1cf360a32817ace92de30761c.cloudfront.net (CloudFront)

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 44 KB
11 KB 61ms
13ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Requested by: Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7bee59805589126e21db95601706f843be3f8b62bd8ace4e7c5433f8382ebe09

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Mon, 27 Jun 2022 23:56:22 GMT
server: AkamaiNetStorage
etag: "746e3231d017d1a8f69d80efc56db477:1656374181.965341"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 10857
expires: Thu, 14 Jul 2022 17:03:58 GMT

GET
H2 200 bg-desktop.svg
images.ctfassets.net/b32zuu6bt176/7dpj3TgoldzUg7XdsEuUdW/887b208269cc152c309d564611aa71ae/ 3 KB
1 KB 5ms
5ms Image
image/svg+xml 2600:9000:210b:5a00:12:94b3:c380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.ctfassets.net/b32zuu6bt176/7dpj3TgoldzUg7XdsEuUdW/887b208269cc152c309d564611aa71ae/bg-desktop.svg
Requested by: Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:210b:5a00:12:94b3:c380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Contentful Images API /
Resource Hash: 88487bbc94a8da6d3df5ff48ad198e4913c74422b1a60b682660ce3c023da23e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 10:07:54 GMT
content-encoding: gzip
last-modified: Mon, 20 Dec 2021 18:00:00 GMT
server: Contentful Images API
age: 24664
etag: W/"ef51bc569253f152fd63961ae8a6ad37"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: XPEjHnzLK24MK8sY_lGG8SzKXkYQqhu_SO8zCH5gU3stMeVUFtFJrg==
via: 1.1 34d691c1cf360a32817ace92de30761c.cloudfront.net (CloudFront)

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ 44 KB
44 KB 23ms
5ms Font
font/woff2 2607:f8b0:4006:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2003 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://apply.freedomfinancialnet.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 13 Jul 2022 19:32:38 GMT
x-content-type-options: nosniff
age: 77180
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Jul 2023 19:32:38 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2
fonts.gstatic.com/s/opensans/v29/ 31 KB
31 KB 6ms
5ms Font
font/woff2 2607:f8b0:4006:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2003 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

935be36155c74981c8f8baf473058b6798ab14eafcf898fcf17c1fc7bb0c254a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://apply.freedomfinancialnet.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 13 Jul 2022 19:41:20 GMT
x-content-type-options: nosniff
age: 76658
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31448
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Jul 2023 19:41:20 GMT

GET
H2 200 9990-444de82574f8d676.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 14 KB
5 KB 36ms
36ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/9990-444de82574f8d676.js

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/main-99469a66d7d08f8c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

e8f40f61e8d5d6df7386668d2836bb947051fffbf965ab38bdb139e1bfde311c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"36fa-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 6850-9605af9be76e9f75.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 13 KB
5 KB 59ms
58ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/6850-9605af9be76e9f75.js

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/main-99469a66d7d08f8c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

78f1b809f8aa7b7b1488f53c2a4e2f209f279c8c7e23991d6a6415ba289c5dd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"34a3-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 2308-97445be6e076840c.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 26 KB
9 KB 63ms
63ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/2308-97445be6e076840c.js

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/main-99469a66d7d08f8c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

0614b885d83e2398d6d118f717c14f88eba98a973f3351f5536d246af8705d16

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"6778-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 9411-f1d08d472fee7beb.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/ 18 KB
7 KB 60ms
60ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/9411-f1d08d472fee7beb.js

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/main-99469a66d7d08f8c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

019b77e9434f25334bf9ff220045d08b36cb49869a434fbcdda0b721819cf097

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"49eb-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 estimated-debt-18efffecb1be5ab4.js Show response
apply.freedomfinancialnet.com/_next/static/chunks/pages/%5Bcampaign%5D/ 19 KB
5 KB 63ms
63ms Script
application/javascript 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/chunks/pages/%5Bcampaign%5D/estimated-debt-18efffecb1be5ab4.js

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/main-99469a66d7d08f8c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

36ab8944c1c56f83152606ac7efcf71168fcfa29c47bc773fbd6f9a40d22f39b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"4cf3-181e1520da0"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 27d680fadd87e227.css Show response
apply.freedomfinancialnet.com/_next/static/css/ 926 B
1 KB 59ms
59ms Fetch
text/css 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/static/css/27d680fadd87e227.css

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/main-99469a66d7d08f8c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

62ef1af1c12468125dc1c5004a1787fd57058d0ea3a8d8f26b50b52713481ffa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
last-modified: Sat, 09 Jul 2022 04:57:40 GMT
etag: W/"39e-181e1520da0"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=31536000, immutable
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes
content-length: 926

POST
H2 201 track-event Show response
apply.freedomfinancialnet.com/api/ 0
243 B 56ms
56ms XHR
text/plain 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/api/track-event

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/pages/_app-728b8915c13ec332.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2 200 utag.3.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 3 KB
2 KB 20ms
12ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.3.js?utv=ut4.47.202112091954
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 6e0ef256271b4ace71542793c679cfa39a1f367ae293dc40a2e064c33daebda0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:54:15 GMT
server: AkamaiNetStorage
etag: "4b37e8a8a7bb0576574471f0944d3a21:1639079655.604018"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1483
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 utag.4.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 25 KB
8 KB 22ms
14ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.4.js?utv=ut4.47.202206272355
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: fd341e83be9e4ad1c0021b7f095715aee3c4931a8eba081a13c528249b752070

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Mon, 27 Jun 2022 23:56:21 GMT
server: AkamaiNetStorage
etag: "a93b2fd89da713443b46a82fe7574a37:1656374181.715692"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 7852
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 utag.5.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 13 KB
4 KB 25ms
17ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.5.js?utv=ut4.47.202202270255
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 795697490194e742fe564de7f23df7361ee436f1aca2ce88eb1a95cbb9d9a257

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sun, 27 Feb 2022 02:55:44 GMT
server: AkamaiNetStorage
etag: "f83e115b22949bbd348e93c0ec28b222:1645930544.890735"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3915
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 utag.9.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 32 KB
8 KB 27ms
19ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.9.js?utv=ut4.47.202111111649
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e6572baea44da015c6c2e163c9319d10694fbbaed42058c40613f8c11f30659d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Tue, 03 Aug 2021 17:29:59 GMT
server: AkamaiNetStorage
etag: "cf0a90c29d2f818d4e0973551eb523e2:1628011799.30595"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 7601
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 utag.23.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 4 KB
2 KB 28ms
21ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.23.js?utv=ut4.47.202104221618
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: ef3f3ac96c2e0a7fd71f775a4377413365aa63659423260bf2472bd419823532

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Thu, 22 Apr 2021 16:18:28 GMT
server: AkamaiNetStorage
etag: "60c1e03e4da5a0a44e399ab9bcf286b3:1619108308.4689"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1675
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 utag.32.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 5 KB
2 KB 28ms
21ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.32.js?utv=ut4.47.202106081329
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b84bd412e2fa8adb61ca71806cfa75a7c8744c5439592bec244bfa932caa7cc9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Tue, 08 Jun 2021 13:29:50 GMT
server: AkamaiNetStorage
etag: "4210472337ca1afd5d4315b76079965d:1623158990.941006"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2248
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 utag.36.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 13 KB
4 KB 29ms
22ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.36.js?utv=ut4.47.202202270255
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: fedf1a833080dfd45892eee078eddee9fb8a74220093987613837e1b5c081829

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Sun, 27 Feb 2022 02:55:45 GMT
server: AkamaiNetStorage
etag: "5953225a19149b07d2860c005560c014:1645930545.516002"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3829
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 utag.41.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 9 KB
3 KB 29ms
22ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.41.js?utv=ut4.47.202112201818
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d3e34c041aac1524fb49247eddcc5c5160f5d67a35fcb96024739273320aaa8c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Mon, 20 Dec 2021 18:18:45 GMT
server: AkamaiNetStorage
etag: "e34a276701eab065c529dcced57cfc7a:1640024325.088863"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2484
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 estimated-debt.json Show response
apply.freedomfinancialnet.com/_next/data/835f03b949c4f8e61631c6a06c4b7a70148d6011/ffn_4mp1/ 13 KB
4 KB 178ms
177ms Fetch
application/json 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/_next/data/835f03b949c4f8e61631c6a06c4b7a70148d6011/ffn_4mp1/estimated-debt.json?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281&campaign=ffn_4mp1

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/main-99469a66d7d08f8c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

825044f103b1f52d3e9e17e0ecb1c99d3ffa5d439eb483bfd05a89583f9a30f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
cache-control: private, no-cache, no-store, max-age=0, must-revalidate
vary: Accept-Encoding
content-encoding: gzip
etag: "3263-zD66S1OJ2a4+eDFx3TQG8jG5LjI"
strict-transport-security: max-age=15724800; includeSubDomains
content-type: application/json

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
203 B 6ms
6ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=freedomfinancialnetwork/freedomfinancialnet/202206272355&cb=1657817938861
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Thu, 14 Jul 2022 17:08:58 GMT

GET
H2 200 hotjar-2327048.js Show response
static.hotjar.com/c/ 5 KB
3 KB 31ms
14ms Script
application/javascript 13.225.63.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2327048.js?sv=3

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.63.88 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-63-88.ewr53.r.cloudfront.net

Software

Resource Hash

263d8420fa817c2800fa2b6cc49bf4fdec2ab34eaa7a8e10b564aec4d3a0a152

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=86400; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
age: 16
x-cache: Hit from cloudfront
date: Thu, 14 Jul 2022 16:58:58 GMT
cross-origin-resource-policy: cross-origin
via: 1.1 f78e2a2d083c0945ee670c9d5d179e9e.cloudfront.net (CloudFront)
cache-control: max-age=60
etag: W/8e73bcc42d59b348df76da97ef0b395a
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
x-amz-cf-pop: EWR53-C1
x-amz-cf-id: oNBIhhHQp5KyiCZzP_PTgOKxlZqa61RlKl_9elPgG0sbS33eJVyxqQ==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 18ms
5ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26001
x-xss-protection: 0
pragma: public
x-fb-debug: MQki0Mbzgw99bhum3LzfZYqi+rXbGGNJO3PziknTUd4OmELY5ztPEpdvy/tXcrQKlj0I/EJXecGjzJcK/jfCoA==
x-fb-trip-id: 1512268381
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 14 Jul 2022 16:58:58 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 154 KB
57 KB 52ms
40ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-926516132

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ad7b2b8fbc672cb7b3216642a3a8602e139889db62cfbe4c76bf0c2088ae858d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 58125
x-xss-protection: 0
last-modified: Thu, 14 Jul 2022 16:05:25 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 14 Jul 2022 16:58:58 GMT

GET
H2

200

bootstrap.js Show response
cdn.trustedform.com/
Redirect Chain

https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.6229365290807762
https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.6229365290807762

8 KB
4 KB

68ms
33ms

Script
application/javascript

2600:9000:21dd:e000:1c:7f1a:6680:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.6229365290807762
Requested by: Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
Protocol: H2
Server: 2600:9000:21dd:e000:1c:7f1a:6680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3c98c65185f0c687986fab5e2b66b56d7f89b896d1aa7dae48ccb466ee58ef46

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
last-modified: Tue, 10 May 2022 15:11:25 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
etag: W/"af2c721f28d4f08f6dd1e2d1538d6d5e"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
via: 1.1 968753ca270b3abbf31cdfc00e23b162.cloudfront.net (CloudFront)
x-amz-version-id: M4BYxzuwDsSLMzNpxHSURX978fUhoR5T
x-amz-cf-id: yTYXRJkB8Cazb5UMeBspIrYPcMmED0_VmKtguYPKyNZWLn1G2X1lAg==

Redirect headers

location: https://cdn.trustedform.com:443/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.6229365290807762
date: Thu, 14 Jul 2022 16:58:58 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1006637/ 55 KB
17 KB 20ms
5ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1006637/tfa.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eabe936530e880e1b5bedd91889b18e87de40c608a7058ccbcd900dc5a1473b6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: s3wvzUgKHMk6RvAzhJQqfbGIuvIj89bD
content-encoding: gzip
etag: "5095bae2c453a86038187bd1a87211a3"
age: 173
x-cache: HIT
x-amz-replication-status: PENDING
content-length: 17409
x-amz-id-2: oNzxyXGwntCglzyr7JYrEcHaGIKF33PKzRH16kcaANhOd0neGFDLFMWMTnIs/0UWtFr9mZ7L7h/igxTFHAwaDA==
x-served-by: cache-ewr18127-EWR
last-modified: Sun, 10 Jul 2022 11:24:50 GMT
server: AmazonS3
x-timer: S1657817939.891148,VS0,VE1
date: Thu, 14 Jul 2022 16:58:58 GMT
vary: Accept-Encoding
x-amz-request-id: 4Y31JX1QJ6N42RYT
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 7
x-cache-hits: 1

GET
H2 200 a-05iv.min.js Show response
b-code.liadm.com/ 27 KB
10 KB 54ms
5ms Script
application/javascript 2600:9000:210b:f800:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-05iv.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:210b:f800:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 2ec5f4d31b86d22a8e32bf7c4b3a8c448e6edc54ddf2fa1d5842b37115875511

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Wed, 13 Jul 2022 18:34:15 GMT
via: 1.1 7059c9fc065ed611eb4484ede494f844.cloudfront.net (CloudFront)
age: 80683
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-pop: EWR53-C3
content-encoding: gzip
x-amz-cf-id: MSAbZnDfKmvw6djTln3hmzPPC56f3EvavMQUxtgPl8LQ3aH2cNjTSA==

GET
H2 200 utag.44.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 8 KB
3 KB 11ms
10ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.44.js?utv=ut4.47.202206272356
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1b467b2e5a13614556b2e39d7ae9c788f69a8a3169def8431fcf3b2eaaf0c96e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Wed, 16 Mar 2022 16:28:43 GMT
server: AkamaiNetStorage
etag: "7820ea709570ea453716e29de71aa5de:1647448123.824823"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2570
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H2 200 utag.48.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 10 KB
3 KB 16ms
15ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.48.js?utv=ut4.47.202206272356
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 93e7a60935c388108dde0d64432ca04a6fcf55df28cab3f3354a0e321fa34dad

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
last-modified: Thu, 28 Apr 2022 17:31:20 GMT
server: AkamaiNetStorage
etag: "661cfde32bdce2056f2b8d2658b68e4c:1651167080.598287"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3339
expires: Fri, 29 Jul 2022 16:58:58 GMT

GET
H3 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 12ms
4ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.65

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d4edbbe1037c50c8ffa90860286c8166860ad9da450ed5e16a28e2fc9bce3c23

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 20715
x-xss-protection: 0
pragma: public
x-fb-debug: QHk8xiVAwO46bTjMkTEeF4FHnM4gWkPXofJq2OAFcLJmIUxsJgzGIRH2EQuDlKXObKWHGZqyY/hhdYe/vyOUCw==
x-frame-options: DENY
date: Thu, 14 Jul 2022 16:58:58 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 219272468277337 Show response
connect.facebook.net/signals/config/ 25 KB
7 KB 48ms
41ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/219272468277337?v=2.9.65&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fb8ed37ef272d1f6e50f377bd275a7044286171a625d7377e026774efc3c0dfb

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: JRLUHhWb0uMzGI7hh8EYKIqWuw86tadl8IsgrZhLhvB0HT+i/MesO1CE1Q6Jx2eIk4TrKTTksm/4VDswxNfe9w==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 14 Jul 2022 16:58:58 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1657817938947
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

trackpoint-async.js Show response
s2.adform.net/banners/scripts/st/
Redirect Chain

https://a1.adform.net/serving/scripts/trackpoint/async/
https://s2.adform.net/banners/scripts/st/trackpoint-async.js

81 KB
30 KB

96ms
11ms

Script
application/javascript

185.167.164.47
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
Requested by: Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1/estimated-debt?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
Protocol: H2
Server: 185.167.164.47 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: ee94251fea8b03da5d0dc6f8489a529c1a2d2a031d874b0ec61866784e3c73c3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
last-modified: Wed, 25 May 2022 11:34:23 GMT
server: nginx
x-amz-request-id: tx0000000000000413b903c-0062cf0c89-32334d62-default
etag: W/"552eeb5f0620fb6f56733d625b5e719e"
x-cache-status: HIT, EXPIRED, HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800

Redirect headers

location: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html

GET
H2 200 events.js Show response
analytics.tiktok.com/i18n/pixel/ 126 KB
38 KB 85ms
42ms Script
application/javascript 23.49.248.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=&lib=ttq
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.49.248.16 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-248-16.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1eba8268d112d2903105c9b82da51799cd7467c382af9b3b94bcb41295d9c1dc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-akamai-request-id: 26db2463.c1bb10
date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
x-cache-remote: TCP_MISS from a23-48-215-159.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-40-19-16.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-parent-response-time: 34,23.40.19.16
server-timing: cdn-cache; desc=MISS, edge; dur=8, origin; dur=26, inner; dur=2
content-length: 37804
pragma: no-cache
server: nginx
x-tt-logid: 20220714165858010004003007735002006122C80B2
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 26,23.48.215.159
x-tt-trace-host: 01805dd5b33f2fecd0b1907d90c6a9fae6b159300b538ffedf728a64bf9cb2d76933377c3cf3e9264ac54c6a95d78792f7fb1cd3a19379117f51644b5090d475c01ddfaa69a64e5fe400a9d93aecf192dab73b98fea47ff09484e830086911584fb84f1218233cc239441febb827c7f310
expires: Thu, 14 Jul 2022 16:58:58 GMT

GET
H2 200 modules.c1ee1432a210d043a500.js Show response
script.hotjar.com/ 245 KB
63 KB 21ms
6ms Script
application/javascript 54.230.163.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.c1ee1432a210d043a500.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2327048.js?sv=3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.230.163.70 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-163-70.ewr53.r.cloudfront.net

Software

Resource Hash

f9dca1c94230284259e7ecdc43283a907876a18978700c6b6198d36dd2703bb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 09:40:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26331
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains
content-length: 64401
access-control-allow-origin: *
last-modified: Thu, 14 Jul 2022 09:39:33 GMT
etag: "498b600bf7ff37331482fe1ffcb30cd5"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 bc5fa17d3a05da358cc5e2a45aac35c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: EWR53-C3
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: MayHy87Do4m3z01JUfnjYrlHWizaaANjMmyQOQ3sydkXhhEKPIRgIw==

GET
H2 200 json Show response
trc.taboola.com/1006637/trc/3/ 2 KB
2 KB 48ms
38ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1006637/trc/3/json?tim=1657817938920&data=%7B%22id%22%3A793%2C%22ii%22%3A%22%2Fffn_4mp1%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1657817938913%2C%22cv%22%3A%2220220710-5-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281%22%2C%22e%22%3A%22http%3A%2F%2Fbayareaace.com%2F%22%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dbills-slw-debt%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22item-url%22%3A%22https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281%22%2C%22tim%22%3A1657817938919%2C%22ref%22%3A%22http%3A%2F%2Fbayareaace.com%2F%22%2C%22tos%22%3A3%2C%22ssd%22%3A1%2C%22scd%22%3A100%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1006637/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a2b95bcdd12b9623c208722b7f656ad774419635959a553fa48486ed51da480b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-vcl-time-ms: 34
date: Thu, 14 Jul 2022 16:58:58 GMT
content-encoding: gzip
server: nginx
x-timer: S1657817939.943126,VS0,VE34
x-served-by: cache-ewr18127-EWR
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 box-1ada912494ba7fc7aca15fcef1c2a7ae.html Show response
vars.hotjar.com/ Frame DF84 2 KB
1 KB 18ms
4ms Document
text/html 13.226.39.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vars.hotjar.com/box-1ada912494ba7fc7aca15fcef1c2a7ae.html

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2327048.js?sv=3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.20 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-20.ewr53.r.cloudfront.net

Software

Resource Hash

90438997aa817bad94f49d367b04dbaaaa387493ef5a1f5b5d5f7b953b76c1ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Referer: https://apply.freedomfinancialnet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 116753
cache-control: max-age=31536000
content-encoding: br
content-length: 1044
content-type: text/html
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 13 Jul 2022 08:33:06 GMT
etag: "0b3d3f4206ab84d8861a8cc4b2ddbe66"
last-modified: Wed, 13 Jul 2022 08:32:20 GMT
strict-transport-security: max-age=86400; includeSubDomains
vary: Accept-Encoding
via: 1.1 08e4533f506df09f2c978ceaed6e2310.cloudfront.net (CloudFront)
x-amz-cf-id: 1ux0IzGPxahaQUtb_2ch9KROq8B1haDPuObpaA84yDRY-aTZI5YVBQ==
x-amz-cf-pop: EWR53-C2
x-cache: Hit from cloudfront
x-robots-tag: none

GET
H2 200 /
www.facebook.com/tr/ 44 B
412 B 17ms
5ms Image
image/gif 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=219272468277337&ev=PageView&dl=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&rl=http%3A%2F%2Fbayareaace.com%2F&if=false&ts=1657817939058&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmtealium&ec=0&o=28&fbp=fb.1.1657817939057.1037966192&it=1657817938900&coo=false&eid=f7757e4b5f859150d71c53ee7096d7f0&tm=1&exp=u0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 14 Jul 2022 16:58:59 GMT

GET
H2 204 unip Show response
trc.taboola.com/1006637/log/3/ 0
277 B 24ms
23ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1006637/log/3/unip?en=page_view&item-url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&tim=1657817938919&ref=http%3A%2F%2Fbayareaace.com%2F&cv=20220710-5-RELEASE&tos=143&ssd=1&scd=100&vi=1657817938913&ri=c7e853117822e3bd8aad3f53e93a3489&sd=v2_65099d4a94f314b9492a16b876a220fa_0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2_1657817938_1657817938_CMC0lh8Qrbg9GOH3mO2fMCABKAEw4QE4kaQOQLDlD0j_ndsDUP8DWABgAGjsyrjT39zS1ipwAQ&ui=0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1006637/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-vcl-time-ms: 3
pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
via: 1.1 varnish
server: nginx
x-timer: S1657817939.075939,VS0,VE3
x-served-by: cache-ewr18127-EWR
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://apply.freedomfinancialnet.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H2 200 cds-pips.js Show response
cdn.taboola.com/scripts/ 2 KB
1 KB 18ms
18ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/cds-pips.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1006637/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 70efe208587aa0220cbd71b13870394c06f90930540cbdfb677b1af997023bac

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: Q93sCEWoqxiO0LdTLulEOAOmIgRcHF1L
content-encoding: gzip
etag: "8cbcf8a5c724c32aa9be09d14a4c624d"
age: 1801
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 923
x-amz-id-2: fyktYwwLkUsXlRkyUu2P9Rcv8yNtMvba+ENZsruFdgSi2jAsn7KD+VNqR3/NcLX4HKLAVuF3fB0=
x-served-by: cache-ewr18127-EWR
last-modified: Tue, 05 Apr 2022 10:34:30 GMT
server: AmazonS3
x-timer: S1657817939.075908,VS0,VE0
date: Thu, 14 Jul 2022 16:58:59 GMT
vary: Accept-Encoding
x-amz-request-id: YTZW9KQ23FYSGPR1
via: 1.1 varnish
cache-control: private, max-age=3600
accept-ranges: bytes
content-type: application/javascript
abp: 79
x-cache-hits: 5418

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 40 KB
15 KB 71ms
38ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-926516132

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

f339bf56ad8afee196e4fc0b372309b0182860243c807c6577f3a3d64fcc1a4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15167
x-xss-protection: 0
server: cafe
etag: 11554697858837217958
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 14 Jul 2022 16:58:59 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 40ms
40ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-998340879&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-926516132

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b7631bde4924a3225ae9befba3f31a2519417ea802cd298dfa9f2feab33adfda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43865
x-xss-protection: 0
last-modified: Thu, 14 Jul 2022 16:05:25 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 14 Jul 2022 16:58:59 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 37ms
36ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-998340879&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-926516132

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

52616f98c27f6812817d4433c6fe7a1b4e095647a3c95980a48ea6ee6576e6e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43866
x-xss-protection: 0
last-modified: Thu, 14 Jul 2022 16:05:25 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 14 Jul 2022 16:58:59 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 103 KB
39 KB 37ms
37ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-131129682-26&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-926516132

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

680e209fc064b0b0a40c1a3e6da5cad23f971a0883e3d1c7f328894e2cd30ba8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40281
x-xss-protection: 0
last-modified: Thu, 14 Jul 2022 16:05:25 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 14 Jul 2022 16:58:59 GMT

GET
H2 200 identify.js Show response
analytics.tiktok.com/i18n/pixel/ 114 KB
31 KB 33ms
32ms Script
application/javascript 23.49.248.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/identify.js
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.49.248.16 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-248-16.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 8e53ff1ed1e86e6e55ce41ddd909d8802b08b66ca24171ecae21c65b3da77c75

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-akamai-request-id: 54bc321.c1bb96
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-cache-remote: TCP_MISS from a23-48-215-142.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-40-19-16.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-parent-response-time: 25,23.40.19.16
server-timing: cdn-cache; desc=MISS, edge; dur=8, origin; dur=17, inner; dur=3
pragma: no-cache
server: nginx
x-tt-logid: 202207141658590100040040077350020230A33500C
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 17,23.48.215.142
x-tt-trace-host: 01805dd5b33f2fecd0b1907d90c6a9fae6b159300b538ffedf728a64bf9cb2d769240777bb549324997c009cbd9e6119298fffec2505f881f06318bd36cf114cb66e9eecf9e5ae2fdd3fa82b5889cd51a7732f244ee1760020ba98d742557a57d1ea4c485b22a33abad3bbf578244e264b
expires: Thu, 14 Jul 2022 16:58:59 GMT

GET
H2 200 config.js Show response
analytics.tiktok.com/i18n/pixel/ 882 B
1 KB 21ms
21ms Script
application/javascript 23.49.248.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/config.js?sdkid=C5FMO4VGE0M3SF4IVADG&hostname=apply.freedomfinancialnet.com
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.49.248.16 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-248-16.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 9c2bf9d2c79d17ddba927f5a78fb89775b4788223fd06c07aa1996dcdec0e848

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-akamai-request-id: 24349f3c.c1bbb7
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-cache-remote: TCP_MISS from a23-48-215-143.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-40-19-16.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-parent-response-time: 13,23.40.19.16
server-timing: cdn-cache; desc=MISS, edge; dur=4, origin; dur=9, inner; dur=3
content-length: 359
pragma: no-cache
server: nginx
x-tt-logid: 2022071416585901000200600500500600302812417E98
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 9,23.48.215.143
x-tt-trace-host: 01805dd5b33f2fecd0b1907d90c6a9fae6b159300b538ffedf728a64bf9cb2d769a7ea05ca70f2e69aa90978d85bd61024f35300399e213fb2a4a3c8f724361c01527050bcc4e8184a627877e3c7ed51102294d1accce4bc6add62518e1519fca293c1b5822d721ff7f056cf81ed407477
expires: Thu, 14 Jul 2022 16:58:59 GMT

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1657817939169&aid=a-05iv&se=e30&duid=e5e630066617--01g7ytcf2weac9zb1q4jnxj5dt&tna=v2.4.0&pu=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn...
https://rp4.liadm.com/j?dtstmp=1657817939169&aid=a-05iv&se=e30&duid=e5e630066617--01g7ytcf2weac9zb1q4jnxj5dt&tna=v2.4.0&pu=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ff...

13 B
553 B

52ms
12ms

XHR
application/json

52.22.224.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1657817939169&aid=a-05iv&se=e30&duid=e5e630066617--01g7ytcf2weac9zb1q4jnxj5dt&tna=v2.4.0&pu=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&wpn=lc-bundle&refr=http%3A%2F%2Fbayareaace.com%2F&c=PHRpdGxlPkZyZWVkb20gRmluYW5jaWFsIE5ldHdvcms8L3RpdGxlPg&i6=MmEwZDo1NjAwOjI0OjE1MDA6MTAxMTpiMGU3OjJjN2E6MTUyNQ%3D%3D&n3pc=true

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1/estimated-debt?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281

Protocol

Server

52.22.224.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-224-209.compute-1.amazonaws.com

Software

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
x-pixel-event-id: 90b238f3-8ef0-479b-8ff6-e25fbfe11d66
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: null
x-xss-protection: 1; mode=block
vary: Origin
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: 5ffec99be4878e34
request-time: 0
content-length: 13
x-content-type-options: nosniff

Redirect headers

date: Thu, 14 Jul 2022 16:58:59 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
location: https://rp4.liadm.com/j?dtstmp=1657817939169&aid=a-05iv&se=e30&duid=e5e630066617--01g7ytcf2weac9zb1q4jnxj5dt&tna=v2.4.0&pu=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&wpn=lc-bundle&refr=http%3A%2F%2Fbayareaace.com%2F&c=PHRpdGxlPkZyZWVkb20gRmluYW5jaWFsIE5ldHdvcms8L3RpdGxlPg&i6=MmEwZDo1NjAwOjI0OjE1MDA6MTAxMTpiMGU3OjJjN2E6MTUyNQ%3D%3D&n3pc=true
x-frame-options: DENY
access-control-allow-origin: https://apply.freedomfinancialnet.com
x-xss-protection: 1; mode=block
vary: Origin
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: f4d10340252e5dd2
request-time: 0
content-length: 0
x-content-type-options: nosniff

POST
H2 201 track-event Show response
apply.freedomfinancialnet.com/api/ 0
243 B 54ms
53ms XHR
text/plain 34.134.212.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.freedomfinancialnet.com/api/track-event

Requested by

Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/_next/static/chunks/pages/_app-728b8915c13ec332.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.134.212.62 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.212.134.34.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://apply.freedomfinancialnet.com/ffn_4mp1/estimated-debt?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2

200

bootstrap.js Show response
cdn.trustedform.com/
Redirect Chain

https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.5544284264352011
https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.5544284264352011

8 KB
4 KB

42ms
42ms

Script
application/javascript

2600:9000:21dd:e000:1c:7f1a:6680:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.5544284264352011
Requested by: Host: apply.freedomfinancialnet.com
URL: https://apply.freedomfinancialnet.com/ffn_4mp1/estimated-debt?utm_source=4_ffn_mp&utm_medium=affiliate&utm_campaign=633&utm_term=203930&utm_adgroup=62b17f83386680b6d3979191555710fd&match_type=41576_9260892_11&utm_publisher=&utm_content=92449799&cake_requestid=91699281
Protocol: H2
Server: 2600:9000:21dd:e000:1c:7f1a:6680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3c98c65185f0c687986fab5e2b66b56d7f89b896d1aa7dae48ccb466ee58ef46

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:59:00 GMT
content-encoding: gzip
last-modified: Tue, 10 May 2022 15:11:25 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
etag: W/"af2c721f28d4f08f6dd1e2d1538d6d5e"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
via: 1.1 968753ca270b3abbf31cdfc00e23b162.cloudfront.net (CloudFront)
x-amz-version-id: M4BYxzuwDsSLMzNpxHSURX978fUhoR5T
x-amz-cf-id: HnyYSGkgQKAyQbLlAinO54XHBDmsX2KnGY6ubHCcEeONG4nlvb095A==

Redirect headers

location: https://cdn.trustedform.com:443/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.5544284264352011
date: Thu, 14 Jul 2022 16:58:59 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2 200 json Show response
trc.taboola.com/1006637/trc/3/ 2 KB
2 KB 26ms
26ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1006637/trc/3/json?tim=1657817939222&data=%7B%22id%22%3A255%2C%22ii%22%3A%22%2Fffn_4mp1%2Festimated-debt%22%2C%22it%22%3A%22video%22%2C%22sd%22%3A%22v2_65099d4a94f314b9492a16b876a220fa_0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2_1657817938_1657817938_CMC0lh8Qrbg9GOH3mO2fMCABKAEw4QE4kaQOQLDlD0j_ndsDUP8DWABgAGjsyrjT39zS1ipwAQ%22%2C%22ui%22%3A%220a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2%22%2C%22vi%22%3A1657817938913%2C%22cv%22%3A%2220220710-5-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281%22%2C%22e%22%3A%22http%3A%2F%2Fbayareaace.com%2F%22%2C%22cb%22%3A%22TFASC.trkCallback1%22%2C%22qs%22%3A%22%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dbills-slw-debt%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22item-url%22%3A%22https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281%22%2C%22tim%22%3A1657817939222%2C%22ref%22%3A%22http%3A%2F%2Fbayareaace.com%2F%22%2C%22tos%22%3A305%2C%22ssd%22%3A2%2C%22scd%22%3A100%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1006637/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: d12257b92ef493ab9af5dcaf620af8216d8f939a91797832efcb4c14b81c5c8a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-vcl-time-ms: 21
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
server: nginx
x-timer: S1657817939.228955,VS0,VE21
x-served-by: cache-ewr18127-EWR
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 utag.46.js Show response
tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/ 7 KB
3 KB 9ms
9ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.46.js?utv=ut4.47.202206272356
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/freedomfinancialnetwork/freedomfinancialnet/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 17810b6ce0ce393416dcf42ab69acf86d22c5aefa5c7920f1d82e1ac21917a5d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
last-modified: Tue, 19 Apr 2022 22:11:52 GMT
server: AkamaiNetStorage
etag: "509e3ab0d654014029a7cf3947b639ff:1650406312.198174"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2884
expires: Fri, 29 Jul 2022 16:58:59 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 12ms
5ms Image
image/gif 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=219272468277337&ev=PageView&dl=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&rl=http%3A%2F%2Fbayareaace.com%2F&if=false&ts=1657817939216&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmtealium&ec=1&o=28&fbp=fb.1.1657817939057.1037966192&it=1657817938900&coo=false&eid=780cea3afc5ab2617f7284a83baf04f2&tm=1&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 14 Jul 2022 16:58:59 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
716 B 88ms
88ms Ping
application/octet-stream 23.49.248.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.49.248.16 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-248-16.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: b8c2696.c1bc30
date: Thu, 14 Jul 2022 16:58:59 GMT
x-cache-remote: TCP_MISS from a23-48-215-205.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-40-19-16.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-parent-response-time: 72,23.40.19.16
server-timing: cdn-cache; desc=MISS, edge; dur=31, origin; dur=48, inner; dur=10
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20220714165859010004003007735002053113BA019
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 48,23.48.215.205
x-tt-trace-host: 01805dd5b33f2fecd0b1907d90c6a9fae6b159300b538ffedf728a64bf9cb2d769cf71ec7b02abb7b2b25b828bb6f5692982d797727da8477656945615d22da6c738568c9c6e25b94af2494c1605354391b8dde7373c16ddad0cbd5749956b74d3308c7d6a66750ddd90237fa002f2cb73
expires: Thu, 14 Jul 2022 16:58:59 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
715 B 70ms
70ms Ping
application/octet-stream 23.49.248.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.49.248.16 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-248-16.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 2434a0fb.c1bc32
date: Thu, 14 Jul 2022 16:58:59 GMT
x-cache-remote: TCP_MISS from a23-48-215-143.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-40-19-16.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-parent-response-time: 50,23.40.19.16
server-timing: cdn-cache; desc=MISS, edge; dur=44, origin; dur=20, inner; dur=11
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202207141658590100040030077350020650240D1EF
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 21,23.48.215.143
x-tt-trace-host: 01805dd5b33f2fecd0b1907d90c6a9fae6b159300b538ffedf728a64bf9cb2d7698274e103a9fa1f8e7767d422b49ba381e76d2cb66428052db3dde7d644a11d6fd4fe0db061da2eb6f8f0e9aceab66be67fb0ba0d7740ad26299edc532872d8f6f16a07e650f4ae2dd9ef3e691c7c1b2b
expires: Thu, 14 Jul 2022 16:58:59 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
716 B 57ms
57ms Ping
application/octet-stream 23.49.248.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.49.248.16 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-248-16.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 3dfaf45e.c1bc36
date: Thu, 14 Jul 2022 16:58:59 GMT
x-cache-remote: TCP_MISS from a23-220-104-24.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-40-19-16.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-parent-response-time: 30,23.40.19.16
server-timing: cdn-cache; desc=MISS, edge; dur=22, origin; dur=22, inner; dur=13
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 20220714165859010002006005005006003033133D0B4D
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 22,23.220.104.24
x-tt-trace-host: 01805dd5b33f2fecd0b1907d90c6a9fae6867f2778b1813fb9099f53117b6005295020077d16dafed0b3c28785d5aa83d3dc69f3121ab9c96c524848d76a91045881552ec9bc333d8c88d4006c2a9433756efbf32c23f32e0bdf74ea70cb0df008f11f24d9392a025be2237af577d90ef7
expires: Thu, 14 Jul 2022 16:58:59 GMT

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
713 B 65ms
65ms Ping
application/octet-stream 23.49.248.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.49.248.16 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-49-248-16.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-akamai-request-id: 3dfa93f1.c1bc3e
date: Thu, 14 Jul 2022 16:58:59 GMT
x-cache-remote: TCP_MISS from a23-220-104-24.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a23-40-19-16.deploy.akamaitechnologies.com (AkamaiGHost/10.9.0-42538714) (-)
x-parent-response-time: 24,23.40.19.16
server-timing: cdn-cache; desc=MISS, edge; dur=23, origin; dur=15, inner; dur=13
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202207141658590100020077350020470D3F21A2
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
x-origin-response-time: 16,23.220.104.24
x-tt-trace-host: 01805dd5b33f2fecd0b1907d90c6a9fae6867f2778b1813fb9099f53117b600529da6f2627448520992f395b9ed9880cb2a8cf828dcc9d6a9da513314210355abb244e33cbb5a89a09457f4cd7ca404f6d0955621bccc4852cff0465d71f442133468339bc10823cde8df162cd07c039ea
expires: Thu, 14 Jul 2022 16:58:59 GMT

GET
H2 200 / Show response
pips.taboola.com/ 64 B
250 B 25ms
4ms XHR
text/plain 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pips.taboola.com/
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: 3c96b2793b00a4b3d098ba7e2fcf034f5e3f3404ad4f4e02f671f092456a359f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
via: 1.1 varnish
server: Varnish
x-served-by: cache-ewr18150-EWR
access-control-allow-methods: GET
access-control-allow-origin: https://apply.freedomfinancialnet.com
cache-control: no-store
x-cache: HIT
accept-ranges: bytes
content-length: 64
retry-after: 0
x-cache-hits: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/ 2 KB
1 KB 46ms
26ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/?random=1657817939303&cv=9&fst=1657817939303&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5002432ec674c89be93f32abc7c0123fa83a449593a7b908201004eac0d6e441

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1212
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/ 2 KB
1 KB 44ms
25ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/?random=1657817939307&cv=9&fst=1657817939307&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

52a5238b0ad1bd9998c64f5a161f80f2b65670097e9cb594ee8b7edb69efbdfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1210
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/ 2 KB
1 KB 43ms
24ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/?random=1657817939308&cv=9&fst=1657817939308&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12161d164dc54ef18441632a392f120c085870b84070de922e6921fa91ed715b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1211
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/ 2 KB
1 KB 43ms
26ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/?random=1657817939309&cv=9&fst=1657817939309&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a18e52d45296eb3927e641fa270c5ad0065ebc158e8b505968b8129a659d13c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1209
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-user-list/926516132/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/?random=1657817939307&cv=9&fst=1657817939307&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_...
https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939307&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u...

42 B
109 B

43ms
26ms

Image
image/gif

2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939307&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=276162609&resp=GooglemKTybQhCsO

Requested by

Protocol

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/gif
location: https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939307&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=276162609&resp=GooglemKTybQhCsO
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-user-list/926516132/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/926516132/?random=1657817939308&cv=9&fst=1657817939308&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_...
https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939308&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u...

42 B
109 B

45ms
28ms

Image
image/gif

2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939308&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=3913137529&resp=GooglemKTybQhCsO

Requested by

Protocol

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/gif
location: https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939308&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=3913137529&resp=GooglemKTybQhCsO
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 20ms
4ms Script
text/javascript 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-131129682-26&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 6998
date: Thu, 14 Jul 2022 15:02:21 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 14 Jul 2022 17:02:21 GMT

GET
H/1.1 204
No Content / Show response
cds.taboola.com/ 0
155 B 22ms
3ms XHR
text/plain 141.226.224.32
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.taboola.com/?uid=0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2&uad=746edc9c28c4569cda216d7f90fad4d013eb809a638389b5be2ee7d557da05fc
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 14 Jul 2022 16:58:59 GMT
Cache-Control: no-store
Server: nginx
Connection: close

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/ 2 KB
1 KB 39ms
28ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/?random=1657817939369&cv=9&fst=1657817939369&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2673aac5b08bdec9074c0ad0d95d3b5ccc1efd175c01ffe4eac7ff0c98cf3103

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1201
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/ 2 KB
1 KB 40ms
29ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/?random=1657817939370&cv=9&fst=1657817939370&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&ig=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f40a48dc2251da96bc1eeaf2cb86f6d5208464bb7109f4896eb1260b4e0f32f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1200
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-user-list/998340879/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/?random=1657817939369&cv=9&fst=1657817939369&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939369&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=f...

42 B
109 B

26ms
24ms

Image
image/gif

2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939369&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=4235477428&resp=GooglemKTybQhCsO

Requested by

Protocol

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/gif
location: https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939369&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=4235477428&resp=GooglemKTybQhCsO
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-user-list/998340879/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/?random=1657817939370&cv=9&fst=1657817939370&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=f...

42 B
109 B

24ms
23ms

Image
image/gif

2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=2539113144&resp=GooglemKTybQhCsO

Requested by

Protocol

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/gif
location: https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=2539113144&resp=GooglemKTybQhCsO
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-user-list/998340879/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/998340879/?random=1657817939370&cv=9&fst=1657817939370&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=f...

42 B
109 B

27ms
26ms

Image
image/gif

2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=1566478221&resp=GooglemKTybQhCsO

Requested by

Protocol

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/gif
location: https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&is_vtc=1&random=1566478221&resp=GooglemKTybQhCsO
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 unip Show response
trc.taboola.com/1006637/log/3/ 0
58 B 9ms
8ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1006637/log/3/unip?en=page_view&item-url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&tim=1657817939222&ui=0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2&ref=http%3A%2F%2Fbayareaace.com%2F&cv=20220710-5-RELEASE&tos=457&ssd=2&scd=100&vi=1657817938913&ri=f24e16cfb7beefcfe7dc8ac613faa288&sd=v2_65099d4a94f314b9492a16b876a220fa_0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2_1657817938_1657817939_CMC0lh8Qrbg9GOH3mO2fMCABKAEw4QE4kaQOQLDlD0j_ndsDUP8DWABgAGjsyrjT39zS1ipwAQ
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1006637/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-vcl-time-ms: 3
pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
via: 1.1 varnish
server: nginx
x-timer: S1657817939.378526,VS0,VE3
x-served-by: cache-ewr18127-EWR
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://apply.freedomfinancialnet.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: image/gif
x-cache-hits: 0

GET
H2

200

/ Show response
a1.adform.net/Serving/TrackPoint/
Redirect Chain

https://a1.adform.net/Serving/TrackPoint/?pm=2544792&ADFPageName=Campaign%20Index%20-%20Page%20Loaded&ADFdivider=%7C&ord=310446637221&Set1=en-US%7Cen-US%7C1600x1200%7C24&CPref=http%3A%2F%2Fbayareaa...
https://a1.adform.net/Serving/TrackPoint/?CC=1&pm=2544792&ADFPageName=Campaign%20Index%20-%20Page%20Loaded&ADFdivider=%7C&ord=310446637221&Set1=en-US%7Cen-US%7C1600x1200%7C24&CPref=http%3A%2F%2Fbay...

851 B
1 KB

7ms
7ms

Script
text/javascript

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.adform.net/Serving/TrackPoint/?CC=1&pm=2544792&ADFPageName=Campaign%20Index%20-%20Page%20Loaded&ADFdivider=%7C&ord=310446637221&Set1=en-US%7Cen-US%7C1600x1200%7C24&CPref=http%3A%2F%2Fbayareaace.com%2F&ADFtpmode=2&itm=eyJic3oiOjEsInN2MyI6ImFwcGx5LmZyZWVkb21maW5hbmNpYWxuZXQuY29tIiwic3Y0IjoiMDE4MWZkYTYzYjI2MDAxNDA1OTExZGE2NDE1MjAzMDczMDBmZDA2YjAwYjA4Iiwic3Y1IjoiMGU5ZWM5NzAtZDQxYi00NGY4LTk3MWQtMjkyNmEyOGRhYWE4Iiwic3Y2IjoiZThmMmZkNDMtMTE3Ny00OGYwLWJjZjQtM2JjMDg2ZTYwOTk1In0&loc=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffili

Requested by

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

d130da5a613c1a085236d316be61b48c716de40e3fbd8391edee28cfa460daca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 694
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
location: https://a1.adform.net/Serving/TrackPoint/?CC=1&pm=2544792&ADFPageName=Campaign%20Index%20-%20Page%20Loaded&ADFdivider=%7C&ord=310446637221&Set1=en-US%7Cen-US%7C1600x1200%7C24&CPref=http%3A%2F%2Fbayareaace.com%2F&ADFtpmode=2&itm=eyJic3oiOjEsInN2MyI6ImFwcGx5LmZyZWVkb21maW5hbmNpYWxuZXQuY29tIiwic3Y0IjoiMDE4MWZkYTYzYjI2MDAxNDA1OTExZGE2NDE1MjAzMDczMDBmZDA2YjAwYjA4Iiwic3Y1IjoiMGU5ZWM5NzAtZDQxYi00NGY4LTk3MWQtMjkyNmEyOGRhYWE4Iiwic3Y2IjoiZThmMmZkNDMtMTE3Ny00OGYwLWJjZjQtM2JjMDg2ZTYwOTk1In0&loc=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffili
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: text/html; charset=utf-8
expires: -1

GET
H2 200 /
www.google.com/pagead/1p-user-list/926516132/ 42 B
549 B 31ms
25ms Image
image/gif 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939303&cv=9&fst=1657814400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&fmt=3&is_vtc=1&random=2068607969&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/926516132/ 42 B
109 B 31ms
26ms Image
image/gif 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939307&cv=9&fst=1657814400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&fmt=3&is_vtc=1&random=3262837728&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/926516132/ 42 B
109 B 33ms
28ms Image
image/gif 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939308&cv=9&fst=1657814400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&fmt=3&is_vtc=1&random=4221459876&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/926516132/ 42 B
109 B 31ms
27ms Image
image/gif 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/926516132/?random=1657817939309&cv=9&fst=1657814400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&fmt=3&is_vtc=1&random=2951052869&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 30ms
17ms XHR
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1088227783&t=pageview&_s=1&dl=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&dr=http%3A%2F%2Fbayareaace.com%2F&dp=%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ul=en-us&de=UTF-8&dt=Campaign%20Index&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=4GBACUABBAAAAC~&jid=663354594&gjid=2117588867&cid=72618260.1657817939&tid=UA-131129682-26&_gid=656742064.1657817939&_r=1&cd1=freedomfinancialnet&cd2=ut4.47.202206272356&cd3=http%3A%2F%2Fbayareaace.com%2F&cd4=1657817938871.mpfkig2s&cd5=GA%20Page%20View%20-%20Virtual%20Page%20View&cd33=e8f2fd43-1177-48f0-bcf4-3bc086e60995&cd40=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&cd42=0e9ec970-d41b-44f8-971d-2926a28daaa8&gtm=2ou7d0&did=dYmQxMT&gdid=dYmQxMT&cd6=72618260.1657817939&z=445275156

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://apply.freedomfinancialnet.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 15ms
3ms Image
image/gif 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1088227783&t=pageview&_s=2&dl=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&dr=http%3A%2F%2Fbayareaace.com%2F&dp=%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ul=en-us&de=UTF-8&dt=Estimated%20Debt&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=4GBACUABBAAAAC~&jid=&gjid=&cid=72618260.1657817939&tid=UA-131129682-26&_gid=656742064.1657817939&cd1=freedomfinancialnet&cd2=ut4.47.202206272356&cd3=http%3A%2F%2Fbayareaace.com%2F&cd4=1657817939219.uxmwwxa&cd5=GA%20Page%20View%20-%20Virtual%20Page%20View&cd33=e8f2fd43-1177-48f0-bcf4-3bc086e60995&cd40=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&cd42=0e9ec970-d41b-44f8-971d-2926a28daaa8&gtm=2ou7d0&did=dYmQxMT&gdid=dYmQxMT&cd6=72618260.1657817939&z=1890694696

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::200e New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 14:01:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 10673
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixels Show response
c1.adform.net/imatch/ Frame 6452 5 KB
2 KB 201ms
6ms Document
text/html 185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Requested by

Host: a1.adform.net
URL: https://a1.adform.net/Serving/TrackPoint/?pm=2544792&ADFPageName=Campaign%20Index%20-%20Page%20Loaded&ADFdivider=%7C&ord=310446637221&Set1=en-US%7Cen-US%7C1600x1200%7C24&CPref=http%3A%2F%2Fbayareaace.com%2F&ADFtpmode=2&itm=eyJic3oiOjEsInN2MyI6ImFwcGx5LmZyZWVkb21maW5hbmNpYWxuZXQuY29tIiwic3Y0IjoiMDE4MWZkYTYzYjI2MDAxNDA1OTExZGE2NDE1MjAzMDczMDBmZDA2YjAwYjA4Iiwic3Y1IjoiMGU5ZWM5NzAtZDQxYi00NGY4LTk3MWQtMjkyNmEyOGRhYWE4Iiwic3Y2IjoiZThmMmZkNDMtMTE3Ny00OGYwLWJjZjQtM2JjMDg2ZTYwOTk1In0&loc=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffili

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

7f5863a79668b6932731a3deee623cfb63109180b485acbaeecc8c11f9d30f40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://apply.freedomfinancialnet.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 14 Jul 2022 16:58:59 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
H2 200 /
a1.seadform.net/serving/cookie/sync/ 35 B
336 B 129ms
6ms Image
image/gif 185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a1.seadform.net/serving/cookie/sync/?uid=2594886636168415069&stamp=j0yUKmD0JEUDvP-67D9Y4w2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 14 Jul 2022 16:58:59 GMT
cache-control: private
server: nginx
content-type: image/gif
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"

GET
H2 200 /
www.google.com/pagead/1p-user-list/998340879/ 42 B
109 B 27ms
25ms Image
image/gif 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939369&cv=9&fst=1657814400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&fmt=3&is_vtc=1&random=676069593&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/998340879/ 42 B
109 B 24ms
24ms Image
image/gif 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/998340879/?random=1657817939370&cv=9&fst=1657814400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7d0&sendb=1&data=event%3Dpage_view&frm=0&url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281&ref=http%3A%2F%2Fbayareaace.com%2F&tiba=Freedom%20Financial%20Network&async=1&fmt=3&is_vtc=1&random=3020141899&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 2 B
450 B 42ms
19ms XHR
text/plain 2607:f8b0:4004:c09::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-131129682-26&cid=72618260.1657817939&jid=663354594&gjid=2117588867&_gid=656742064.1657817939&_u=4GBACUAABAAAAC~&z=1443137567

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 14 Jul 2022 16:58:59 GMT
content-type: text/plain
access-control-allow-origin: https://apply.freedomfinancialnet.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 37ms
23ms Image
image/gif 2607:f8b0:4006:81e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-131129682-26&cid=72618260.1657817939&jid=663354594&_u=4GBACUAABAAAAC~&z=1296208842

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2004 New York, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 plf
c1.adform.net/imatch/ Frame 6452 0
262 B 7ms
6ms Image
text/plain 185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plff

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame 6452
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=42&external_user_id=2594886636168415069&Expiration=1659027539
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=2594886636168415069&Expiration=1659027539

43 B
424 B

13ms
13ms

Image
image/gif

52.204.250.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=2594886636168415069&Expiration=1659027539
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Server: 52.204.250.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-250-135.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 14 Jul 2022 16:58:59 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=2594886636168415069&Expiration=1659027539
date: Thu, 14 Jul 2022 16:58:59 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1 204
No Content m
ad.yieldlab.net/ Frame 6452 0
522 B 128ms
85ms Image
text/plain 23.217.46.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.yieldlab.net/m?dt_id=4879&ext_id=2594886636168415069

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.46.28 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-46-28.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jul 2022 16:58:59 GMT
x-content-type-options: nosniff
x-frame-options: DENY
Cache-Control: no-store,no-cache,max-age=-3600,must-revalidate,post-check=0,pre-check=0
Connection: keep-alive
x-xss-protection: 1; mode=block
x-application-context: application
Expires: Wed, 13 Jul 2022 16:58:59 GMT

GET
H/1.1 204
No Content token
token.rubiconproject.com/ Frame 6452 0
656 B 69ms
12ms Image
text/plain 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=5232&puid=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 6452
Redirect Chain

https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=2594886636168415069&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__
https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=2594886636168415069&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__&nut&uu=248d370c4fc54f609...
https://c1.adform.net/serving/cookie/match?party=9&uid=f82e736565e5d356f0b3f8c817fa4ef916c0d8ded7646199b46cf9e57eba21c0

35 B
469 B

6ms
6ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=9&uid=f82e736565e5d356f0b3f8c817fa4ef916c0d8ded7646199b46cf9e57eba21c0

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

location: https://c1.adform.net/serving/cookie/match?party=9&uid=f82e736565e5d356f0b3f8c817fa4ef916c0d8ded7646199b46cf9e57eba21c0
date: Thu, 14 Jul 2022 16:58:59 GMT
content-length: 0
p3p: CP=NOI PSA OUR

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 6452
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?partnerid=22&partneruserid=2594886636168415069&redirurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d10%26cid%3DSMART_USER_ID
https://c1.adform.net/serving/cookie/match?party=10&cid=4869644335841745454

35 B
469 B

9ms
6ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=10&cid=4869644335841745454

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

location: https://c1.adform.net/serving/cookie/match?party=10&cid=4869644335841745454
pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55944/ Frame 6452
Redirect Chain

https://ups.analytics.yahoo.com/ups/55944/sync?uid=2594886636168415069&_origin=1
https://ups.analytics.yahoo.com/ups/55944/sync?uid=2594886636168415069&_origin=1&verify=true

0
121 B

15ms
15ms

Image
text/plain

3.218.90.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55944/sync?uid=2594886636168415069&_origin=1&verify=true

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

3.218.90.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-90-66.compute-1.amazonaws.com

Software

ATS/9.1.0.46 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
server: ATS/9.1.0.46
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55944/sync?uid=2594886636168415069&_origin=1&verify=true
date: Thu, 14 Jul 2022 16:58:59 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK user-registering
ads.stickyadstv.com/ Frame 6452 43 B
670 B 264ms
6ms Image
image/gif 63.251.28.219
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=189&userId=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 63.251.28.219 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jul 2022 16:58:59 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
x-sticky-vk: 1657817939848076-53

GET
H2

200

put
e1.emxdgt.com/ Frame 6452
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=70&user_id=2594886636168415069
https://x.bidswitch.net/ul_cb/sync?dsp_id=70&user_id=2594886636168415069
https://e1.emxdgt.com/put?d=d21&uid=56fe4e91-9b13-4706-8c22-ec018dad3a34&gdpr=&gdpr_consent=

43 B
121 B

61ms
17ms

Image
image/gif

54.234.88.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e1.emxdgt.com/put?d=d21&uid=56fe4e91-9b13-4706-8c22-ec018dad3a34&gdpr=&gdpr_consent=
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Server: 54.234.88.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-88-163.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-length: 43
x-nosync: emp
content-type: image/gif

Redirect headers

Location: //e1.emxdgt.com/put?d=d21&uid=56fe4e91-9b13-4706-8c22-ec018dad3a34&gdpr=&gdpr_consent=
Date: Thu, 14 Jul 2022 16:58:59 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6452
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=2594886636168415069&expiration=1659027539
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=2594886636168415069&expiration=1659027539&C=1

43 B
950 B

47ms
37ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=2594886636168415069&expiration=1659027539&C=1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 72abce6b2d01191b-EWR
pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VepbyWP%2FJkeQUeeS99DsfpNTCLcqT1kr9L8v2nP8DK4TET6Uyvl1aO9yUn8kx1V1dYLNyyTYZwx5LY%2Fg%2FDmoWlqrRqIWo3hSdfU%2FTU1s5a7vf7nYVh9J5%2B5f9QN6IqTcto%2FNMU8hmMo%2BFg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=344wh2l0odbpHzZQNVB5YculmRWOB3yVDCxQTnf1HSllvHjrmzXZrQpjLEeVqdOcof9eEEMhyZ2WOZ5cMchJ35vBb%2Flaee%2FhjHSiUsaKUpVzXtlwzOo0KF80pxyTq7cnYdLOAVh%2BZlANLw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=111&external_user_id=2594886636168415069&expiration=1659027539&C=1
cache-control: no-cache
cf-ray: 72abce6aea93187d-EWR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H/1.1

200
OK

info2
uipglob.semasio.net/adform/1/ Frame 6452
Redirect Chain

https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=2594886636168415069&sInitiator=external
https://uipglob.semasio.net/adform/1/info2?sType=sync&sExtCookieId=2594886636168415069&sInitiator=external

42 B
604 B

26ms
25ms

Image
image/gif

50.57.31.206
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uipglob.semasio.net/adform/1/info2?sType=sync&sExtCookieId=2594886636168415069&sInitiator=external
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: HTTP/1.1
Server: 50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software: /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jul 2022 16:58:59 GMT
Frontend-ID: 13
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Type: image/gif
Content-Length: 42
Routing-Server-ID: -1
Expires: Sat, 01 Jan 2011 12:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 14 Jul 2022 16:58:59 GMT
Frontend-ID: 14
Location: /adform/1/info2?sType=sync&sExtCookieId=2594886636168415069&sInitiator=external
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Access-Control-Allow-Origin: *
UIP-Response-Status: Ok
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Length: 0
Routing-Server-ID: -1
Expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/ Frame 6452
Redirect Chain

https://ps.eyeota.net/match?uid=2594886636168415069&bid=9gdtmu1
https://ps.eyeota.net/match/bounce/?uid=2594886636168415069&bid=9gdtmu1

70 B
440 B

49ms
48ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?uid=2594886636168415069&bid=9gdtmu1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Thu, 14 Jul 2022 16:58:59 GMT
Content-Type: image/gif
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /match/bounce/?uid=2594886636168415069&bid=9gdtmu1
Date: Thu, 14 Jul 2022 16:58:59 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2 204 /
loadm.exelator.com/load/ Frame 6452 0
324 B 71ms
11ms Image
text/plain 34.229.3.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.229.3.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-229-3-43.compute-1.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

GET
H3

200

sync
pippio.com/api/ Frame 6452
Redirect Chain

https://idsync.rlcdn.com/398366.gif?partner_uid=2594886636168415069
https://idsync.rlcdn.com/1000.gif?memo=CJ6oGBIeChoIARCUdRoTMjU5NDg4NjYzNjE2ODQxNTA2ORAAGg0I05bBlgYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=499e95a30926cd48fadce2a071c5cd575691fc1f8b7ecda0c9a757e557deb681791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0OTllOTVhMzA5MjZjZDQ4ZmFkY2UyYTA3MWM1Y2Q1NzU2OTFmYzFmOGI3ZWNkYTBjOWE3NTdlNTU3ZGViNjgxNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0OTllOTVhMzA5MjZjZDQ4ZmFkY2UyYTA3MWM1Y2Q1NzU2OTFmYzFmOGI3ZWNkYTBjOWE3NTdlNTU3ZGViNjgxNzkxNDI2YjU0MTdkY2UyMRAAGgwI05bBlgYSBAgCEABCAEoA&goog...
https://usermatch.krxd.net/um/v2?partner=liveramp_identity
https://pippio.com/api/sync?pid=709973&it=1&iv=O9QEdpPR

42 B
59 B

47ms
47ms

Image
image/gif

107.178.254.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=709973&it=1&iv=O9QEdpPR
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H3
Server: 107.178.254.65 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 14 Jul 2022 16:58:59 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://pippio.com/api/sync?pid=709973&it=1&iv=O9QEdpPR
date: Thu, 14 Jul 2022 16:58:59 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a008-ash-prod.krxd.net

GET
H2

200

gdpr_consent=
sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=2594886636168415069/gdpr=/ Frame 6452
Redirect Chain

https://sync.crwdcntrl.net/map/c=6466/tp=ADFM/tpid=2594886636168415069/gdpr=/gdpr_consent=
https://sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=2594886636168415069/gdpr=/gdpr_consent=

49 B
544 B

46ms
46ms

Image
image/gif

34.196.96.235
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=2594886636168415069/gdpr=/gdpr_consent=
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Server: 34.196.96.235 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-96-235.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.40.11.45
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=2594886636168415069/gdpr=/gdpr_consent=
cache-control: no-cache
x-server: 10.40.37.22
content-length: 0
expires: 0

GET
H2 200 29729
tags.bluekai.com/site/ Frame 6452 62 B
428 B 127ms
87ms Image
image/gif 184.50.205.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/29729?id=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.50.205.90 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-205-90.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
content-length: 62
content-type: image/gif

GET
H3

200

sd
eu-u.openx.net/w/1.0/ Frame 6452
Redirect Chain

https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2594886636168415069
https://eu-u.openx.net/w/1.0/sd?cc=1&id=537113484&val=2594886636168415069

43 B
61 B

47ms
41ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?cc=1&id=537113484&val=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/485d39a /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
via: 1.1 google
server: OXGW/485d39a
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://eu-u.openx.net/w/1.0/sd?cc=1&id=537113484&val=2594886636168415069
date: Thu, 14 Jul 2022 16:58:59 GMT
via: 1.1 google
server: OXGW/485d39a
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1

200
OK

pixel.gif
s3-eu-west-1.amazonaws.com/adality-cdn-content/ Frame 6452
Redirect Chain

https://api.adrtx.net/thirdparty/click?p=adfo
https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif

35 B
390 B

344ms
96ms

Image
image/gif

52.218.112.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: HTTP/1.1
Server: 52.218.112.139 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Thu, 14 Jul 2022 16:59:01 GMT
Last-Modified: Thu, 29 Oct 2015 16:41:57 GMT
Server: AmazonS3
x-amz-request-id: EETJR74HD12VPZW7
ETag: "c2196de8ba412c60c22ab491af7b1409"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 35
x-amz-id-2: 2mwknxRbAb0/W3cQD85SsxoDEfEe5IORi+9a5i/EMn/5b/ZipLShTk1Tf6ztL6VurN0xopLP62A=

Redirect headers

X-Error-Reason: Missing UserId
Date: Thu, 14 Jul 2022 16:58:59 GMT
Server: akka-http/10.2.9
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 137

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame 6452
Redirect Chain

https://pixel.onaudience.com/?mapped=2594886636168415069&partner=68
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/tpid=a4e00959540e9c68/gdpr=1/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%...
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=75d436046e8c595c16c89502e56ad4e1&gdpr=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=1

70 B
264 B

12ms
11ms

Image
image/gif

3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=1
content-length: 0

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 6452 0
339 B 43ms
11ms Image
text/plain 75.101.130.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=adform&partner_uid=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.101.130.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-75-101-130-249.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
cache-control: private, no-cache, no-store
x-request-time: D=33 t=1657817939
x-served-by: beacon-n018-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
c1.adform.net/serving/cookie/match/ Frame 6452
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_cm&google_ula=1641347&party=1&google_hm=MjU5NDg4NjYzNjE2ODQxNTA2OQ
https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKUPihO4y4a5MoMWI0bz6BI&google_cver=1&google_ula=1641347,0

35 B
469 B

6ms
6ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKUPihO4y4a5MoMWI0bz6BI&google_cver=1&google_ula=1641347,0

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKUPihO4y4a5MoMWI0bz6BI&google_cver=1&google_ula=1641347,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
secure.adnxs.com/ Frame 6452
Redirect Chain

https://secure.adnxs.com/getuid?https://c1.adform.net/serving/cookie/match?party=3&id=$UID&redirect=1
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc1.adform.net%2Fserving%2Fcookie%2Fmatch%3Fparty%3D3%26id%3D%24UID%26redirect%3D1
https://c1.adform.net/serving/cookie/match?party=3&id=7910631169925372168&redirect=1
https://secure.adnxs.com/setuid?entity=91&code=2594886636168415069

43 B
1006 B

6ms
5ms

Image
image/gif

68.67.178.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/setuid?entity=91&code=2594886636168415069

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

HTTP/1.1

Server

68.67.178.15 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

633.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jul 2022 16:58:59 GMT
X-Proxy-Origin: 5.181.234.134; 5.181.234.134; 633.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: fe57b2bc-bda3-4a1f-8d14-b6c2e1da8b89
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
location: https://secure.adnxs.com/setuid?entity=91&code=2594886636168415069
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 plf
c1.adform.net/imatch/ Frame 6452 0
262 B 6ms
6ms Image
text/plain 185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plfm

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 6452 42 B
449 B 44ms
12ms Image
image/gif 8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:58 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK cs
pdw-adf.userreport.com/ Frame 6452 43 B
444 B 67ms
6ms Image
image/gif 13.225.214.93
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pdw-adf.userreport.com/cs
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-93.ewr50.r.cloudfront.net
Software: nginx/1.20.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 13 Jul 2022 19:06:49 GMT
Via: 1.1 f91b1dd39ce8309d7fc575add365607e.cloudfront.net (CloudFront)
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx/1.20.0
Age: 78730
X-Cache: Hit from cloudfront
Content-Type: image/gif
Connection: keep-alive
X-Amz-Cf-Pop: EWR50-C1
Content-Length: 43
X-Amz-Cf-Id: Ft82p8-mVHwUgR9A37-iOFo0f7AxztbWoRVqyyCjT89yjwiWcsBerw==

GET
H/1.1

200

p
a.audrte.com/ Frame 6452
Redirect Chain

https://a.audrte.com/a?adform_uid=2594886636168415069
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=&google_gid=CAESEIghbXpCQCQxXwOVz2NXvRI&google_cver=1
https://a.audrte.com/p

68 B
617 B

15ms
15ms

Image
image/png

54.81.7.162
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: HTTP/1.1
Server: 54.81.7.162 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-7-162.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Thu, 14 Jul 2022 16:58:59 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Thu, 14 Jul 2022 16:58:59 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 6452
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1586&dpuuid=2594886636168415069&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1586&dpuuid=2594886636168415069&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredire...
https://c1.adform.net/serving/cookie/match?party=1007&cid=37317337400621328102228328483156673726&noredirect=1

35 B
478 B

6ms
6ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=1007&cid=37317337400621328102228328483156673726&noredirect=1

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

DCS: dcs-prod-va6-1-v036-00e2b98e7.edge-va6.demdex.com 10 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: Rihk6PyNST4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://c1.adform.net/serving/cookie/match?party=1007&cid=37317337400621328102228328483156673726&noredirect=1
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 6452
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212269628&_puid=2594886636168415069
https://dmp.adform.net/serving/cookie/match/?party=1014&cid=214630604212376966005

35 B
469 B

26ms
5ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1014&cid=214630604212376966005

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
via: 1.1 7ac993fb3bf15971cbb8b39563ee70e0.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: EWR53-C1
location: https://dmp.adform.net/serving/cookie/match/?party=1014&cid=214630604212376966005
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
x-amz-cf-id: l8VobwFn10-wPxu_CHyXneJnGjV7AIChmRZ3t7Jwf6kxX4xsinqoNA==
expires: 0

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 6452
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1049%26cid%3D%25%25COOKIE%25%25
https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7120273835025954970

35 B
468 B

6ms
6ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7120273835025954970

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

Location: https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7120273835025954970
Date: Thu, 14 Jul 2022 16:59:00 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2 200 33302
tags.bluekai.com/site/ Frame 6452 62 B
427 B 73ms
73ms Image
image/gif 184.50.205.90
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/33302?id=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.50.205.90 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-205-90.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
content-length: 62
content-type: image/gif

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 6452
Redirect Chain

https://pixel.mathtag.com/sync/img?redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1066%26cid%3D%5BMM_UUID%5D
https://c1.adform.net/serving/cookie/match?party=1066&cid=d3e962d0-4b54-4e00-86ed-bd619ac707ab

35 B
478 B

6ms
5ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=1066&cid=d3e962d0-4b54-4e00-86ed-bd619ac707ab

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

Date: Thu, 14 Jul 2022 16:58:59 GMT
Server: MT3 4475 c1dc35a master iad-pixel-x7 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://c1.adform.net/serving/cookie/match?party=1066&cid=d3e962d0-4b54-4e00-86ed-bd619ac707ab
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Thu, 14 Jul 2022 16:58:58 GMT

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 6452
Redirect Chain

https://pm.w55c.net/ping_match.gif?st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_
https://pm.w55c.net/ping_match.gif?scc=1&st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_
https://c1.adform.net/serving/cookie/match?party=1084&cid=Ap0zggMp1Oc2b25

35 B
468 B

6ms
6ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=1084&cid=Ap0zggMp1Oc2b25

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

Pragma: no-cache
Date: Thu, 14 Jul 2022 16:58:59 GMT
Server: PingMatch/658332f#658332fc5aaa95d8a9be88d89d84d3c319923363 i-046b02221141da501@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Location: https://c1.adform.net/serving/cookie/match?party=1084&cid=Ap0zggMp1Oc2b25
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 6452
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=71ei9rr&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=71ei9rr&ttd_tpi=1
https://dmp.adform.net/serving/cookie/match/?party=1144&tdid=8ac6358c-a5a0-43a8-86ba-de53b54f2217

35 B
468 B

7ms
7ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1144&tdid=8ac6358c-a5a0-43a8-86ba-de53b54f2217

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dmp.adform.net/serving/cookie/match/?party=1144&tdid=8ac6358c-a5a0-43a8-86ba-de53b54f2217
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 225

GET
H/1.1

200
OK

image.sbmx
ib.mookie1.com/ Frame 6452
Redirect Chain

https://global.ib-ibi.com/image.sbmx?go=302927&pid=567&xid=2594886636168415069
https://ib.mookie1.com/image.sbmx?go=302927&pid=567&xid=2594886636168415069

0
421 B

395ms
72ms

Image
image/png

64.58.232.177
ASN-VINS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.mookie1.com/image.sbmx?go=302927&pid=567&xid=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: HTTP/1.1
Server: 64.58.232.177 , United States, ASN13649 (ASN-VINS, US),
Reverse DNS: be31-199.crrt01.las04.flexential.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 Jul 2022 16:59:00 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3p: CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
X-Server: LAS03
Content-Type: image/png
Content-Length: 0
Expires: -1

Redirect headers

Date: Thu, 14 Jul 2022 16:58:59 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Location: https://ib.mookie1.com:443/image.sbmx?go=302927&pid=567&xid=2594886636168415069
p3p: CP="DSP COR ADM DEV PSA PSD OUR"
Access-Control-Allow-Origin: *
Cache-Control: private
X-Server: LAS11
Content-Type: text/html; charset=utf-8
Content-Length: 204

GET
H/1.1

200

3.gif
id5-sync.com/cq/10/124/0/ Frame 6452
Redirect Chain

https://id5-sync.com/s/10/0.gif?puid=2594886636168415069
https://id5-sync.com/c/10/10/2/1.gif?puid=2594886636168415069&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/10/2/1/2.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/10/2/1/2.gif?puid=7910631169925372168&gdpr=0&gdpr_consent=
https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOCK2cOvOHgoldKuo-DES6rlbCfh-ngMJUtFRMNA&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F10%2F124%2F0%2F3.gif%3Fpuid%3D%...
https://id5-sync.com/cq/10/124/0/3.gif?puid=e979b045-41f0-4aad-bf24-0bf29b802d98&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

43 B
1 KB

86ms
86ms

Image
image/gif

141.95.98.65
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/cq/10/124/0/3.gif?puid=e979b045-41f0-4aad-bf24-0bf29b802d98&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

HTTP/1.1

Server

141.95.98.65 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:59:00 GMT
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

Redirect headers

location: https://id5-sync.com/cq/10/124/0/3.gif?puid=e979b045-41f0-4aad-bf24-0bf29b802d98&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
date: Thu, 14 Jul 2022 16:59:00 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 6452
Redirect Chain

https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D&bounce=1&random=2227959668
https://dmp.adform.net/serving/cookie/match/?party=1145&cid=.CsVKEd1tRpiGc1bJvUcHu

35 B
468 B

6ms
6ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1145&cid=.CsVKEd1tRpiGc1bJvUcHu

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:58:59 GMT
via: 1.1 google
last-modified: Thu, 14 Jul 2022 16:59:00 GMT
server: Weborama Collect Frontend
location: https://dmp.adform.net/serving/cookie/match/?party=1145&cid=.CsVKEd1tRpiGc1bJvUcHu
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 6452 23 B
287 B 76ms
19ms Image
image/gif 23.200.173.61
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=119&uid=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.173.61 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-173-61.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 14 Jul 2022 16:59:00 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H2

200

pixel.gif
sync.1dmp.io/ Frame 6452
Redirect Chain

https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=2594886636168415069
https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=2594886636168415069&cs=1

35 B
378 B

114ms
113ms

Image
image/gif

95.216.101.186
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=2594886636168415069&cs=1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Server: 95.216.101.186 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.186.101.216.95.clients.your-server.de
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: private, no-cache, no-store, no-cache=Set-Cookie, proxy-revalidate
server: nginx
content-type: image/gif
content-length: 35
expires: 0

Redirect headers

location: /pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=2594886636168415069&cs=1
date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: private, no-cache, no-store, no-cache=Set-Cookie, proxy-revalidate
server: nginx
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6452
Redirect Chain

https://s.ad.smaato.net/c/?dspInit=1001213&dspCookie=2594886636168415069
https://s.ad.smaato.net/c/?dspInit=1001213&dspCookie=2594886636168415069&cookieCheck=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=44&external_user_id=a1f6cd4

43 B
910 B

86ms
86ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=44&external_user_id=a1f6cd4
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray: 72abce6d79ba191b-EWR
pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r%2BoFaE1r%2F%2BEVVzzBseGh8DvSJj4J8XqRFY4Cyx94sWhum0rD6DFizPxJy2SuRN8s6AmWKOXl2qY4PsGI%2BDcq8U6YJUzv74iVpl4GgpxBRFy12g83z0OIZyxyGDhaMINS%2FnQhI9yqh7Ebcw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Thu, 14 Jul 2022 16:59:00 GMT
via: 1.1 95a7b3c60127f88f316c1c042cf353c2.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=44&external_user_id=a1f6cd4
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: 1c0M8FbDcEZcQ1sRv2APPhZ2BmnGGSFbfqruhVB_WB5_dv80Q2x-_A==

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 6452
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2032&partner_device_id=2594886636168415069&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DE...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2032&partner_device_id=2594886636168415069&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=620bde0d-d4a7-4eba-b5d3-03221e96e891%252Chttps%253A%252F%252Fc1.adform.net%252Fserving%252Fcookie%252Fmatch%253Fparty%253...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=8ac6358c-a5a0-43a8-86ba-de53b54f2217&ttd_puid=620bde0d-d4a7-4eba-b5d3-03221e96e891%2Chttps%3A%2F%2Fc1.adform.net%2Fservin...
https://c1.adform.net/serving/cookie/match?party=2007&cid=620bde0d-d4a7-4eba-b5d3-03221e96e891

35 B
468 B

6ms
5ms

Image
image/gif

185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=2007&cid=620bde0d-d4a7-4eba-b5d3-03221e96e891

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

location: https://c1.adform.net/serving/cookie/match?party=2007&cid=620bde0d-d4a7-4eba-b5d3-03221e96e891
date: Thu, 14 Jul 2022 16:59:00 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 200 2594886636168415069
match.contentexchange.me/adform/ Frame 6452 0
49 B 310ms
99ms Image
text/plain 46.19.11.36
SIEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.contentexchange.me/adform/2594886636168415069?redirect_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1219
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.19.11.36 , Slovenia, ASN51790 (SIEL, SI),
Reverse DNS: ilog.vsn.si
Software: nginx/1.16.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:59:00 GMT
content-length: 0
server: nginx/1.16.1

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame 6452 43 B
109 B 104ms
54ms Image
image/gif 52.200.119.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=16974&user_id=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.119.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-119-241.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:59:00 GMT
server: awselb/2.0
content-length: 43
content-type: image/gif

GET
H2

200

xuid
eb2.3lift.com/ Frame 6452
Redirect Chain

https://eb2.3lift.com/xuid?mid=7354&xuid=2594886636168415069&dongle=AD20
https://eb2.3lift.com/xuid?ld=1&mid=7354&xuid=2594886636168415069&dongle=AD20&gdpr=0&cmp_cs=&us_privacy=

37 B
354 B

13ms
13ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7354&xuid=2594886636168415069&dongle=AD20&gdpr=0&cmp_cs=&us_privacy=
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Server: 52.223.22.214 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7354&xuid=2594886636168415069&dongle=AD20&gdpr=0&cmp_cs=&us_privacy=
date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 put
e1.emxdgt.com/ Frame 6452 43 B
75 B 13ms
13ms Image
image/gif 54.234.88.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e1.emxdgt.com/put?d=d52&uid=2594886636168415069
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.234.88.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-234-88-163.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:58:59 GMT
content-length: 43
x-nosync: emp
content-type: image/gif

GET
H2 200 plf
c1.adform.net/imatch/ Frame 6452 0
261 B 6ms
6ms Image
text/plain 185.167.164.42
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plfl

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=2594886636168415069&agencyId=8164&advertiserId=2113733&src=tp&rnd=783965
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 16:59:00 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 204 unip Show response
trc-events.taboola.com/1006637/log/3/ 0
388 B 41ms
3ms XHR
text/plain 141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1006637/log/3/unip?en=pre_d_eng_tb&tos=1606&scd=100&ssd=2&est=1657817938917&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1657817940523&vi=1657817938913&ri=f24e16cfb7beefcfe7dc8ac613faa288&sd=v2_65099d4a94f314b9492a16b876a220fa_0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2_1657817938_1657817939_CMC0lh8Qrbg9GOH3mO2fMCABKAEw4QE4kaQOQLDlD0j_ndsDUP8DWABgAGjsyrjT39zS1ipwAQ&ui=0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2&ref=http%3A%2F%2Fbayareaace.com%2F&cv=20220710-5-RELEASE&item-url=https%3A%2F%2Fapply.freedomfinancialnet.com%2Fffn_4mp1%2Festimated-debt%3Futm_source%3D4_ffn_mp%26utm_medium%3Daffiliate%26utm_campaign%3D633%26utm_term%3D203930%26utm_adgroup%3D62b17f83386680b6d3979191555710fd%26match_type%3D41576_9260892_11%26utm_publisher%3D%26utm_content%3D92449799%26cake_requestid%3D91699281
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1006637/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

access-control-allow-origin: https://apply.freedomfinancialnet.com
pragma: no-cache
date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

POST
H2 201 certs Show response
api.trustedform.com/ 475 B
686 B 35ms
12ms XHR
application/json 3.230.219.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.trustedform.com/certs
Requested by: Host: api.trustedform.com
URL: https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.6229365290807762
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.230.219.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-219-164.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 6b8b873485b61bdfe06d46558f55f78f94ddcebcb0c7eb22c545e2e3aea540e0

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 14 Jul 2022 16:59:00 GMT
server: Cowboy
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 475

GET
H2 200 trustedform-1.8.26.js Show response
cdn.trustedform.com/ 97 KB
36 KB 5ms
5ms Script
application/javascript 2600:9000:21dd:e000:1c:7f1a:6680:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.trustedform.com/trustedform-1.8.26.js
Requested by: Host: api.trustedform.com
URL: https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&invert_field_sensitivity=false&sandbox=&l=0.6229365290807762
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:e000:1c:7f1a:6680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 33da22f0d9d8386d0028f02a1f0052807daae08d3d6f14eb47e7262735d9b98b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-amz-version-id: YhD1w8vOtRO5jDnJaxxF8bLdiuVEBdVt
content-encoding: gzip
last-modified: Tue, 10 May 2022 15:11:25 GMT
server: AmazonS3
age: 6
etag: W/"d9aa7fe810084b856ea5e1fed26caefa"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 968753ca270b3abbf31cdfc00e23b162.cloudfront.net (CloudFront)
date: Thu, 14 Jul 2022 16:58:59 GMT
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: MEeRBZuZlyqpkJCtOMCRN2pQO-cc6-6RjntANYPp7HNaJLB9Sh6L7A==

POST
H2 204 snapshot Show response
api.trustedform.com/certs/bd67147c8680a8371e2f972f4021d0d6712322d7/ 0
159 B 22ms
21ms XHR
text/plain 3.230.219.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.trustedform.com/certs/bd67147c8680a8371e2f972f4021d0d6712322d7/snapshot
Requested by: Host: cdn.trustedform.com
URL: https://cdn.trustedform.com/trustedform-1.8.26.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.230.219.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-219-164.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: Cowboy
access-control-expose-headers

GET
H2 200 freedomNetLogo.svg
images.ctfassets.net/b32zuu6bt176/2NPI7B9FLgFOzZymwweN43/395a29c2c937fd2c8ea2cb3404e02e28/ 8 KB
3 KB 8ms
8ms Image
image/svg+xml 2600:9000:210b:5a00:12:94b3:c380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.ctfassets.net/b32zuu6bt176/2NPI7B9FLgFOzZymwweN43/395a29c2c937fd2c8ea2cb3404e02e28/freedomNetLogo.svg
Requested by: Host: cdn.trustedform.com
URL: https://cdn.trustedform.com/trustedform-1.8.26.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:210b:5a00:12:94b3:c380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Contentful Images API /
Resource Hash: 3326c545962466a3fb88f385a11aeab929d0285d8af2977212b1fb05ba22a827

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 05:51:28 GMT
content-encoding: gzip
last-modified: Wed, 10 Mar 2021 16:37:23 GMT
server: Contentful Images API
age: 40053
etag: W/"2836945a60f880116f667b166b572957"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: NfaNj7qt1Rse0FJL_EzTOUXNzJuni_XfxBJkkJR80v1U8j_n6UVuhQ==
via: 1.1 34d691c1cf360a32817ace92de30761c.cloudfront.net (CloudFront)

GET
H2 200 phone-blue.svg
images.ctfassets.net/b32zuu6bt176/L8ulczF39D0kQfjda8qjz/516b9e34b52df818100e87029010810a/ 1 KB
995 B 5ms
5ms Image
image/svg+xml 2600:9000:210b:5a00:12:94b3:c380:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.ctfassets.net/b32zuu6bt176/L8ulczF39D0kQfjda8qjz/516b9e34b52df818100e87029010810a/phone-blue.svg
Requested by: Host: cdn.trustedform.com
URL: https://cdn.trustedform.com/trustedform-1.8.26.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:210b:5a00:12:94b3:c380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Contentful Images API /
Resource Hash: b432670c18a754142653e11119034e5c944ce6ec998f2ddea0315c0347201834

Request headers

accept-language: en-US,en;q=0.9
Referer: https://apply.freedomfinancialnet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 12:03:27 GMT
content-encoding: gzip
last-modified: Mon, 12 Oct 2020 17:36:54 GMT
server: Contentful Images API
age: 17734
etag: W/"ef069d02c9c612b8a2e8b27f3e6c35a4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
x-amz-cf-pop: EWR53-C3
x-amz-cf-id: QZtThjlZUZZv1CHRVkG654eEPqR35iRxqbDeQthw31vh-Weu_vCmsQ==
via: 1.1 34d691c1cf360a32817ace92de30761c.cloudfront.net (CloudFront)

POST
H2 204 fingerprints Show response
api.trustedform.com/certs/bd67147c8680a8371e2f972f4021d0d6712322d7/ 0
159 B 13ms
13ms XHR
text/plain 3.230.219.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.trustedform.com/certs/bd67147c8680a8371e2f972f4021d0d6712322d7/fingerprints
Requested by: Host: cdn.trustedform.com
URL: https://cdn.trustedform.com/trustedform-1.8.26.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.230.219.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-219-164.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.freedomfinancialnet.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Thu, 14 Jul 2022 16:59:00 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: Cowboy
access-control-expose-headers

GET
DATA 200
OK truncated
/ 10 KB
10 KB Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eed633a8002069e13f06351bfe014d0132941a0882144ccee95cdacfa403b954

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: text/javascript

Verdicts & Comments Add Verdict or Comment

86 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

111 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.taboola.com/bills-slw-debt/	1969-12-31 23:59:59	Name: taboola_session_id Value: v2_65099d4a94f314b9492a16b876a220fa_0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2_1657817938_1657817939_CMC0lh8Qrbg9GOH3mO2fMCABKAEw4QE4kaQOQLDlD0j_ndsDUP8DWABgAGjsyrjT39zS1ipwAQ
bayareaace.com/	1970-01-20 05:13:29	Name: clkcheck28062 Value: 62b17f83386680b6d3979191555710fd_203930
.ifatrk.com/	1969-12-31 23:59:59	Name: sid Value: Bno0aX2lzZPutjuTboRjsWwZz+W0wJYVKBiGDYxPjhJktmL3trVytA==
.ifatrk.com/	1970-01-20 22:02:56	Name: trk Value: DC4C+5IXCSjutjuTboRjsWwZz+W0wJYVKBiGDYxPjhJktmL3trVytA==
.ifatrk.com/	1970-01-20 05:13:29	Name: c633 Value: Bno0aX2lzZNQyWjBh52wqCotBq76+/aaMwdsnAOUj/U=
apply.freedomfinancialnet.com/	1970-01-20 04:33:10	Name: route Value: 1657817939.138.16826.246970
apply.freedomfinancialnet.com/	1970-01-20 05:13:29	Name: leadId Value: e8f2fd43-1177-48f0-bcf4-3bc086e60995
.taboola.com/	1970-01-20 13:15:53	Name: t_gid Value: 0a08dae3-8059-46ab-b4a6-d10e8c4473b7-tuct9c9d0d2
.freedomfinancialnet.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .freedomfinancialnet.com
.freedomfinancialnet.com/	1970-01-20 22:01:29	Name: _lc2_fpi Value: e5e630066617--01g7ytcf2weac9zb1q4jnxj5dt
.freedomfinancialnet.com/	1970-01-20 06:39:53	Name: _fbp Value: fb.1.1657817939057.1037966192
.freedomfinancialnet.com/	1970-01-20 06:39:53	Name: _gcl_au Value: 1.1.779752981.1657817939
.facebook.com/	1970-01-20 06:39:53	Name: fr Value: 0ExrURd8jkJsgZ1td..Bi0EtT...1.0.Bi0EtT.
.tiktok.com/	1970-01-20 13:51:53	Name: _ttp Value: 2BwX5msrQVkkvF0ovwOVvxcdXTi
.freedomfinancialnet.com/	1970-01-20 13:15:53	Name: utag_main Value: v_id:0181fda63b26001405911da641520307300fd06b00b08$_sn:1$_se:2$_ss:0$_st:1657819739212$ses_id:1657817938727%3Bexp-session$_pn:1%3Bexp-session
.liadm.com/	1970-01-20 22:01:29	Name: lidid Value: c8a1b1c3-7042-44d2-be87-e180717eb880
apply.freedomfinancialnet.com/	1970-01-20 04:30:17	Name: ADRUM_BT Value: R:268\|i:3508455\|g:e86e6d76-48fe-4c0b-a70d-69cb95c0c376375904\|e:23\|n:freedomfinancialnetwork_a940e162-1912-44f5-94bd-0a48a8253406
.freedomfinancialnet.com/	1970-01-20 13:51:53	Name: _tt_enable_cookie Value: 1
.freedomfinancialnet.com/	1970-01-20 13:51:53	Name: _ttp Value: 0125d46e-8dcf-43ff-8cac-37961e2dceb2
.freedomfinancialnet.com/	1970-01-20 13:15:53	Name: _hjSessionUser_2327048 Value: eyJpZCI6IjVmODY1OWJkLWY0YTktNWE3Zi1hMjUyLWIxMmZjNzMxZmQ5NSIsImNyZWF0ZWQiOjE2NTc4MTc5MzkxMDUsImV4aXN0aW5nIjpmYWxzZX0=
.freedomfinancialnet.com/	1970-01-20 04:30:19	Name: _hjFirstSeen Value: 1
apply.freedomfinancialnet.com/	1970-01-20 04:30:18	Name: _hjIncludedInSessionSample Value: 0
.freedomfinancialnet.com/	1970-01-20 04:30:19	Name: _hjSession_2327048 Value: eyJpZCI6Ijg2OTcwYzE4LTM3NTctNDU3Ni05ODE4LTcxYmFhYTQ3N2IwYSIsImNyZWF0ZWQiOjE2NTc4MTc5MzkyOTUsImluU2FtcGxlIjpmYWxzZX0=
.freedomfinancialnet.com/	1970-01-20 04:30:19	Name: _hjAbsoluteSessionInProgress Value: 0
.adform.net/	1970-01-20 05:14:56	Name: C Value: 1
.freedomfinancialnet.com/	1970-01-20 22:01:29	Name: _ga Value: GA1.2.72618260.1657817939
.freedomfinancialnet.com/	1970-01-20 04:31:44	Name: _gid Value: GA1.2.656742064.1657817939
.freedomfinancialnet.com/	1970-01-20 04:30:17	Name: _gat_gtag_UA_131129682_26 Value: 1
.adform.net/	1970-01-20 05:56:41	Name: uid Value: 2594886636168415069
.adform.net/	1970-01-20 04:31:44	Name: CM Value: 1\|1
.doubleclick.net/	1970-01-20 22:01:29	Name: IDE Value: AHWqTUlWij-IJKm1Ukpn32cTRrdoJhvLGWra34-W0V13tGnuDUSg-ASmBv1yfK1b
.seadform.net/	1970-01-20 05:56:41	Name: uid Value: 2594886636168415069
.adform.net/	1970-01-20 04:50:27	Name: CM14 Value: 1657904339_1657817939_1_Hu7u4e4e4R7u7u4REREeERERERHhEQ
.360yield.com/	1970-01-20 06:39:53	Name: tuuid Value: e979b045-41f0-4aad-bf24-0bf29b802d98
.360yield.com/	1970-01-20 06:39:53	Name: tuuid_lu Value: 1657817939
.yahoo.com/	1970-01-20 13:16:15	Name: A3 Value: d=AQABBFNL0GICEBfacszfoi7VkrpREPXcDRsFEgEBAQGc0WLaYgAAAAAA_eMAAA&S=AQAAAsgiXiR_jPYvDNqyZRhOyOo
.analytics.yahoo.com/	1970-01-20 13:15:53	Name: IDSYNC Value: 1760~260g
.casalemedia.com/	1970-01-20 13:15:53	Name: CMID Value: YtBLUzL1Kagc7fILEHNQMgAA
.casalemedia.com/	1970-01-20 06:39:53	Name: CMPS Value: 098
.casalemedia.com/	1970-01-20 06:39:53	Name: CMPRO Value: 098
.rubiconproject.com/	1970-01-20 13:15:53	Name: khaos Value: L5L9ZX0Q-1G-DYGN
.rubiconproject.com/	1970-01-20 13:15:53	Name: audit Value: 1\|8+YOMLC+HNLV7ycbBi28ifSBygMzh6Gei6xM8xSfZv/RuZ+dvyOZuAi4zjy5XYVPxaDjlPgC0MtCbuL7wqM7W8iEQX1ma3kMiEqLMLD9rgbyCgydvfDfguIrLQ0pP4bhcCygDcYSdD/OZF4C5xzkLg==
.bidswitch.net/	1970-01-20 13:15:53	Name: tuuid Value: 56fe4e91-9b13-4706-8c22-ec018dad3a34
.bidswitch.net/	1970-01-20 13:15:53	Name: c Value: 1657817939
.bidswitch.net/	1970-01-20 13:15:53	Name: tuuid_lu Value: 1657817939
.rlcdn.com/	1970-01-20 13:15:53	Name: rlas3 Value: faL6loVWBQTrnGoRYHUKLES2Mtl8Vn/rd2Z/1gzvVG8=
.yieldlab.net/	1970-01-20 13:15:53	Name: id Value: 1c069684-02c0-423e-a5c9-7a4ac05e9b1d
.eyeota.net/	1970-01-20 13:15:53	Name: mako_uid Value: 181fda63f34-4b050000010a5e81
.eyeota.net/	1970-01-20 04:30:18	Name: SERVERID Value: 24193~DM
.smartadserver.com/	1970-01-20 14:00:32	Name: pid Value: 4869644335841745454
.smartadserver.com/	1970-01-20 14:00:32	Name: TestIfCookieP Value: ok
.smartadserver.com/	1970-01-20 13:15:53	Name: csync Value: 22:2594886636168415069
.semasio.net/	1970-01-20 13:15:53	Name: SEUNCY Value: D8CE475709E788B3
.rlcdn.com/	1970-01-20 05:56:41	Name: pxrc Value: CNOWwZYGEgUI6AcQABIFCOhHEAA=
.openx.net/	1970-01-20 13:15:53	Name: i Value: 477c20b3-04cc-4d18-8054-f12b67ac19fd\|1657817939
.crwdcntrl.net/	1970-01-20 10:59:02	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-20 10:59:02	Name: _cc_id Value: 75d436046e8c595c16c89502e56ad4e1
.pippio.com/	1970-01-20 13:15:53	Name: did Value: aC7Ud8BxlvlvD4JP
.pippio.com/	1970-01-20 13:15:53	Name: didts Value: 1657817939
.pippio.com/	1970-01-20 05:56:41	Name: nnls Value:
.krxd.net/	1970-01-20 08:49:29	Name: _kuid_ Value: O9QEdpPR
.adnxs.com/	1970-01-20 06:39:53	Name: uuid2 Value: 7910631169925372168
.adnxs.com/	1970-01-20 06:39:53	Name: anj Value: dTM7k!M4/YD>6NRF']wIg2GU%H>?_3!@wnfH8K4YRH[@9=E'B<idx$Bgksdei-3EJi.$pX?[1/UODELzbpRzqF1`*b^nJ(6c)t
ads.stickyadstv.com/	1970-01-20 05:56:41	Name: uid-bp-617 Value: 2594886636168415069
ads.stickyadstv.com/	1970-01-20 05:13:29	Name: UID Value: 3442279c134c89b5bc667e18be70acc
ads.stickyadstv.com/	1969-12-31 23:59:59	Name: sessionId Value: 1dab74748c97b5f9e5afda1ece12e4c
.adscale.de/	1970-01-20 13:12:33	Name: uu Value: 248d370c4fc54f609ef4ce69cff966d4
.adscale.de/	1970-01-20 13:12:33	Name: cct Value: 1657817939856
.pubmatic.com/	1970-01-20 05:13:29	Name: KRTBCOOKIE_391 Value: 22924-2594886636168415069&KRTB&23263-2594886636168415069
.pubmatic.com/	1970-01-20 05:13:29	Name: PugT Value: 1657817938
.pippio.com/	1970-01-20 05:56:41	Name: pxrc Value: CNOWwZYGEgQIAhAAEgYI3awrEAA=
.demdex.net/	1970-01-20 08:49:29	Name: demdex Value: 37317337400621328102228328483156673726
.audrte.com/	1970-01-20 04:51:53	Name: arcki2_adform Value: 2594886636168415069!20210804!1657817939927
.audrte.com/	1970-01-20 04:40:22	Name: arcki2_TTT Value: 1657817939927!di2j0GI0gGvS3WKcBn7d-DtdA!H4sIAAAAAAAAAB2WSZIDIQwEH8NZESDEoucglv8/wdmek6fdBi2lLPk43tRURrldzJeKr5GlusXZ+85zRzpxondbkv0eqTFdloWLWhn6bI46eiqR9TXbPF0hdssRvy+Lnf5q2a/F81SeadPDTSuWWHSXqdwZPVzv7DaKJ83ZbpQh2k6TepWXzs5yWvhdezYiTFnN6l5LmjdiKrvIjBnSTh6tZAJzTdmI0GoTkuSkw6fpfsWbNX8r7LinNfeJ2abcvPYXU5OYvYtmbbMQUa492bX+7nB5uxWpbS+y4/Z3eu698kvraXOz5vZ4GpvAx5LZI0uftb5nUcg36W17+lbZl+wtLtcVAs/TY572bryW2jzllTAZs16K6V28RJGumaP3sjeJqcw769nSfVyuy088W5Z4fRcLLdU0jTn1jjxk8kmsHV7StoUv/R2NUm9JRc8IzZvrCm3pZsLRIU/P2br3GLMlW/6iriZ3zyc27FGnryIcf/PddcWkwW1G6JaMoKTa3QTeVQh4T7tn7TPS3VfHqejp1CFWMsXMOcu0d6pHm+uctC5yQlmy+ZOqJOalDYlszzP1fK+nq2evQQlrr6iga8jqo8l6+RH4qOesdL3kg05lrWoETgr0NcvKZZ0g+jlRQSmdIIfQBZW62xKEQQNz9loqP32RbotVvUwhbk66l5fOfpKt2mi1adWXmKinznXczks5uqzg4lv6vHG6v3fSu3v7ji9m6mDUWZiAKZnBe71cLZNiZt293od8/Qn13TIZJGkcczl332hpUthSEUh+VNzW46W8piy1+ZDJu/3TE5NZpknUOhmEWREd0TGyp4e2XGskpK2rW+X8Q8d4LLFblus5DEWqcd2yEZsopdddeQkqrN5CdLdtp9AX/YqpmstjzN9D49phQZ5NHpPZ24roeaUzzS7ipOKfCrbrN8FNfNsa5/WWr6d+lrfxAeNFg09ZZTWUl19tZaEBoJBGPi+MGUA3oAtBIoChxFTW9VCfNlOU9sn5cFJFvjem+PT8tTo3H9BLa9o95tJBYh3R2VFwOCDdfQcCzPoyJ2mdF5Zwfo9A44UGL/SA1s4YS09Zm5c0RziJD6MtfsnueBE/tLGdU2t5qXycq63SrEMJgC1o6lR87euv91F2Tzrac5Lmpg+sq3JdXS6t69DSKeGm4t17fNNSCtkbjyQG8hzdcssx31olaUPsXzMqR4sBAGLKiAKGzSD/OmqiciXIVTpzzknQ10efsnXYOn5eayWdVo/foM4tPrAS/froCx/KfW3B6AtY59qqDz7ND6xB71b+JvTls8w+4qXxUEQBYmd/8q3f9w8g5L7dwb6dZsknhY9SRJEOwIBf3id1UArFB+b4pnzbQDgmz8f4+PSVFaEGplajKIN206Ycm3+kDmKunze4Hl4quGA9SJnh7CTBbSrgtZIdZScVYjKk75vgb09EGjT7yngFPf2FPKltt2b3LdNiljbVdrUBSQFr/TzW+zhCT5tPKDS1YGUa3xTTsU121FDckFfHfFAfcs+WbNeen37Dz3DbQgAItUh7FXCM0rKuZHlvXSXgk6LhduG4H6Kv2EYrvcxt6dk+Zz4ijdGxskOdOnO1G4OGJfh+M11j/iGt7NPvx0zA+OiScc+YvIb60rFD7Umc0z5TnOAS8xDoVL0hOtqWbLZvSvnpRo/48ZOF7gnxzTl22cxXMoVUngvF/JipCg4rG0C9cSdqntyUEO21ZUX238oerAjcn4rjAJNafXN3lxfr/H4Gdba5sJUPCLSGtrgT7wGsF7XBTI39LTTtYmU+MGpmIhjWt1faZx9MGzP5iF87DfIzD36XJ8aGEZya+ohBvw+EyPRuYHV+YSa9qq8D5hUKfbNCZ0oAiFAeu8paC6Hi9cEC4IXVaM91rUFShtGRCvQExvw7VXd1rePV1FpfmBBmUHnTxuecSE0U8uSXOUtbwt9zBqUfTikmoPyuI8XsU5Efe0VO5RacFj1R+k/jwJyTuHjj5XkHYGdXYZ9ZjXXv5q/3D2dllDkTGCzMuGJDKbP8ODBBtK98HEd0+S2Bpehme293Juz/sFdWyfszIHYCqMN2R8/ryZ8yD1bmJBTvyT0ffb+2sRWy/fGF390Z4ZnGpbJ1Ask3/1Jh8ZuIauos9+RP6S/NZUvxK6iFvOumovGPnq1xMVfBCLMXrIMrIrVey2cwbAivuWwaWxizpj5StPj2ofPtjIx50/w5Aif5ug8R1Mt22PZl/fogudHbdzVWxEKykQZBB5319LyVRgbC2cjXJsCwPaTV5/ouUjmaaBTc45DxLWn2oQe2KX53gr2nxTE4zrYZeIPUyUJkB2b+dy7VAd3mY/O0dBjUytok2AcaryxJa9YvO4RSmJut9gOsAWE5/gsAAA==
.agkn.com/	1970-01-20 13:15:53	Name: ab Value: 0001%3A2TkxHzA7eEenwbJ7xPKz3KN3Nq3%2FKpXj
.mathtag.com/	1970-01-20 13:56:13	Name: uuid Value: d3e962d0-4b54-4e00-86ed-bd619ac707ab
.dpm.demdex.net/	1970-01-20 08:49:29	Name: dpm Value: 37317337400621328102228328483156673726
.ih.adscale.de/	1970-01-20 13:12:33	Name: tu Value: 4#1974785243#42~2594886636168415069~460504~0~0
.audrte.com/	1970-01-20 04:51:53	Name: arcki2_ddp Value: CAESEIghbXpCQCQxXwOVz2NXvRI!20210804!1657817939983
.audrte.com/	1970-01-20 04:51:53	Name: arcki2 Value: di2j0GI0gGvS3WKcBn7d-DtdA!20210804!1657817939998
.adsrvr.org/	1970-01-20 13:15:53	Name: TDID Value: 8ac6358c-a5a0-43a8-86ba-de53b54f2217
.onaudience.com/	1970-01-20 13:15:53	Name: cookie Value: a4e00959540e9c68
.onaudience.com/	1970-01-20 04:31:44	Name: done_redirects104 Value: 1
.smaato.net/	1970-01-20 05:00:32	Name: SCM Value: a1f6cd4
.smaato.net/	1970-01-20 04:45:25	Name: SCMie Value: a1f6cd4
.smaato.net/	1970-01-20 04:45:25	Name: SCM1001213 Value: a1f6cd4
.teads.tv/	1970-01-20 13:14:27	Name: tt_viewer Value: 05de19ec-92e0-4007-b6a0-cf2821f89058
.weborama.fr/	1970-01-20 13:56:13	Name: AFFICHE_W Value: lYHtrFry-aqV43
.onaudience.com/	1970-01-20 04:31:44	Name: done_redirects147 Value: 1
.tapad.com/	1970-01-20 05:56:41	Name: TapAd_TS Value: 1657817940120
.tapad.com/	1970-01-20 05:56:41	Name: TapAd_DID Value: 620bde0d-d4a7-4eba-b5d3-03221e96e891
.casalemedia.com/	1970-01-20 06:39:53	Name: CMTS Value: 144
.adfarm1.adition.com/	1970-01-20 06:39:53	Name: UserID1 Value: 7120273835025954970
.adsrvr.org/	1970-01-20 13:15:53	Name: TDCPM Value: CAESFAoFdGFwYWQSCwiggY7lhfHyOhAFGAEgASgCMgsIoPmQkpzx8joQBTgBWgV0YXBhZGAC
.3lift.com/	1970-01-20 06:39:53	Name: tluid Value: 1225459792955807120444
.tapad.com/	1970-01-20 05:56:41	Name: TapAd_3WAY_SYNCS Value: 1!4696
.id5-sync.com/	1970-01-20 04:30:18	Name: cf Value:
.id5-sync.com/	1970-01-20 04:30:18	Name: cip Value:
.id5-sync.com/	1970-01-20 04:30:18	Name: cnac Value:
.id5-sync.com/	1970-01-20 04:30:18	Name: car Value:
.id5-sync.com/	1970-01-20 04:30:18	Name: gdpr Value:
.id5-sync.com/	1970-01-20 04:30:18	Name: callback Value:
global.ib-ibi.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: p2pflobh5r3xryqyb2eecyc4
.w55c.net/	1970-01-20 14:00:32	Name: wfivefivec Value: Ap0zggMp1Oc2b25
.id5-sync.com/	1970-01-20 06:39:53	Name: id5 Value: cf4afbc6-f071-4adb-83cc-9220f530d86c#1657817940200#2
.1dmp.io/	1970-01-20 13:15:53	Name: uid Value: 41da80d1-0396-11ed-ad67-f832e4719dd9
.w55c.net/	1970-01-20 05:13:29	Name: matchadform Value: 5
.360yield.com/	1970-01-20 06:39:53	Name: um Value: !42,1As7q.FBwMUh7RflSIM18jUZtGfiQJd-NOGIXovjSl0H,1659027539!79,RDOP1xE1oPE1KvxKwy6jjmiXvO7WXqo30Lfl0SKxws1CQaAqzJXrAfWPtD7V3wefk1-j7wbdK4yQqDhJ,1665593940
.360yield.com/	1970-01-20 06:39:53	Name: umeh Value: !42,0,1720025939,-1!79,0,1720025940,-1
.id5-sync.com/	1970-01-20 06:39:53	Name: 3pi Value: 2#1657817940398#723467552#7910631169925372168\|10#1657817940289#236485101#2594886636168415069\|124#1657817940500#1336037912
ib.mookie1.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 13wfck2nstl3omxclletoeb1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.audrte.com
a1.adform.net
a1.seadform.net
aa.agkn.com
ad.360yield.com
ad.yieldlab.net
ads.stickyadstv.com
analytics.tiktok.com
api.adrtx.net
api.traversedlp.com
api.trustedform.com
apply.freedomfinancialnet.com
b-code.liadm.com
bayareaace.com
beacon.krxd.net
beatracks.com
bpi.rtactivate.com
c1.adform.net
cdn.taboola.com
cdn.trustedform.com
cds.taboola.com
cm.g.doubleclick.net
connect.facebook.net
dmp.adform.net
dpm.demdex.net
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
e1.emxdgt.com
eb2.3lift.com
eu-u.openx.net
fonts.googleapis.com
fonts.gstatic.com
global.ib-ibi.com
googleads.g.doubleclick.net
ib.adnxs.com
ib.mookie1.com
ice.360yield.com
id5-sync.com
idsync.rlcdn.com
ifatrk.com
ih.adscale.de
images.ctfassets.net
loadm.exelator.com
match.adsrvr.org
match.contentexchange.me
pdw-adf.userreport.com
pippio.com
pips.taboola.com
pixel.mathtag.com
pixel.onaudience.com
pixel.tapad.com
pm.w55c.net
ps.eyeota.net
redirect.frontend.weborama.fr
rp.liadm.com
rp4.liadm.com
rtb-csync.smartadserver.com
s.ad.smaato.net
s2.adform.net
s3-eu-west-1.amazonaws.com
script.anura.io
script.hotjar.com
secure.adnxs.com
signals.aimtell.com
simage2.pubmatic.com
static.hotjar.com
static.traversedlp.com
stats.g.doubleclick.net
sync.1dmp.io
sync.crwdcntrl.net
sync.teads.tv
tags.bluekai.com
tags.tiqcdn.com
token.rubiconproject.com
trc-events.taboola.com
trc.taboola.com
uipglob.semasio.net
ups.analytics.yahoo.com
usermatch.krxd.net
vars.hotjar.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
x.bidswitch.net
104.18.18.126
107.178.246.49
107.178.254.65
13.225.214.129
13.225.214.93
13.225.63.112
13.225.63.88
13.226.39.20
141.226.224.32
141.226.224.48
141.94.171.215
141.95.98.65
142.250.65.162
142.251.40.162
151.101.129.44
18.157.91.41
18.194.91.60
18.214.54.215
184.50.205.90
185.167.164.42
185.167.164.47
193.151.90.231
199.187.193.185
23.195.108.221
23.200.173.61
23.208.216.220
23.217.46.28
23.250.1.134
23.49.248.16
2600:1f18:730:b110:af35:be39:7aa6:3548
2600:9000:210b:5a00:12:94b3:c380:93a1
2600:9000:210b:f800:8:8845:1500:93a1
2600:9000:21da:1c00:1b:5138:8a40:93a1
2600:9000:21dd:e000:1c:7f1a:6680:93a1
2606:4700::6812:1e97
2607:f8b0:4004:c09::9b
2607:f8b0:4006:807::2003
2607:f8b0:4006:809::200e
2607:f8b0:4006:81e::2002
2607:f8b0:4006:81e::2004
2607:f8b0:4006:81e::200a
2607:f8b0:4006:821::2008
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42::300
3.212.2.215
3.218.90.66
3.230.219.164
3.33.220.150
34.134.212.62
34.192.2.145
34.196.96.235
34.207.39.23
34.229.3.43
34.98.64.218
35.190.24.218
35.190.60.146
35.211.178.172
46.19.11.36
50.57.31.206
52.17.154.165
52.20.189.152
52.200.119.241
52.204.250.135
52.218.112.139
52.22.224.209
52.223.22.214
54.230.163.70
54.234.88.163
54.81.154.5
54.81.7.162
63.251.28.219
64.58.232.176
64.58.232.177
68.67.160.75
68.67.178.15
69.173.151.100
75.101.130.249
8.28.7.83
85.114.159.93
95.216.101.186
019b77e9434f25334bf9ff220045d08b36cb49869a434fbcdda0b721819cf097
0614b885d83e2398d6d118f717c14f88eba98a973f3351f5536d246af8705d16
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0f62bfbc3e1a0bf22c38a2257c40201028707a4dc1ea76f690c2fefd4ef547e9
1007a1c62fd395647b6216220f5ad2119d31aebfded4bc897940dda41f4430c3
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
12161d164dc54ef18441632a392f120c085870b84070de922e6921fa91ed715b
17810b6ce0ce393416dcf42ab69acf86d22c5aefa5c7920f1d82e1ac21917a5d
1b467b2e5a13614556b2e39d7ae9c788f69a8a3169def8431fcf3b2eaaf0c96e
1eba8268d112d2903105c9b82da51799cd7467c382af9b3b94bcb41295d9c1dc
263d8420fa817c2800fa2b6cc49bf4fdec2ab34eaa7a8e10b564aec4d3a0a152
2673aac5b08bdec9074c0ad0d95d3b5ccc1efd175c01ffe4eac7ff0c98cf3103
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2ec5f4d31b86d22a8e32bf7c4b3a8c448e6edc54ddf2fa1d5842b37115875511
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
306094011fa17d1eb215263299126f9f95f50a1c2235c991846ccfd1911a6dce
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3326c545962466a3fb88f385a11aeab929d0285d8af2977212b1fb05ba22a827
33da22f0d9d8386d0028f02a1f0052807daae08d3d6f14eb47e7262735d9b98b
35c37816d291e9c8443f8616c2d663f3b953980dee0bdcdf2587f6a91877cc6d
36ab8944c1c56f83152606ac7efcf71168fcfa29c47bc773fbd6f9a40d22f39b
37f1021b1b8355050d47ce9c21eaa7bcd824445e21f0691ad7403e8aff9371c6
384e668a765ad88ee27d4937f0baeef54171ac9ec18791e839640ebb6bc29fc0
3ad3fefdb207753cf1f7f14c610030fd6b00660db09420776630d056c35a2c58
3c96b2793b00a4b3d098ba7e2fcf034f5e3f3404ad4f4e02f671f092456a359f
3c98c65185f0c687986fab5e2b66b56d7f89b896d1aa7dae48ccb466ee58ef46
4b3e77d3f559db1f98aa30a4259ec83ec2bc331ced4953db19d815ad391ad6c7
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d2ee1d209ef3357e321b265e74369e1d16c63e024e9fb6cb695bbc579eeb181
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5002432ec674c89be93f32abc7c0123fa83a449593a7b908201004eac0d6e441
52616f98c27f6812817d4433c6fe7a1b4e095647a3c95980a48ea6ee6576e6e6
52a5238b0ad1bd9998c64f5a161f80f2b65670097e9cb594ee8b7edb69efbdfa
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56181134088b2c4c736ca3bfbbde20d972ffdfdf5e45d8cbf1fd7efa5d3f5a55
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
62ef1af1c12468125dc1c5004a1787fd57058d0ea3a8d8f26b50b52713481ffa
680e209fc064b0b0a40c1a3e6da5cad23f971a0883e3d1c7f328894e2cd30ba8
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b8b873485b61bdfe06d46558f55f78f94ddcebcb0c7eb22c545e2e3aea540e0
6e0ef256271b4ace71542793c679cfa39a1f367ae293dc40a2e064c33daebda0
6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d
6f5757586f09df18c01d4088337777eb0811ca8148bd55dd47fe20bdc1ba33d4
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
70efe208587aa0220cbd71b13870394c06f90930540cbdfb677b1af997023bac
746e9296f4836e77d133c61ccbde902829bb2f9520de7701a716d8148c03ac8f
78f1b809f8aa7b7b1488f53c2a4e2f209f279c8c7e23991d6a6415ba289c5dd1
795697490194e742fe564de7f23df7361ee436f1aca2ce88eb1a95cbb9d9a257
7bee59805589126e21db95601706f843be3f8b62bd8ace4e7c5433f8382ebe09
7f5863a79668b6932731a3deee623cfb63109180b485acbaeecc8c11f9d30f40
825044f103b1f52d3e9e17e0ecb1c99d3ffa5d439eb483bfd05a89583f9a30f0
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
88487bbc94a8da6d3df5ff48ad198e4913c74422b1a60b682660ce3c023da23e
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e53ff1ed1e86e6e55ce41ddd909d8802b08b66ca24171ecae21c65b3da77c75
90438997aa817bad94f49d367b04dbaaaa387493ef5a1f5b5d5f7b953b76c1ac
935be36155c74981c8f8baf473058b6798ab14eafcf898fcf17c1fc7bb0c254a
93e7a60935c388108dde0d64432ca04a6fcf55df28cab3f3354a0e321fa34dad
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9c2bf9d2c79d17ddba927f5a78fb89775b4788223fd06c07aa1996dcdec0e848
9e15f2039b1402818b76d776dc46281f35fac541a921a0ec270ba9a9dbb1abd0
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a18e52d45296eb3927e641fa270c5ad0065ebc158e8b505968b8129a659d13c6
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2b95bcdd12b9623c208722b7f656ad774419635959a553fa48486ed51da480b
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
ad7b2b8fbc672cb7b3216642a3a8602e139889db62cfbe4c76bf0c2088ae858d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1e25155d2112219ee29424611bdb42fce0fcfead7732e8c6a503e4c95f8ea0e
b432670c18a754142653e11119034e5c944ce6ec998f2ddea0315c0347201834
b44a0bc72e8a00eb116add6082d59cac2da03ef3f5b7685cc7bf8fa8ec5b75ba
b7631bde4924a3225ae9befba3f31a2519417ea802cd298dfa9f2feab33adfda
b84bd412e2fa8adb61ca71806cfa75a7c8744c5439592bec244bfa932caa7cc9
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d12257b92ef493ab9af5dcaf620af8216d8f939a91797832efcb4c14b81c5c8a
d130da5a613c1a085236d316be61b48c716de40e3fbd8391edee28cfa460daca
d3e34c041aac1524fb49247eddcc5c5160f5d67a35fcb96024739273320aaa8c
d4edbbe1037c50c8ffa90860286c8166860ad9da450ed5e16a28e2fc9bce3c23
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de5341313a4dc5d982ca50ae4a491e84bc5e80b0f439d87f05fc3973c1b7e59a
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6572baea44da015c6c2e163c9319d10694fbbaed42058c40613f8c11f30659d
e8f40f61e8d5d6df7386668d2836bb947051fffbf965ab38bdb139e1bfde311c
eabe936530e880e1b5bedd91889b18e87de40c608a7058ccbcd900dc5a1473b6
ee94251fea8b03da5d0dc6f8489a529c1a2d2a031d874b0ec61866784e3c73c3
eed633a8002069e13f06351bfe014d0132941a0882144ccee95cdacfa403b954
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef3f3ac96c2e0a7fd71f775a4377413365aa63659423260bf2472bd419823532
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f339bf56ad8afee196e4fc0b372309b0182860243c807c6577f3a3d64fcc1a4c
f40a48dc2251da96bc1eeaf2cb86f6d5208464bb7109f4896eb1260b4e0f32f5
f5706fc18e80cc81f81e24d0b5eb7a41566cb681f6464b0bbf2fd81c15c24618
f9dca1c94230284259e7ecdc43283a907876a18978700c6b6198d36dd2703bb0
fb8ed37ef272d1f6e50f377bd275a7044286171a625d7377e026774efc3c0dfb
fd341e83be9e4ad1c0021b7f095715aee3c4931a8eba081a13c528249b752070
fedf1a833080dfd45892eee078eddee9fb8a74220093987613837e1b5c081829

apply.freedomfinancialnet.com Open in urlscan Pro 34.134.212.62 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

160 Requests

74 %HTTPS

20 %IPv6

68 Domains

86 Subdomains

61 IPs

9 Countries

1202 kBTransfer

3370 kBSize

111 Cookies

3 Outgoing links

Page URL History

Redirected requests

160 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

apply.freedomfinancialnet.com Open in urlscan Pro
34.134.212.62 Public Scan

Screenshot
Live screenshot

Full Image

160
Requests

74 %
HTTPS

20 %
IPv6

68
Domains

86
Subdomains

61
IPs

9
Countries

1202 kB
Transfer

3370 kB
Size

111
Cookies

160 HTTP transactions
1 data transactions