auth.savings.workingadvantage.com Open in urlscan Pro
104.18.39.111 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://fanduel.savings.workingadvantage.com/
Effective URL:
https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ff...
Submission: On October 26 via api (October 26th 2023, 3:17:49 pm UTC) from US — Scanned from DE

Summary HTTP 120 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 27 IPs in 5 countries across 20 domains to perform 120 HTTP transactions. The main IP is 104.18.39.111, located in and belongs to CLOUDFLARENET, US. The main domain is auth.savings.workingadvantage.com. The Cisco Umbrella rank of the primary domain is 887535.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 6th 2023. Valid for: a year.

This is the only time auth.savings.workingadvantage.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 28	104.18.39.111 104.18.39.111	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2a02:26f0:350... 2a02:26f0:3500:587::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
2	3.251.33.99 3.251.33.99	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
2	63.140.62.108 63.140.62.108	15224 (OMNITURE) (OMNITURE)
6	2001:4860:480... 2001:4860:4802:38::178	15169 (GOOGLE) (GOOGLE)
1	13.32.27.113 13.32.27.113	16509 (AMAZON-02) (AMAZON-02)
5	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c06::9d	15169 (GOOGLE) (GOOGLE)
1	18.66.122.42 18.66.122.42	16509 (AMAZON-02) (AMAZON-02)
1	199.38.167.54 199.38.167.54	54312 (ROCKETFUEL) (ROCKETFUEL)
1 2	185.89.210.180 185.89.210.180	29990 (ASN-APPNEX) (ASN-APPNEX)
1	52.21.113.158 52.21.113.158	14618 (AMAZON-AES) (AMAZON-AES)
2	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
3	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
1	54.225.208.88 54.225.208.88	14618 (AMAZON-AES) (AMAZON-AES)
2	2606:4700::68... 2606:4700::6812:1b32	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	172.64.150.236 172.64.150.236	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	66.235.152.115 66.235.152.115	15224 (OMNITURE) (OMNITURE)
1	2607:f5b7:1:5... 2607:f5b7:1:52::10	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
3	2a04:4e42:8e:... 2a04:4e42:8e::720	54113 (FASTLY) (FASTLY)
2	192.96.202.199 192.96.202.199	() ()
120	27

28 104.18.39.111 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

fanduel.savings.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
auth.savings.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a02:26f0:3500:587::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.251.33.99 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-251-33-99.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.62.108 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-108.data.adobedc.net

smetrics.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.113 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-113.fra56.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.42 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-42.fra60.r.cloudfront.net

cdn.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.38.167.54 (United States)

ASN54312 (ROCKETFUEL, US)

com-wag3.netmng.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.180 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.21.113.158 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-113-158.compute-1.amazonaws.com

people.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.247.241.14 (United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.225.208.88 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-208-88.compute-1.amazonaws.com

events.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1b32 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mouseflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.64.150.236 (United States)

ASN13335 (CLOUDFLARENET, US)

fanduel.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.115 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-66-235-152-115.data.adobedc.net

entertainmentbenefit.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f5b7:1:52::10 (United States)

ASN30633 (LEASEWEB-USA-WDC, US)

n2.mouseflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42:8e::720 (United States)

ASN54113 (FASTLY, US)

g3i.imgix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.96.202.199 (None, )

ASN- ()

n2.mouseflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	workingadvantage.com 3 redirects fanduel.savings.workingadvantage.com smetrics.workingadvantage.com — Cisco Umbrella Rank: 413086 auth.savings.workingadvantage.com — Cisco Umbrella Rank: 887535	2 MB
12	beneplace.com fanduel.savings.beneplace.com	24 KB
12	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 111	929 KB
12	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 626	334 KB
11	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 96 region1.google-analytics.com — Cisco Umbrella Rank: 1878	42 KB
6	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 778	263 KB
5	mouseflow.com cdn.mouseflow.com — Cisco Umbrella Rank: 11241 n2.mouseflow.com — Cisco Umbrella Rank: 44016 Failed	116 KB
4	gstatic.com fonts.gstatic.com	55 KB
3	imgix.net g3i.imgix.net — Cisco Umbrella Rank: 270675	113 KB
3	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 460	1 KB
3	boomtrain.com cdn.boomtrain.com — Cisco Umbrella Rank: 8292 people.api.boomtrain.com — Cisco Umbrella Rank: 8853 events.api.boomtrain.com — Cisco Umbrella Rank: 10661	31 KB
2	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 969	51 KB
2	adnxs.com 1 redirects secure.adnxs.com — Cisco Umbrella Rank: 806	2 KB
2	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 319	2 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 410	28 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 558	50 KB
1	omtrdc.net entertainmentbenefit.tt.omtrdc.net — Cisco Umbrella Rank: 281650	955 B
1	netmng.com com-wag3.netmng.com — Cisco Umbrella Rank: 229857	240 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 175	361 B
1	rezync.com live.rezync.com — Cisco Umbrella Rank: 2356	7 KB
120	20

	Domain	Requested by
18	fanduel.savings.workingadvantage.com	2 redirects fanduel.savings.workingadvantage.com
12	fanduel.savings.beneplace.com	auth.savings.workingadvantage.com
12	www.googletagmanager.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
12	assets.adobedtm.com	fanduel.savings.workingadvantage.com assets.adobedtm.com auth.savings.workingadvantage.com
10	auth.savings.workingadvantage.com	1 redirects fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
6	www.google-analytics.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
6	maps.googleapis.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
5	region1.google-analytics.com	www.googletagmanager.com
4	fonts.gstatic.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
3	g3i.imgix.net
3	n2.mouseflow.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
3	bam.nr-data.net	fanduel.savings.workingadvantage.com js-agent.newrelic.com auth.savings.workingadvantage.com
2	cdn.mouseflow.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
2	js-agent.newrelic.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
2	secure.adnxs.com	1 redirects fanduel.savings.workingadvantage.com
2	smetrics.workingadvantage.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
2	dpm.demdex.net	assets.adobedtm.com auth.savings.workingadvantage.com
2	cdnjs.cloudflare.com	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
2	cdn.jsdelivr.net	fanduel.savings.workingadvantage.com auth.savings.workingadvantage.com
1	entertainmentbenefit.tt.omtrdc.net	auth.savings.workingadvantage.com
1	events.api.boomtrain.com	fanduel.savings.workingadvantage.com
1	people.api.boomtrain.com	fanduel.savings.workingadvantage.com
1	com-wag3.netmng.com	fanduel.savings.workingadvantage.com
1	cdn.boomtrain.com	fanduel.savings.workingadvantage.com
1	stats.g.doubleclick.net	fanduel.savings.workingadvantage.com
1	live.rezync.com	fanduel.savings.workingadvantage.com
120	26

This site contains links to these domains. Also see Links.

Domain
fanduel.savings.beneplace.com

Subject Issuer	Validity	Valid
workingadvantage.com Cloudflare Inc ECC CA-3	`2023-07-06` - `2024-07-04`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
smetrics.workingadvantage.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-09` - `2024-08-08`	a year	crt.sh
*.rezync.com Amazon RSA 2048 M02	`2023-10-25` - `2024-11-21`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh
*.boomtrain.com Amazon RSA 2048 M02	`2023-02-09` - `2024-03-09`	a year	crt.sh
*.netmng.com Sectigo RSA Domain Validation Secure Server CA	`2023-01-23` - `2024-02-04`	a year	crt.sh
*.api.boomtrain.com Amazon RSA 2048 M03	`2023-09-16` - `2024-10-14`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-04-13` - `2024-05-14`	a year	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh
cdn.mouseflow.com Cloudflare Inc ECC CA-3	`2023-10-25` - `2024-10-23`	a year	crt.sh
beneplace.com Cloudflare Inc ECC CA-3	`2022-12-31` - `2023-12-31`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2023-08-22` - `2024-09-21`	a year	crt.sh
*.mouseflow.com Sectigo RSA Domain Validation Secure Server CA	`2023-08-28` - `2024-09-27`	a year	crt.sh
*.imgix.com GlobalSign Atlas R3 DV TLS CA 2023 Q1	`2023-03-05` - `2024-04-05`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
Frame ID: 696F5B8FF09A51F4680154BF7E919B18
Requests: 119 HTTP requests in this frame

Frame: https://fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/c359bc3d/main.js
Frame ID: C66B468BAFECE5976F4B1F90281028A2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FanDuel Group Marketplace

Page URL History Show full URLs

http://fanduel.savings.workingadvantage.com/ HTTP 301
https://fanduel.savings.workingadvantage.com/ Page URL
https://auth.savings.workingadvantage.com/auth/authorize?subdomain=fanduel&response_type=code&client_id=9ezalirn45mF43... HTTP 302
https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Mouse Flow (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.mouseflow\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

120
Requests

91 %
HTTPS

46 %
IPv6

20
Domains

26
Subdomains

27
IPs

5
Countries

3798 kB
Transfer

14128 kB
Size

26
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://fanduel.savings.beneplace.com/common/terms/of-use
Title: Terms and Conditions of Use

Search URL Search Domain Scan URL

URL: https://fanduel.savings.beneplace.com/common/policies/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://fanduel.savings.workingadvantage.com/ HTTP 301
https://fanduel.savings.workingadvantage.com/ Page URL
https://auth.savings.workingadvantage.com/auth/authorize?subdomain=fanduel&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F HTTP 302
https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://fanduel.savings.workingadvantage.com/ HTTP 301
https://fanduel.savings.workingadvantage.com/

Request Chain 25

https://fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/c359bc3d/main.js

Request Chain 36

https://secure.adnxs.com/seg?add=32509374&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2

120 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
fanduel.savings.workingadvantage.com/
Redirect Chain

http://fanduel.savings.workingadvantage.com/
https://fanduel.savings.workingadvantage.com/

10 KB
4 KB

254ms
168ms

Document
text/html

104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4cefa96e1215966aaf67cd962476b90c41a392fd494cc010351310644dc80ee

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 81c3aadf5c2d9c01-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
content-type: text/html; charset=utf-8
date: Thu, 26 Oct 2023 15:17:40 GMT
last-modified: Wed, 25 Oct 2023 01:22:51 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

CF-RAY: 81c3aade6c76362a-FRA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Thu, 26 Oct 2023 15:17:40 GMT
Expires: Thu, 26 Oct 2023 16:17:40 GMT
Location: https://fanduel.savings.workingadvantage.com/
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
alt-svc: h3=":443"; ma=86400

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 621 KB
151 KB 124ms
42ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0243c31edfa364b267018adb5220cf2ccc54e61f1b5a472fa7ba9cc6c1a4c984

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:46:59 GMT
server: AkamaiNetStorage
etag: "e33d264b6768a8b8fee1604b859d7748:1696974419.198914"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 154061
expires: Thu, 26 Oct 2023 16:17:40 GMT

GET
H2 200 new-relic-integration.js Show response
fanduel.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 163ms
161ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
last-modified: Wed, 25 Oct 2023 01:22:50 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65386dea-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 81c3aae07d559c01-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 146ms
61ms Stylesheet
text/css 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
Origin: https://fanduel.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 18647160
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230071-FRA, cache-bma1663-BMA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eS%2BR4IkBAPIokciKjzV0kL0pdUWeFO3bcAf9rBTZ7Ox1ybnKXRhFneCXIGCuBWToMCMrd61WP4BsL6GGU2YiOc0I%2F1cRc%2Bqh%2FLAjimawGx2JRZtE3ouTS1thydNG%2Fl4FZ2jx6hpNqp2LhZ6hDEE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 81c3aae0fca39162-FRA

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 243 KB
78 KB 157ms
69ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

9a9259e930e3dae8b97c60c968b0815db8d0382bb1f3ab236af138a211579e68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80001
x-xss-protection: 0

GET
H2 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 133ms
48ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 19317208
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RsD6k1Sp2nwAyGHV5HV1BxEhlFowHmRLWiAXPTg3FoR75d3yFzYi8pdMQykSHIR5FKlP1uHjkfokI%2FIuIcxvTBkToqaAmup2Y557KSitKhCVANG5LYk3yivXWkKzWzipuPMT0niPaKKXi2iCyuShl%2FCN"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 81c3aae0fb3d373d-FRA
expires: Tue, 15 Oct 2024 15:17:40 GMT

GET
H2 200 runtime-es2015.b04fffef486941b9e47d.js Show response
fanduel.savings.workingadvantage.com/ 4 KB
2 KB 158ms
157ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/runtime-es2015.b04fffef486941b9e47d.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6ef9ffffb88d08f27175148b71182885d3f5afd482cdd0dd819a7230dfc7a3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
Origin: https://fanduel.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 25 Oct 2023 01:20:08 GMT
server: cloudflare
content-encoding: br
etag: W/"65386d48-e1a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://fanduel.savings.workingadvantage.com, https://fanduel.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 81c3aae07d579c01-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 polyfills-es2015.75d458ddb35d2c6c96ea.js Show response
fanduel.savings.workingadvantage.com/ 143 KB
46 KB 168ms
168ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/polyfills-es2015.75d458ddb35d2c6c96ea.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f1403f29af77729e3caa999fb9e78ea109799e15e9cc13c9b6f5704e42ded13

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
Origin: https://fanduel.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 25 Oct 2023 01:20:12 GMT
server: cloudflare
content-encoding: br
etag: W/"65386d4c-23a44"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://fanduel.savings.workingadvantage.com, https://fanduel.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 81c3aae07d599c01-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.839823a06217b7c66e38.js Show response
fanduel.savings.workingadvantage.com/ 165 KB
53 KB 206ms
205ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/scripts.839823a06217b7c66e38.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf6df84cb37b5c853a3414f9878473bec61127f2168d9431131bbe0be589a335

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
last-modified: Wed, 25 Oct 2023 01:20:07 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65386d47-2957f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 81c3aae299112c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 main-es2015.4793c8498241675dedc6.js Show response
fanduel.savings.workingadvantage.com/ 5 MB
1021 KB 201ms
200ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/main-es2015.4793c8498241675dedc6.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c2304465e0076a791a63d6aecdc3efefdc44e67ca7b48fb1bfff1e3e1e1dae3

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
Origin: https://fanduel.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 25 Oct 2023 01:22:46 GMT
server: cloudflare
content-encoding: br
etag: W/"65386de6-50a3a4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://fanduel.savings.workingadvantage.com, https://fanduel.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 81c3aae07d5d9c01-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 230 KB
77 KB 155ms
69ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

931831f1ec6bc41c16ed704b2750760fbc4a4face4c8d52cda25b82fba183c9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78618
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 185 B
850 B 246ms
63ms XHR
application/json 3.251.33.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&d_coppa=true&ts=1698333460803

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.251.33.99 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-251-33-99.eu-west-1.compute.amazonaws.com

Software

Resource Hash

9f88bd0176930b98dd6f6f002b6fdee2c2a3cfecde738db8826e1df6089ce10f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v053-028cd0165.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: pqJ7HVy5SnU=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://fanduel.savings.workingadvantage.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 184
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 40ms
39ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
x-akamai-ew-subworker: 8096267
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Thu, 26 Oct 2023 16:17:40 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 43ms
42ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:40 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
x-akamai-ew-subworker: 8096267
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Thu, 26 Oct 2023 16:17:40 GMT

GET
H3 200 styles.76ee3d6b13884baf7097.css
fanduel.savings.workingadvantage.com/ 99 KB
17 KB 166ms
165ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/styles.76ee3d6b13884baf7097.css

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65b182304c6036dfb7e6ead8c6931a2fd13f2228bc868eb6e6674aac424f51de

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
last-modified: Wed, 25 Oct 2023 01:20:07 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65386d47-18b4c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 81c3aae299152c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 127ms
40ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
Origin: https://fanduel.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 17:37:58 GMT
x-content-type-options: nosniff
age: 164382
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Oct 2024 17:37:58 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 140ms
60ms XHR
application/json 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 id Show response
smetrics.workingadvantage.com/ 48 B
482 B 185ms
53ms XHR
application/x-javascript 63.140.62.108
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.workingadvantage.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&mid=35176477656560890932757554289484568657&cl=157680000&d_coppa=true&ts=1698333461078

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.108 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-108.data.adobedc.net

Software

jag /

Resource Hash

de8ad932a2b1a1859b67b97e14cd636dd214acaa3b7a08f898c4a695e48166a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 272 KB
90 KB 50ms
49ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

56d21399428b6e767b744a0c2e4668688db0cd8dfc185b125fe95669cc9580e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92447
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 127ms
39ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 26 Oct 2023 13:49:42 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 5279
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 26 Oct 2023 15:49:42 GMT

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
fanduel.savings.workingadvantage.com/api/ 7 KB
2 KB 469ms
468ms XHR
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/api/info

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

664cf9ddd63f0e68714dc6c16b7c70d7526e7282baa6b0fe146d02e5a319d9d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://fanduel.savings.workingadvantage.com/
tracestate: 88831@nr=0-1-2647367-1120218725-b11be0835b2a59e5----1698333461267
traceparent: 00-9e922eab77089f7e80ee5da0db8f1300-b11be0835b2a59e5-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImIxMWJlMDgzNWIyYTU5ZTUiLCJ0ciI6IjllOTIyZWFiNzcwODlmN2U4MGVlNWRhMGRiOGYxMzAwIiwidGkiOjE2OTgzMzM0NjEyNjcsInRrIjoiODg4MzEifX0=

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aae50cfc2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:40 GMT

GET
H3 200 marketplace-styles.css Show response
fanduel.savings.workingadvantage.com/api/fanduel/ 32 KB
5 KB 1114ms
1114ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/api/fanduel/marketplace-styles.css

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b1576aaf6d192bcd0e059cd15d3b68a183895909a41f473e1aaa0cb2919c41b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://fanduel.savings.workingadvantage.com/
tracestate: 88831@nr=0-1-2647367-1120218725-6b61cadb38427510----1698333461268
traceparent: 00-750176d774acd6320e8570e60cbc1900-6b61cadb38427510-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjZiNjFjYWRiMzg0Mjc1MTAiLCJ0ciI6Ijc1MDE3NmQ3NzRhY2Q2MzIwZTg1NzBlNjBjYmMxOTAwIiwidGkiOjE2OTgzMzM0NjEyNjgsInRrIjoiODg4MzEifX0=

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8128-ieekTvxwGihSJtxj0D9Ar83ZC7g"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aae50d042c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H3 200 colors.css Show response
fanduel.savings.workingadvantage.com/api/fanduel/ 3 KB
836 B 838ms
838ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/api/fanduel/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3886c5ae4348a2bc69a71cbf779880b8899dff1412fe2dd2d7e2711bad9cfc3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://fanduel.savings.workingadvantage.com/
tracestate: 88831@nr=0-1-2647367-1120218725-fd14f9f85712dd89----1698333461268
traceparent: 00-87ef9fee7d2e5271f332a7681145a200-fd14f9f85712dd89-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImZkMTRmOWY4NTcxMmRkODkiLCJ0ciI6Ijg3ZWY5ZmVlN2QyZTUyNzFmMzMyYTc2ODExNDVhMjAwIiwidGkiOjE2OTgzMzM0NjEyNjgsInRrIjoiODg4MzEifX0=

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"aa2-AixcMtMEVOtUBtfgO9XF5S9/vBw"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aae50d072c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H2 200 RCea9d317d3a374e44b3f0f8711e38765e-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/ 2 KB
1020 B 43ms
43ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/RCea9d317d3a374e44b3f0f8711e38765e-source.min.js
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f92af17b23f77c222229cf069ee967e0786a95665bd87cbfc984fe3de13c3ea0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:46:59 GMT
server: AkamaiNetStorage
etag: "7e9b95127b86f5b4657a8a4d1840ccc1:1696974419.9836"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 750
expires: Thu, 26 Oct 2023 16:17:41 GMT

GET
H3

200

main.js Show response
fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/c359bc3d/ Frame C66B
Redirect Chain

https://fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/c359bc3d/main.js

7 KB
3 KB

52ms
52ms

Script
application/javascript

104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/c359bc3d/main.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d44f0ab25b413b56b8047b2723ca1769e1802a791f279557eb6e812838c89e4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 81c3aae5ce302c1a-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Thu, 26 Oct 2023 15:17:41 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/c359bc3d/main.js
cache-control: max-age=300, public
cf-ray: 81c3aae54d652c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 sync Show response
live.rezync.com/ 6 KB
7 KB 290ms
189ms Script
text/javascript 13.32.27.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=5ef4f9c1e806678f2ab0275df01d5ff4&zmpID=ebg-wag3&cache_buster=1698333461386&k=ebg-wag3-pixel-0988
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-113.fra56.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: 56e4748204cced6882dad4656534f385ee520fac7a51c3c0b648b8c719ff845c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
via: 1.1 84f381696dd33e92960b92250106e464.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 6376
x-amz-cf-id: lJk7D2hbyXkO1PNYMSQvBXUAtIdlhpfasE331-ADhMs11XNBC8-P2g==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
237 B 51ms
51ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1630001433&t=pageview&_s=1&dl=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=1821204360&gjid=360502834&cid=715138408.1698333461&tid=UA-2876877-9&_gid=1196957923.1698333461&_r=1&_slc=1&gtm=45He3an0n815QN8HWMv78847533&gcd=11l1l1l1l1&z=1690334615

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1da6ad9dfce9466037ec92e1f7699158c9a9347c669333c724f5cf6f3a7c0634

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
260 B 135ms
47ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je3an0v9112553684z878847533&_p=1630001433&gcd=11l1l1l1l1&cid=715138408.1698333461&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1698333461&sct=1&seg=0&dl=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&_fv=1&_ss=1&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&up.pb_site_name=fanduel&up.page_path=%2F&up.user_id_value=&up.zip_code=NaN
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:41 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 81c3aadf5c2d9c01 Show response
fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame C66B 0
304 B 65ms
63ms XHR
text/plain 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/jsd/r/81c3aadf5c2d9c01

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 81c3aae6cfd62c1a-FRA
alt-svc: h3=":443"; ma=86400

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
361 B 166ms
55ms XHR
text/plain 2a00:1450:400c:c06::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-2876877-9&cid=715138408.1698333461&jid=1821204360&gjid=360502834&_gid=1196957923.1698333461&_u=YEBAAEAAAAAAACAAI~&z=5605619

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 26 Oct 2023 15:17:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 253 KB
85 KB 63ms
63ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d7cda308070a79c063aaa524b74a119904c4c1480e2ec35ea43f5ded3f2ef4a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86825
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/ebg-wag3/ 93 KB
30 KB 157ms
48ms Script
application/javascript 18.66.122.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/ebg-wag3/p13n.min.js
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-42.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6657dc9f6ee9fef340fa05ea4110332efb39d8f4e0d7da0aa080b59691eb53ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-amz-version-id: ZG.w.l49O_ew7ONL.VJfy_bYdRjSIbb_
Content-Encoding: gzip
Via: 1.1 d71acb203a3e8fc7db2c1cf9725d51da.cloudfront.net (CloudFront)
Date: Thu, 26 Oct 2023 14:49:37 GMT
X-Amz-Cf-Pop: FRA60-P2
Age: 1684
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Tue, 24 Oct 2023 04:34:10 GMT
Server: AmazonS3
ETag: W/"6f20e9c72330eb507ebd90a9fe7026e5"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: zeSsp1JuOkLzVLRJiHlnfAJFe5bR9zqKzPWBFdvWVWXjbsTDJUrlOw==

GET
H/1.1 200
OK / Show response
com-wag3.netmng.com/ 0
240 B 551ms
119ms Script
text/html 199.38.167.54
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://com-wag3.netmng.com/?aid=6366&siclientid=105368&url=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&p5=&p6=&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.38.167.54 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Thu, 26 Oct 2023 15:17:42 GMT
X-Cnection: close
Content-Encoding: gzip
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 190 KB
68 KB 53ms
53ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-12084042

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6dccf5082015b8556b15e6a21a619a18edc552cad62aac0f6f7e53cff8e78d55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69997
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 190 KB
68 KB 62ms
61ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-12084042&l=dataLayer&cx=c

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

adabc9c64246a50454043d3dbfa223bf968f62aa789483f5a960d7581847b2fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70039
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?add=32509374&t=2
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2

43 B
840 B

46ms
45ms

Image
image/gif

185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/

Protocol

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:41 GMT
an-x-request-uuid: ddef24b8-9743-4f92-9ac0-46fe38ee590f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.100; 80.255.7.100; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:41 GMT
an-x-request-uuid: 26a652a2-23c9-4f51-9a0b-e3af3e94b03a
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2
x-proxy-origin: 80.255.7.100; 80.255.7.100; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
45 B 47ms
46ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je3an0v9126564266&_p=1630001433&gcd=11l1l1l1l2&ul=en-us&sr=1600x1200&cid=715138408.1698333461&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&sid=1698333461&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:41 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 fanduel Show response
fanduel.savings.workingadvantage.com/api/controls/ 2 KB
1 KB 180ms
180ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/api/controls/fanduel

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d733e0f556966c0783cd8d7fa304ea033509c93a202167e84fd337681ca1a94b

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://fanduel.savings.workingadvantage.com/
tracestate: 88831@nr=0-1-2647367-1120218725-6f6b23d15dadba9d----1698333461743
traceparent: 00-742f09e4c74a30c39a35214dbeae9500-6f6b23d15dadba9d-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjZmNmIyM2QxNWRhZGJhOWQiLCJ0ciI6Ijc0MmYwOWU0Yzc0YTMwYzM5YTM1MjE0ZGJlYWU5NTAwIiwidGkiOjE2OTgzMzM0NjE3NDMsInRrIjoiODg4MzEifX0=

Response headers

date: Thu, 26 Oct 2023 15:17:41 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"802-v9eGn7h9ufcBa7plcRSLDwfQUn4"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aae809d82c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:40 GMT

GET
H/1.1 200
OK resolve Show response
people.api.boomtrain.com/identify/ 142 B
457 B 599ms
160ms XHR
application/json 52.21.113.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/identify/resolve?data=eyJjb29raWUiOnsiYnNpbiI6IiJ9LCJxdWVyeXN0cmluZyI6e30sImV4dGVybmFsX2lkcyI6eyJ6eW5jIjoiYThhOGI1NjItZTY2ZC00ZjE3LWJlOWYtOTg3MWEyY2RjYzM3OjE2OTgzMzM0NjEuNTgwNTU4NSJ9fQ%3D%3D&site_id=ebg-wag3
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.21.113.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-21-113-158.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 7d71ff454224cb861240d15be7804dd7cfdd2cc085826ab9d7ed26b23d5492ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Thu, 26 Oct 2023 15:17:42 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 142

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
26 KB 129ms
41ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Thu, 26 Oct 2023 15:17:42 GMT
strict-transport-security: max-age=300
x-amz-request-id: 32QGWQ2Q8YXX70QC
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: 4mlkuD+JDth4wo/QBMctxAliSNTUsTApT5L8+f4cLmgB3l+45PsvOvXZA+c1qr+RAGpR2S5FDiI=
x-served-by: cache-fra-eddf8230033-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
x-timer: S1698333462.341580,VS0,VE0
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 4022

GET
H3 200 onetrust Show response
fanduel.savings.workingadvantage.com/api/platform/options/ 501 B
729 B 237ms
236ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/api/platform/options/onetrust

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05f687735d78286be14d4e10a1fb29138cddcf927835e5441b61406512db7c8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://fanduel.savings.workingadvantage.com/
tracestate: 88831@nr=0-1-2647367-1120218725-92ad12cb384d3c26----1698333462403
traceparent: 00-01e537dbeb1b34ad598952a280bf9e00-92ad12cb384d3c26-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjkyYWQxMmNiMzg0ZDNjMjYiLCJ0ciI6IjAxZTUzN2RiZWIxYjM0YWQ1OTg5NTJhMjgwYmY5ZTAwIiwidGkiOjE2OTgzMzM0NjI0MDMsInRrIjoiODg4MzEifX0=

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f5-7p9slVTH/yNu6/xY0Gl0Ekd5Wds"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaec28982c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H3 200 info
fanduel.savings.workingadvantage.com/api/ 8 KB
3 KB 248ms
247ms XHR
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/api/info?authInfo=true

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://fanduel.savings.workingadvantage.com/
tracestate: 88831@nr=0-1-2647367-1120218725-1329c7a6560173a7----1698333462405
traceparent: 00-468cf8f92be58c1c2e08a1d1e868bc00-1329c7a6560173a7-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjEzMjljN2E2NTYwMTczYTciLCJ0ciI6IjQ2OGNmOGY5MmJlNThjMWMyZTA4YTFkMWU4NjhiYzAwIiwidGkiOjE2OTgzMzM0NjI0MDUsInRrIjoiODg4MzEifX0=

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaec289b2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 40ms
39ms Image
image/gif 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1630001433&t=pageview&_s=1&dl=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=FanDuel%20Group%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAACAAI~&jid=&gjid=&cid=715138408.1698333461&tid=UA-2876877-9&_gid=1196957923.1698333461&gtm=45He3an0n815QN8HWMv78847533&gcd=11l1l1l1l1&z=1384938318

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 08:50:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23225
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/1/ 40 B
485 B 418ms
287ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2280&ck=0&s=162910da6e1f074b&ref=https://fanduel.savings.workingadvantage.com/&af=err,xhr,stn,ins,spa&be=379&fe=1705&dc=752&perf=%7B%22timing%22:%7B%22of%22:1698333460150,%22n%22:0,%22f%22:125,%22dn%22:126,%22dne%22:126,%22c%22:126,%22s%22:165,%22ce%22:210,%22rq%22:210,%22rp%22:379,%22rpe%22:380,%22di%22:734,%22ds%22:1119,%22de%22:1131,%22dc%22:2082,%22l%22:2082,%22le%22:2084%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
content-type: text/plain

Response headers

Date: Thu, 26 Oct 2023 15:17:42 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://fanduel.savings.workingadvantage.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 81c3aaed2f34037c-FRA
Content-Length: 40

POST
H2 200 track
events.api.boomtrain.com/event/ 2 B
209 B 429ms
149ms XHR
text/plain 54.225.208.88
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.208.88 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-208-88.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Thu, 26 Oct 2023 15:17:42 GMT
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain

GET
H3 200 gtm.js
www.googletagmanager.com/ 230 KB
77 KB 59ms
58ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78506
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Oct 2023 15:17:42 GMT

GET
H3 200 js
www.googletagmanager.com/gtag/ 185 KB
67 KB 66ms
66ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2876877-9

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68582
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Oct 2023 15:17:42 GMT

GET
H3 200 mouseflow
fanduel.savings.workingadvantage.com/api/platform/options/ 94 B
493 B 165ms
164ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.workingadvantage.com/api/platform/options/mouseflow?name=workingadvantage_mouseflow_script_id

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://fanduel.savings.workingadvantage.com/
tracestate: 88831@nr=0-1-2647367-1120218725-c65ff25c77e43f16----1698333462644
traceparent: 00-b80ee65680a9b664b441a74b9c698300-c65ff25c77e43f16-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImM2NWZmMjVjNzdlNDNmMTYiLCJ0ciI6ImI4MGVlNjU2ODBhOWI2NjRiNDQxYTc0YjljNjk4MzAwIiwidGkiOjE2OTgzMzM0NjI2NDQsInRrIjoiODg4MzEifX0=

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"5e-xWERRy+8FVp8nFwecehLclRX7Go"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://fanduel.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaedaaf32c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:41 GMT

GET
H3

200

Primary Request sign-in Show response
auth.savings.workingadvantage.com/fanduel/
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=fanduel&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F

11 KB
3 KB

165ms
164ms

Document
text/html

104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/main-es2015.4793c8498241675dedc6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3b83ced5629150dbea6190afe5ad44feaef7987587aa905a7254ee701c2a3a0

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://fanduel.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 81c3aaef1d572c1a-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
content-type: text/html; charset=utf-8
date: Thu, 26 Oct 2023 15:17:43 GMT
last-modified: Wed, 25 Oct 2023 01:27:26 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 81c3aaedd9ca9c01-FRA
content-type: text/html; charset=utf-8
date: Thu, 26 Oct 2023 15:17:42 GMT
expires: Thu, 26 Oct 2023 15:17:41 GMT
location: /fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H2 200 RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/ 451 B
555 B 41ms
41ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:46:59 GMT
server: AkamaiNetStorage
etag: "7e9b95127b86f5b4657a8a4d1840ccc1:1696974419.9836"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 285
expires: Thu, 26 Oct 2023 16:17:42 GMT

GET
H2 200 RC0c16579d5c704bd0a214633d669d35f2-source.min.js
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/ 1018 B
816 B 42ms
41ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/RC0c16579d5c704bd0a214633d669d35f2-source.min.js
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:46:59 GMT
server: AkamaiNetStorage
etag: "7e9b95127b86f5b4657a8a4d1840ccc1:1696974419.9836"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 546
expires: Thu, 26 Oct 2023 16:17:42 GMT

GET
H2 200 07e508d2-aee2-481f-ac8e-6e200d46af80.js
cdn.mouseflow.com/projects/ 195 KB
58 KB 155ms
49ms Script
application/javascript 2606:4700::6812:1b32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mouseflow.com/projects/07e508d2-aee2-481f-ac8e-6e200d46af80.js

Requested by

Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1b32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 104874
x-cache-status: HIT
x-mf-script: EU
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 23 Oct 2023 08:31:17 GMT
server: cloudflare
etag: W/"206de44a8b5da1:0"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
cf-ray: 81c3aaef5dd89ba4-FRA
expires: Fri, 27 Oct 2023 15:17:42 GMT

GET
H2 200 RC668a267ca36c45b5acca38f3e4360a76-source.min.js
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/ 340 B
484 B 45ms
45ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/RC668a267ca36c45b5acca38f3e4360a76-source.min.js
Requested by: Host: fanduel.savings.workingadvantage.com
URL: https://fanduel.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fanduel.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:42 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:46:59 GMT
server: AkamaiNetStorage
etag: "7e9b95127b86f5b4657a8a4d1840ccc1:1696974419.9836"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://fanduel.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Thu, 26 Oct 2023 16:17:42 GMT

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET init
n2.mouseflow.com/ 0
0

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 621 KB
151 KB 42ms
39ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0243c31edfa364b267018adb5220cf2ccc54e61f1b5a472fa7ba9cc6c1a4c984

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:46:59 GMT
server: AkamaiNetStorage
etag: "e33d264b6768a8b8fee1604b859d7748:1696974419.198914"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 154061
expires: Thu, 26 Oct 2023 16:17:43 GMT

GET
H3 200 new-relic-integration.js Show response
auth.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 152ms
150ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
last-modified: Wed, 25 Oct 2023 01:27:26 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65386efe-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 81c3aaf03f0f2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 54ms
51ms Stylesheet
text/css 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 18647163
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230071-FRA, cache-bma1663-BMA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CWFS0mDPieYrvbY5%2Br%2Fw8KJK2qkpnMHhvNUE6TaCxZ%2FX7hv3xtdvHHjyR1fiqew6E4mLZH%2BwWT6GwQMmYoF0W7Y7C%2F8PUNBw2BbARhcVJTXfxZ%2BHh13Z9fXc%2FnypvDqw31%2BkzYfUCjp4rkAXZn0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 81c3aaf0396f9162-FRA

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 243 KB
78 KB 74ms
72ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

9a9259e930e3dae8b97c60c968b0815db8d0382bb1f3ab236af138a211579e68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80001
x-xss-protection: 0

GET
H2 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 52ms
50ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 19317211
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BFdZ512DiDHxsHHx%2BTNiVh2VShNhxhPJq%2FaabQChLjKBQjAur2n6ILUB2dZGEtgI%2B3bSJF0BMtzrO9DX7HAIOQdQ5sE0msWTPuc%2FflgZbnf3phGrfBxzr0RyrE98KmTnAjwFIOEzsV4TqRcNC78fIyUJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 81c3aaf03ec8373d-FRA
expires: Tue, 15 Oct 2024 15:17:43 GMT

GET
H3 200 runtime-es2015.d65d9e1ef0e041f5ea49.js Show response
auth.savings.workingadvantage.com/ 1 KB
1 KB 157ms
155ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/runtime-es2015.d65d9e1ef0e041f5ea49.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3078803c6ef90f5b252cc62899b2d5dfc3d4842f80e7194d9acd57504d7b1ed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 25 Oct 2023 01:26:25 GMT
server: cloudflare
content-encoding: br
etag: W/"65386ec1-511"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 81c3aaf03f122c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills-es2015.83678f157fdb7aa8c9b4.js Show response
auth.savings.workingadvantage.com/ 121 KB
41 KB 158ms
156ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/polyfills-es2015.83678f157fdb7aa8c9b4.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2921dc9f527117223206f193fc90b8c0fddc6dd38e744e932362af8cb1186c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 25 Oct 2023 01:26:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65386ec3-1e5c7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 81c3aaf03f152c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.839823a06217b7c66e38.js Show response
auth.savings.workingadvantage.com/ 165 KB
53 KB 155ms
154ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/scripts.839823a06217b7c66e38.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf6df84cb37b5c853a3414f9878473bec61127f2168d9431131bbe0be589a335

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
last-modified: Wed, 25 Oct 2023 01:26:23 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65386ebf-2957f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 81c3aaf148ac2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main-es2015.d1b10b000c1670dfd114.js Show response
auth.savings.workingadvantage.com/ 2 MB
401 KB 193ms
192ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/main-es2015.d1b10b000c1670dfd114.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cf98b1ce1a6ce2b5c6b88563939cf674a6ee7e234efa11c2491624d7d05d717

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Wed, 25 Oct 2023 01:27:26 GMT
server: cloudflare
content-encoding: br
etag: W/"65386efe-1a1069"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 81c3aaf03f192c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 230 KB
77 KB 59ms
58ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d3ad8c93592935c825d1b4a949bf77c4bbe8548d68bb5fe2c3fcf2abe934aae4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78615
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Oct 2023 15:17:43 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 41ms
40ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
x-akamai-ew-subworker: 8096267
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Thu, 26 Oct 2023 16:17:43 GMT

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
x-akamai-ew-subworker: 8096267
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Thu, 26 Oct 2023 16:17:43 GMT

GET
H3 200 styles.7a30f38d0e88aa825854.css
auth.savings.workingadvantage.com/ 39 KB
8 KB 140ms
139ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/styles.7a30f38d0e88aa825854.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23249457a4658036071a9eed9216775069391781c9032aedcb09ab4c50a24f62

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
last-modified: Wed, 25 Oct 2023 01:26:23 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65386ebf-9bdf"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 81c3aaf148ad2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 41ms
41ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 17:37:58 GMT
x-content-type-options: nosniff
age: 164385
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 23 Oct 2024 17:37:58 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 272 KB
90 KB 56ms
56ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

90eaf1018b6fc0c54fcecd5d56bfde171366317d6d203d5f0471a6a1db8628e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92401
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 26 Oct 2023 15:17:43 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 40ms
40ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 26 Oct 2023 13:51:33 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 5170
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 26 Oct 2023 15:51:33 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 59ms
59ms XHR
application/json 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 46ms
46ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1767707822&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Ffanduel%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Ffanduel.savings.workingadvantage.com%252F&dr=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=715138408.1698333461&tid=UA-2876877-9&_gid=1196957923.1698333461&_slc=1&gtm=45He3an0n815QN8HWMv78847533&gcd=11l1l1l1l1&z=1913967561

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 253 KB
85 KB 47ms
47ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d7cda308070a79c063aaa524b74a119904c4c1480e2ec35ea43f5ded3f2ef4a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86825
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 26 Oct 2023 15:17:43 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 47ms
46ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je3an0v9112553684z878847533&_p=1767707822&gcd=11l1l1l1l1&cid=715138408.1698333461&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1698333461&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Ffanduel%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Ffanduel.savings.workingadvantage.com%252F&dr=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fauth.savings.workingadvantage.com%2Ffanduel%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Ffanduel.savings.workingadvantage.com%252F&up.pb_site_name=auth&up.page_path=%2Ffanduel%2Fsign-in&up.user_id_value=&up.zip_code=NaN
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:43 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 system-wide Show response
fanduel.savings.beneplace.com/api/notifications/ 2 B
297 B 348ms
240ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/notifications/system-wide

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf3ad9d18da-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:42 GMT

GET
H2 200 info Show response
fanduel.savings.beneplace.com/api/ 8 KB
3 KB 457ms
350ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d419a7e0a1611e35e89d2ef54c69e80f191ccc3463515f4e9899f4ac84327145

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf3ad9c18da-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:42 GMT

GET
H2 200 info Show response
fanduel.savings.beneplace.com/api/ 8 KB
3 KB 362ms
256ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d419a7e0a1611e35e89d2ef54c69e80f191ccc3463515f4e9899f4ac84327145

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"2037-aeYzbZBxcW1vb8vHBH4rc/G6FSE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf3ad9718da-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:42 GMT

GET
H2 200 info Show response
fanduel.savings.beneplace.com/api/ 7 KB
2 KB 413ms
307ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/info

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

664cf9ddd63f0e68714dc6c16b7c70d7526e7282baa6b0fe146d02e5a319d9d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf3ad9918da-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:42 GMT

GET
H2 200 fanduel Show response
fanduel.savings.beneplace.com/api/controls/ 2 KB
1 KB 1688ms
1583ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/controls/fanduel

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d733e0f556966c0783cd8d7fa304ea033509c93a202167e84fd337681ca1a94b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"802-v9eGn7h9ufcBa7plcRSLDwfQUn4"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf3ad9618da-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:44 GMT

GET
H2 200 marketplace-styles.css Show response
fanduel.savings.beneplace.com/api/fanduel/ 32 KB
5 KB 451ms
346ms XHR
text/css 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/fanduel/marketplace-styles.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b1576aaf6d192bcd0e059cd15d3b68a183895909a41f473e1aaa0cb2919c41b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8128-ieekTvxwGihSJtxj0D9Ar83ZC7g"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf3ad9f18da-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:42 GMT

GET
H2 200 auth-v2 Show response
fanduel.savings.beneplace.com/api/google-experiments/ 4 KB
3 KB 316ms
212ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/google-experiments/auth-v2

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a83eaf590f2c078872c01c0f332037dc8fef2a3a2f925d9d8ea5425d0172cf99

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"fd8-xTrkXE581f1SQMoUGwMfCAmZvJg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf3ad9818da-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:42 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
25 KB 39ms
39ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Thu, 26 Oct 2023 15:17:43 GMT
strict-transport-security: max-age=300
x-amz-request-id: 32QGWQ2Q8YXX70QC
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: 4mlkuD+JDth4wo/QBMctxAliSNTUsTApT5L8+f4cLmgB3l+45PsvOvXZA+c1qr+RAGpR2S5FDiI=
x-served-by: cache-fra-eddf8230033-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
x-timer: S1698333464.562474,VS0,VE0
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 4023

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 40 B
482 B 290ms
290ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=960&ck=0&s=b864ae346bc0b39a&ref=https://auth.savings.workingadvantage.com/fanduel/sign-in&af=err,xhr,stn,ins,spa&be=385&fe=504&dc=466&perf=%7B%22timing%22:%7B%22of%22:1698333462655,%22n%22:0,%22r%22:1,%22re%22:220,%22f%22:220,%22dn%22:220,%22dne%22:220,%22c%22:220,%22s%22:220,%22ce%22:220,%22rq%22:221,%22rp%22:385,%22rpe%22:386,%22di%22:569,%22ds%22:850,%22de%22:851,%22dc%22:887,%22l%22:887,%22le%22:889%7D,%22navigation%22:%7B%22rc%22:1%7D%7D
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
content-type: text/plain

Response headers

Date: Thu, 26 Oct 2023 15:17:43 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 81c3aaf3b9a92c29-FRA
Content-Length: 40

GET
H2 200 fanduel Show response
fanduel.savings.beneplace.com/api/controls/ 2 KB
1 KB 1400ms
1399ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/controls/fanduel

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d733e0f556966c0783cd8d7fa304ea033509c93a202167e84fd337681ca1a94b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"802-v9eGn7h9ufcBa7plcRSLDwfQUn4"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf50f5018da-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:44 GMT

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
421 B 162ms
162ms XHR
image/gif 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1259&ck=0&s=b864ae346bc0b39a&ref=https://auth.savings.workingadvantage.com/fanduel/sign-in
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 , United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
content-type: text/plain

Response headers

Date: Thu, 26 Oct 2023 15:17:44 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 81c3aaf59bea2c29-FRA
Content-Length: 24

GET
H3 200 auth Show response
fanduel.savings.beneplace.com/api/navigation/fanduel/auth_footer/US/ 959 B
1 KB 396ms
395ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/navigation/fanduel/auth_footer/US/auth

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

986bf6d062a9495c5b1f31a4f143c8ce0d48ceb09ff37f5032d63c990d060d9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:44 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3bf-fTrY/POxp8xLE7tJOcrV4J65oF4"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaf5ef9e9b9e-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:43 GMT

GET
H3 200 onetrust Show response
fanduel.savings.beneplace.com/api/platform/options/ 501 B
927 B 185ms
185ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/platform/options/onetrust

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05f687735d78286be14d4e10a1fb29138cddcf927835e5441b61406512db7c8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f5-7p9slVTH/yNu6/xY0Gl0Ekd5Wds"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aafdda3f9b9e-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:44 GMT

GET
H3 200 info Show response
fanduel.savings.beneplace.com/api/ 8 KB
3 KB 392ms
391ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d419a7e0a1611e35e89d2ef54c69e80f191ccc3463515f4e9899f4ac84327145

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aafe0a849b9e-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:44 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 42ms
41ms Image
image/gif 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1767707822&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Ffanduel%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%3A%252F%252Ffanduel.savings.workingadvantage.com%252F&dr=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=FanDuel%20Group%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=715138408.1698333461&tid=UA-2876877-9&_gid=1196957923.1698333461&gtm=45He3an0n815QN8HWMv78847533&gcd=11l1l1l1l1&z=372683733

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 08:50:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23228
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 185 B
865 B 65ms
65ms XHR
application/json 3.251.33.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&d_mid=35176477656560890932757554289484568657&d_coppa=true&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=adobe_ecid%0135176477656560890932757554289484568657&d_cid_ic=ecid%0135176477656560890932757554289484568657&d_cid_ic=mcid%0135176477656560890932757554289484568657&ts=1698333465278

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.251.33.99 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-251-33-99.eu-west-1.compute.amazonaws.com

Software

Resource Hash

53cff53c52bf9fba78668d500a3db0628652f59cb5fe8aba1123bd90b681d0ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v053-0c4c20f8b.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: fyKJWA8tTcc=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://auth.savings.workingadvantage.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
X-Error: 300,300
Connection: keep-alive
Content-Length: 184
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 RCfc27f81c245c44b78fbb03ff4af1a6be-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/ 343 B
482 B 63ms
62ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/RCfc27f81c245c44b78fbb03ff4af1a6be-source.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0fb88363006fa1090248e57e5bb00bbcb91a851d7619b320fc661312e552be48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:46:59 GMT
server: AkamaiNetStorage
etag: "7e9b95127b86f5b4657a8a4d1840ccc1:1696974419.9836"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Thu, 26 Oct 2023 16:17:45 GMT

GET
H2 200 RC986b4d5825364bd4887033e40e20c549-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/ 757 B
697 B 63ms
63ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/a7f5bdf81d6c/RC986b4d5825364bd4887033e40e20c549-source.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 524921f6844becbc9f6f7447807fd724afeceb34924f93b425e04c7816ff38d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:46:59 GMT
server: AkamaiNetStorage
etag: "7e9b95127b86f5b4657a8a4d1840ccc1:1696974419.9836"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 429
expires: Thu, 26 Oct 2023 16:17:45 GMT

POST
H2 200 delivery Show response
entertainmentbenefit.tt.omtrdc.net/rest/v1/ 781 B
955 B 220ms
73ms XHR
application/json 66.235.152.115
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://entertainmentbenefit.tt.omtrdc.net/rest/v1/delivery?client=entertainmentbenefit&sessionId=c7ca63fd513646418ff9837631c934aa&version=2.8.2

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.115 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-66-235-152-115.data.adobedc.net

Software

jag /

Resource Hash

83be120f6b17d12d05c7820389336a294627ef4b0385b2c4b0f687f662748a30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: 3e44e740-bdfb-44fd-b910-15bedea76574

POST
H2 200 s3945008770890 Show response
smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LDQM/ 43 B
368 B 63ms
62ms XHR
image/gif 63.140.62.108
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LDQM/s3945008770890

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.108 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-108.data.adobedc.net

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 27 Oct 2023 15:17:45 GMT
server: jag
etag: 3647143346923831296-4617751274206921989
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Wed, 25 Oct 2023 15:17:45 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 230 KB
77 KB 51ms
51ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8cf3ca6c7bfd7218205c8a8bc8427c5a624f54bbe799680a5f6210e094158f6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78619
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Oct 2023 15:17:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 185 KB
67 KB 65ms
64ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2876877-9

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2ca706c1e7e5b57fca4b27c9d5918c1d2c5259ffc721e6665b07134991c2c1fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68561
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 26 Oct 2023 15:17:45 GMT

GET
H3 200 mouseflow Show response
fanduel.savings.beneplace.com/api/platform/options/ 94 B
692 B 218ms
217ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fanduel.savings.beneplace.com/api/platform/options/mouseflow?name=workingadvantage_mouseflow_script_id

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61b4579ddd9500f72669998271f04641a6f956554326995c3000531a9a57e4d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"5e-xWERRy+8FVp8nFwecehLclRX7Go"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 81c3aaff2c2d9b9e-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Thu, 26 Oct 2023 15:17:44 GMT

GET
H2 200 07e508d2-aee2-481f-ac8e-6e200d46af80.js Show response
cdn.mouseflow.com/projects/ 195 KB
57 KB 51ms
51ms Script
application/javascript 2606:4700::6812:1b32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mouseflow.com/projects/07e508d2-aee2-481f-ac8e-6e200d46af80.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1b32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef9650aaf24d93ad520c8968f6dbf9e4d04dc774898ee8a79f0afe977c5f950b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 104877
x-cache-status: HIT
x-mf-script: EU
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 23 Oct 2023 08:31:17 GMT
server: cloudflare
etag: W/"206de44a8b5da1:0"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
cf-ray: 81c3ab008d419ba4-FRA
expires: Fri, 27 Oct 2023 15:17:45 GMT

GET
H2 200 init Show response
n2.mouseflow.com/ 0
230 B 125ms
124ms XHR
text/plain 2607:f5b7:1:52::10
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL

https://n2.mouseflow.com/init?v=17.97&p=07e508d2-aee2-481f-ac8e-6e200d46af80&s=04775b9dcff21f15ab70f5347dd42a93&page=102645286152c4c06698b6b217e8d7072c5401f5&ret=0&u=279997ce65fd1fb1d2326d3e24068816&href=https%3A%2F%2Fauth.savings.workingadvantage.com%2Ffanduel%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%3A%252F%252Ffanduel.savings.workingadvantage.com%252F&url=%2Ffanduel%2Fsign-in&ref=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&title=FanDuel%20Group%20Marketplace&res=1600x1200&tz=-60&to=0&dnt=0&ori=&dw=1600&dh=1200&time=2677&pxr=1&gdpr=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2607:f5b7:1:52::10 , United States, ASN30633 (LEASEWEB-USA-WDC, US),

Reverse DNS

Software

Mouseflow /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-type: text/plain

Response headers

date: Thu, 26 Oct 2023 15:17:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: Mouseflow
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 fanduel_carousel_08.jpg
g3i.imgix.net/uploads/ 99 KB
99 KB 357ms
216ms Image
image/jpeg 2a04:4e42:8e::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g3i.imgix.net/uploads/fanduel_carousel_08.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8e::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

5f0c311525f51fda117ba80675401e920ed0f95fc7d79b66e5bf342c5a7c59a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:46 GMT
x-content-type-options: nosniff
age: 264552
x-cache: HIT, MISS
x-imgix-id: f9cb253cf2818e6bfc4ad4675d7f5ec051f11131
cross-origin-resource-policy: cross-origin
content-length: 101270
x-served-by: cache-sjc10063-SJC, cache-fra-etou8220058-FRA
x-imgix-render-farm: 01.140360
last-modified: Mon, 23 Oct 2023 13:48:34 GMT
server: imgix
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 fanduel_logo_wide_02.png
g3i.imgix.net/uploads/ 6 KB
6 KB 197ms
59ms Image
image/png 2a04:4e42:8e::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g3i.imgix.net/uploads/fanduel_logo_wide_02.png?w=280&h=24&crop=entropy&fit=clip&trim=color&trim-color=FFFFFF

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8e::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

8714a8a413a49808c320f03a1ab83007cd28ce4656af610efe1e0d09cbda51be

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:46 GMT
x-content-type-options: nosniff
age: 1949
x-cache: HIT, HIT
x-imgix-id: 115b31c3df6e30b14a2020ffba10247f55b176f0
cross-origin-resource-policy: cross-origin
content-length: 6021
x-served-by: cache-sjc10069-SJC, cache-fra-etou8220058-FRA
x-imgix-render-farm: 01.140360
last-modified: Thu, 26 Oct 2023 14:45:17 GMT
server: imgix
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 fanduel_logo_wide_02.png
g3i.imgix.net/uploads/ 7 KB
7 KB 234ms
95ms Image
image/png 2a04:4e42:8e::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g3i.imgix.net/uploads/fanduel_logo_wide_02.png?w=250&h=32&crop=entropy&fit=clip&trim=color&trim-color=FFFFFF

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8e::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

dbe1c813227fbba673bc030543817b6ec74552cafdd972eeb75d66fa7165d668

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:46 GMT
x-content-type-options: nosniff
age: 868369
x-cache: HIT, HIT
x-imgix-id: 94e75f978bffabe9c874606140f92301a2276258
cross-origin-resource-policy: cross-origin
content-length: 7294
x-served-by: cache-sjc10070-SJC, cache-fra-etou8220058-FRA
x-imgix-render-farm: 01.140360
last-modified: Mon, 16 Oct 2023 14:04:57 GMT
server: imgix
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 wa-logo-wide.png
auth.savings.workingadvantage.com/assets/ 29 KB
29 KB 144ms
144ms Image
image/png 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth.savings.workingadvantage.com/assets/wa-logo-wide.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99e2d1102c644111abed2ee312d1e57ed5418135c0c9905f3f2a1cd44312d3d4

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https:%2F%2Ffanduel.savings.workingadvantage.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:46 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
last-modified: Wed, 25 Oct 2023 01:27:26 GMT
server: cloudflare
cf-cache-status: DYNAMIC
etag: "65386efe-724c"
x-frame-options: DENY
content-type: image/png
accept-ranges: bytes
cf-ray: 81c3ab0509f72c1a-FRA
alt-svc: h3=":443"; ma=86400
content-length: 29260

GET
H3 200 workingadvantage_logo_wide_inverse_01.png
auth.savings.workingadvantage.com/assets/ 18 KB
19 KB 165ms
164ms Image
image/png 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth.savings.workingadvantage.com/assets/workingadvantage_logo_wide_inverse_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22de6cb47cb99a22c97982e083731cbbd79340c75261c8e68f9ddb350a11d264

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/fanduel/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https:%2F%2Ffanduel.savings.workingadvantage.com%2F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 15:17:46 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com
last-modified: Wed, 25 Oct 2023 01:27:26 GMT
server: cloudflare
cf-cache-status: DYNAMIC
etag: "65386efe-4924"
x-frame-options: DENY
content-type: image/png
accept-ranges: bytes
cf-ray: 81c3ab0509fc2c1a-FRA
alt-svc: h3=":443"; ma=86400
content-length: 18724

POST
H2 200 html Show response
n2.mouseflow.com/ 0
248 B 1385ms
537ms XHR
text/plain 192.96.202.199

General

Check archive.org

Show headers Download Go to

Full URL

https://n2.mouseflow.com/html?website=07e508d2-aee2-481f-ac8e-6e200d46af80&session=04775b9dcff21f15ab70f5347dd42a93&page=102645286152c4c06698b6b217e8d7072c5401f5&gz=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.96.202.199 -, , ASN (),

Reverse DNS

Software

Mouseflow /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-type: text/plain

Response headers

date: Thu, 26 Oct 2023 15:17:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: Mouseflow
x-recorder: rec-21-us
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 47ms
46ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a7ce1a34f3e9944fe88fc61abbc93b6db383afa2b90815fd7ccea456fbce4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 25 Oct 2023 18:52:43 GMT
x-content-type-options: nosniff
age: 73504
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14168
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:29:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Oct 2024 18:52:43 GMT

GET
H3 200 S6u9w4BMUTPHh50XSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 13 KB
13 KB 43ms
42ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh50XSwiPGQ3q5d0.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bd9a6192274f8f2f3ce31cd3d2cae5ebe32e2fa86fc7c4f60a3c28556e496d56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 07:53:04 GMT
x-content-type-options: nosniff
age: 26683
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13724
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:20:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 25 Oct 2024 07:53:04 GMT

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/53/14/intl/de_ALL/ 260 KB
56 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/53/14/intl/de_ALL/common.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fa7fcb7413f7b6cb9c0a76aadaa23a5e73ea367785cfc859a21dda19f6f226c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 25 Oct 2023 15:09:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 86884
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57809
x-xss-protection: 0
last-modified: Tue, 01 Aug 2023 04:14:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Oct 2024 15:09:44 GMT

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/53/14/intl/de_ALL/ 159 KB
50 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/53/14/intl/de_ALL/util.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21627001b40dde45bb3ba2d7d613cd6f42c438eb81ab924ddc56e14052b932e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 13:32:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179140
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51142
x-xss-protection: 0
last-modified: Tue, 01 Aug 2023 04:14:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 23 Oct 2024 13:32:08 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 47ms
47ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je3an0v9112553684&_p=1767707822&gcd=11l1l1l1l1&cid=715138408.1698333461&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&sid=1698333461&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Ffanduel%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Ffanduel.savings.workingadvantage.com%252F&dr=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:48 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 47ms
46ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je3an0v9126564266&_p=1767707822&gcd=11l1l1l1l2&ul=en-us&sr=1600x1200&cid=715138408.1698333461&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Ffanduel%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Ffanduel.savings.workingadvantage.com%252F&dr=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&sid=1698333461&sct=1&seg=1&_s=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 15:17:48 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 dom Show response
n2.mouseflow.com/ 0
229 B 125ms
124ms XHR
text/plain 192.96.202.199

General

Check archive.org

Show headers Download Go to

Full URL

https://n2.mouseflow.com/dom?gz=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.96.202.199 -, , ASN (),

Reverse DNS

Software

Mouseflow /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-type: text/plain

Response headers

date: Thu, 26 Oct 2023 15:17:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: Mouseflow
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=86400
content-length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2710&ck=0&s=162910da6e1f074b&ref=https://fanduel.savings.workingadvantage.com/

Domain: n2.mouseflow.com
URL: https://n2.mouseflow.com/init?v=17.97&p=07e508d2-aee2-481f-ac8e-6e200d46af80&s=04775b9dcff21f15ab70f5347dd42a93&page=10264279114b6844ce557b00782067f21161f40b&ret=0&u=279997ce65fd1fb1d2326d3e24068816&href=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&url=%2F&ref=&title=FanDuel%20Group%20Marketplace&res=1600x1200&tz=-60&to=0&dnt=0&ori=&dw=1600&dh=1200&time=2445&pxr=1&gdpr=1

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je3an0v9112553684&_p=1630001433&gcd=11l1l1l1l1&cid=715138408.1698333461&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&_s=2&sid=1698333461&sct=1&seg=0&dl=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=scroll&ep.userId=&epn.percent_scrolled=90&_et=4

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je3an0v9112553684&_p=1630001433&gcd=11l1l1l1l1&cid=715138408.1698333461&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=3&sid=1698333461&sct=1&seg=0&dl=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&dt=FanDuel%20Group%20Marketplace&en=user_engagement&ep.userId=&_et=1612

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je3an0v9126564266&_p=1630001433&gcd=11l1l1l1l2&ul=en-us&sr=1600x1200&cid=715138408.1698333461&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=2&dl=https%3A%2F%2Ffanduel.savings.workingadvantage.com%2F&dt=FanDuel%20Group%20Marketplace&sid=1698333461&sct=1&seg=1&en=page_view&_ee=1&_et=691

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2896&ck=0&s=162910da6e1f074b&ref=https://fanduel.savings.workingadvantage.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2897&ck=0&s=162910da6e1f074b&ref=https://fanduel.savings.workingadvantage.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2897&ck=0&s=162910da6e1f074b&ref=https://fanduel.savings.workingadvantage.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2898&ck=0&s=162910da6e1f074b&ref=https://fanduel.savings.workingadvantage.com/

Verdicts & Comments Add Verdict or Comment

222 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.workingadvantage.com/	1970-01-20 15:45:35	Name: __cf_bm Value: oDQDEIHPFMb46c0fwAxCDve12Jsax_JUhTJkyl57fqQ-1698333460-0-AbxxRK2c7slFQismbMl6h0b/UjpEiyYFkAStbGpxic2KfLwFQL2xUwAbaDr9Xxa3yl7W5dLwmyqQhvr79R1Mx9s=
.workingadvantage.com/	1969-12-31 23:59:59	Name: AMCVS_B5F9FF2554F608410A4C98C6%40AdobeOrg Value: 1
.workingadvantage.com/	1970-01-21 01:21:33	Name: s_ecid Value: MCMID%7C35176477656560890932757554289484568657
.workingadvantage.com/	1970-01-20 15:46:59	Name: _gid Value: GA1.2.1196957923.1698333461
.workingadvantage.com/	1970-01-20 15:45:33	Name: _gat_UA-2876877-9 Value: 1
.workingadvantage.com/	1970-01-21 00:31:09	Name: cf_clearance Value: i36yJKkVbP65ol3MhMxmtjaNR3wzfnXq6LPcerBCkRo-1698333461-0-1-abd7f64d.13c825d0.c35ccccf-0.2.1698333461
.rezync.com/	1970-01-20 20:04:45	Name: zync-uuid Value: a8a8b562-e66d-4f17-be9f-9871a2cdcc37:1698333461.5805585
live.rezync.com/	1970-01-20 20:04:45	Name: sd-session-id Value: eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiYThhOGI1NjItZTY2ZC00ZjE3LWJlOWYtOTg3MWEyY2RjYzM3OjE2OTgzMzM0NjEuNTgwNTU4NSJ9.ZTqDFQ.Ji1pPKBjIxbi_rbf-fWlP8ij5RQ
.workingadvantage.com/	1970-01-20 17:55:09	Name: _gcl_au Value: 1.1.1222419635.1698333462
.adnxs.com/	1970-01-20 17:55:09	Name: uuid2 Value: 6797580073409821958
.workingadvantage.com/	1970-01-21 00:31:09	Name: btIdentify Value: 5472a657-ca22-4591-cae7-b9a967aaddc0
.workingadvantage.com/	1970-01-20 15:45:37	Name: _bts Value: 8f4a6a15-eeb9-462d-95d3-e9f80985c7c8
.adnxs.com/	1970-01-20 17:55:09	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2GUgpO:C[!@wnf-Te9(>wL5L!!'GT$dI%Z
.workingadvantage.com/	1970-01-21 00:31:09	Name: _bti Value: %7B%22app_id%22%3A%22ebg-wag3%22%2C%22bsin%22%3A%22fVZJfVfgMUZgyHk5XXih02IWVJHd0ExiBIdoMmXZISTqoHYfUwzRawFsRuE4vdcRiOW%2F3GnFo2sB8Kh0OGMYGg%3D%3D%22%2C%22is_identified%22%3Afalse%7D
.workingadvantage.com/	1970-01-20 17:55:09	Name: mf_user Value: 279997ce65fd1fb1d2326d3e24068816\|
.workingadvantage.com/	1970-01-21 01:21:33	Name: _ga Value: GA1.2.715138408.1698333461
.workingadvantage.com/	1970-01-21 01:21:33	Name: _ga_2K753Z6D0L Value: GS1.2.1698333461.1.1.1698333465.0.0.0
.workingadvantage.com/	1969-12-31 23:59:59	Name: at_check Value: true
.workingadvantage.com/	1970-01-21 01:21:33	Name: AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19657%7CMCMID%7C35176477656560890932757554289484568657%7CMCAAMLH-1698938265%7C6%7CMCAAMB-1698938265%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1698340665s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0%7CMCCIDH%7C2071760937
.workingadvantage.com/	1969-12-31 23:59:59	Name: g3refurl Value: https%253A%252F%252Fauth.savings.workingadvantage.com%252Ffanduel%252Fsign-in%253Fresponse_type%253Dcode%2526client_id%253D9ezalirn45mf43imjtdf53%2526redirect_uri%253Dhttps%253A%25252f%25252ffanduel.savings.workingadvantage.com%25252f
.workingadvantage.com/	1970-01-21 01:21:33	Name: prev_url_v2 Value: https%253A%252F%252Fauth.savings.workingadvantage.com%252Ffanduel%252Fsign-in%253Fresponse_type%253Dcode%2526client_id%253D9ezalirn45mf43imjtdf53%2526redirect_uri%253Dhttps%253A%25252f%25252ffanduel.savings.workingadvantage.com%25252f
.workingadvantage.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.workingadvantage.com/	1970-01-21 01:21:33	Name: mbox Value: session#c7ca63fd513646418ff9837631c934aa#1698335326\|PC#c7ca63fd513646418ff9837631c934aa.37_0#1761578266
.workingadvantage.com/	1969-12-31 23:59:59	Name: mf_07e508d2-aee2-481f-ac8e-6e200d46af80 Value: 04775b9dcff21f15ab70f5347dd42a93\|10264279114b6844ce557b00782067f21161f40b.47.1698333462982$102645286152c4c06698b6b217e8d7072c5401f5.7836787618.1698333465729\|1698333462979\|\|0\|\|\|\|0\|17.97\|81.79115
.savings.workingadvantage.com/	1970-01-21 01:21:33	Name: split_test_groups Value: {"auth_v3_test1":{"group_id":"auth_v3","events":["stts-set-test-group","stts-view-search-result","stts-clickout-internal","stts-clickout-external","stts-auth-access","stts-accounts-created-password","stts-accounts-created-otp","stts-accounts-set-password-new","stts-auth-password-reset","stts-auth-password-skip"]}}
.workingadvantage.com/	1970-01-21 01:21:33	Name: _ga_FD2X5ZMELR Value: GS1.1.1698333461.1.1.1698333466.0.0.0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.googletagmanager.com/ Message: Refused to frame 'https://12084042.fls.doubleclick.net/' because it violates the following Content Security Policy directive: "frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
auth.savings.workingadvantage.com
bam.nr-data.net
cdn.boomtrain.com
cdn.jsdelivr.net
cdn.mouseflow.com
cdnjs.cloudflare.com
com-wag3.netmng.com
dpm.demdex.net
entertainmentbenefit.tt.omtrdc.net
events.api.boomtrain.com
fanduel.savings.beneplace.com
fanduel.savings.workingadvantage.com
fonts.gstatic.com
g3i.imgix.net
js-agent.newrelic.com
live.rezync.com
maps.googleapis.com
n2.mouseflow.com
people.api.boomtrain.com
region1.google-analytics.com
secure.adnxs.com
smetrics.workingadvantage.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
bam.nr-data.net
n2.mouseflow.com
region1.google-analytics.com
104.18.39.111
13.32.27.113
151.101.130.137
162.247.241.14
172.64.150.236
18.66.122.42
185.89.210.180
192.96.202.199
199.38.167.54
2001:4860:4802:34::36
2001:4860:4802:38::178
2606:4700::6810:5514
2606:4700::6811:190e
2606:4700::6812:1b32
2607:f5b7:1:52::10
2a00:1450:4001:810::2008
2a00:1450:4001:82b::2003
2a00:1450:4001:82f::200a
2a00:1450:400c:c06::9d
2a02:26f0:3500:587::1e80
2a04:4e42:8e::720
3.251.33.99
52.21.113.158
54.225.208.88
63.140.62.108
66.235.152.115
0243c31edfa364b267018adb5220cf2ccc54e61f1b5a472fa7ba9cc6c1a4c984
05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9
05f687735d78286be14d4e10a1fb29138cddcf927835e5441b61406512db7c8e
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0cf98b1ce1a6ce2b5c6b88563939cf674a6ee7e234efa11c2491624d7d05d717
0fb88363006fa1090248e57e5bb00bbcb91a851d7619b320fc661312e552be48
1c2304465e0076a791a63d6aecdc3efefdc44e67ca7b48fb1bfff1e3e1e1dae3
1da6ad9dfce9466037ec92e1f7699158c9a9347c669333c724f5cf6f3a7c0634
21627001b40dde45bb3ba2d7d613cd6f42c438eb81ab924ddc56e14052b932e4
22de6cb47cb99a22c97982e083731cbbd79340c75261c8e68f9ddb350a11d264
23249457a4658036071a9eed9216775069391781c9032aedcb09ab4c50a24f62
2ca706c1e7e5b57fca4b27c9d5918c1d2c5259ffc721e6665b07134991c2c1fb
3078803c6ef90f5b252cc62899b2d5dfc3d4842f80e7194d9acd57504d7b1ed5
3886c5ae4348a2bc69a71cbf779880b8899dff1412fe2dd2d7e2711bad9cfc3a
3f1403f29af77729e3caa999fb9e78ea109799e15e9cc13c9b6f5704e42ded13
462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
524921f6844becbc9f6f7447807fd724afeceb34924f93b425e04c7816ff38d1
53cff53c52bf9fba78668d500a3db0628652f59cb5fe8aba1123bd90b681d0ae
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
56d21399428b6e767b744a0c2e4668688db0cd8dfc185b125fe95669cc9580e7
56e4748204cced6882dad4656534f385ee520fac7a51c3c0b648b8c719ff845c
5f0c311525f51fda117ba80675401e920ed0f95fc7d79b66e5bf342c5a7c59a6
61b4579ddd9500f72669998271f04641a6f956554326995c3000531a9a57e4d4
65b182304c6036dfb7e6ead8c6931a2fd13f2228bc868eb6e6674aac424f51de
664cf9ddd63f0e68714dc6c16b7c70d7526e7282baa6b0fe146d02e5a319d9d5
6657dc9f6ee9fef340fa05ea4110332efb39d8f4e0d7da0aa080b59691eb53ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6dccf5082015b8556b15e6a21a619a18edc552cad62aac0f6f7e53cff8e78d55
7a7ce1a34f3e9944fe88fc61abbc93b6db383afa2b90815fd7ccea456fbce4e5
7d71ff454224cb861240d15be7804dd7cfdd2cc085826ab9d7ed26b23d5492ae
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83be120f6b17d12d05c7820389336a294627ef4b0385b2c4b0f687f662748a30
8714a8a413a49808c320f03a1ab83007cd28ce4656af610efe1e0d09cbda51be
8cf3ca6c7bfd7218205c8a8bc8427c5a624f54bbe799680a5f6210e094158f6b
90eaf1018b6fc0c54fcecd5d56bfde171366317d6d203d5f0471a6a1db8628e1
9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
931831f1ec6bc41c16ed704b2750760fbc4a4face4c8d52cda25b82fba183c9a
986bf6d062a9495c5b1f31a4f143c8ce0d48ceb09ff37f5032d63c990d060d9f
99e2d1102c644111abed2ee312d1e57ed5418135c0c9905f3f2a1cd44312d3d4
9a9259e930e3dae8b97c60c968b0815db8d0382bb1f3ab236af138a211579e68
9f88bd0176930b98dd6f6f002b6fdee2c2a3cfecde738db8826e1df6089ce10f
a6ef9ffffb88d08f27175148b71182885d3f5afd482cdd0dd819a7230dfc7a3f
a83eaf590f2c078872c01c0f332037dc8fef2a3a2f925d9d8ea5425d0172cf99
adabc9c64246a50454043d3dbfa223bf968f62aa789483f5a960d7581847b2fc
b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b
b1576aaf6d192bcd0e059cd15d3b68a183895909a41f473e1aaa0cb2919c41b7
b3b83ced5629150dbea6190afe5ad44feaef7987587aa905a7254ee701c2a3a0
b4cefa96e1215966aaf67cd962476b90c41a392fd494cc010351310644dc80ee
bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23
bd9a6192274f8f2f3ce31cd3d2cae5ebe32e2fa86fc7c4f60a3c28556e496d56
c831a58c25f63105a06a622b3435bc6761474664f87e8e7b6ef8dccafa0d890f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b
cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d
cf6df84cb37b5c853a3414f9878473bec61127f2168d9431131bbe0be589a335
d2921dc9f527117223206f193fc90b8c0fddc6dd38e744e932362af8cb1186c1
d3ad8c93592935c825d1b4a949bf77c4bbe8548d68bb5fe2c3fcf2abe934aae4
d419a7e0a1611e35e89d2ef54c69e80f191ccc3463515f4e9899f4ac84327145
d44f0ab25b413b56b8047b2723ca1769e1802a791f279557eb6e812838c89e4b
d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0
d733e0f556966c0783cd8d7fa304ea033509c93a202167e84fd337681ca1a94b
d7cda308070a79c063aaa524b74a119904c4c1480e2ec35ea43f5ded3f2ef4a2
dbe1c813227fbba673bc030543817b6ec74552cafdd972eeb75d66fa7165d668
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de8ad932a2b1a1859b67b97e14cd636dd214acaa3b7a08f898c4a695e48166a6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef9650aaf24d93ad520c8968f6dbf9e4d04dc774898ee8a79f0afe977c5f950b
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f92af17b23f77c222229cf069ee967e0786a95665bd87cbfc984fe3de13c3ea0
fa7fcb7413f7b6cb9c0a76aadaa23a5e73ea367785cfc859a21dda19f6f226c9

auth.savings.workingadvantage.com Open in urlscan Pro 104.18.39.111 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

120 Requests

91 %HTTPS

46 %IPv6

20 Domains

26 Subdomains

27 IPs

5 Countries

3798 kBTransfer

14128 kBSize

26 Cookies

2 Outgoing links

Page URL History

Redirected requests

120 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

auth.savings.workingadvantage.com Open in urlscan Pro
104.18.39.111 Public Scan

Screenshot
Live screenshot

Full Image

120
Requests

91 %
HTTPS

46 %
IPv6

20
Domains

26
Subdomains

27
IPs

5
Countries

3798 kB
Transfer

14128 kB
Size

26
Cookies

120 HTTP transactions
1 data transactions