cov.savings.workingadvantage.com Open in urlscan Pro
104.18.39.111 Public Scan

Software

jag /

Resource Hash

e4e60db0ab955141d56d809b48a427406074fd22949368086bfdcaa9b911eaa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 39ms
22ms XHR
application/json 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
cov.savings.workingadvantage.com/api/ 7 KB
2 KB 171ms
171ms XHR
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/info

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5f1c401aa792d1a1cca07a225fd018f36cb64b2d53680b68003dfbf50653eb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-9c4dba90629dcc01----1709552411580
traceparent: 00-f150bd08ef0593001c4ae4b4e4ffbf00-9c4dba90629dcc01-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjljNGRiYTkwNjI5ZGNjMDEiLCJ0ciI6ImYxNTBiZDA4ZWYwNTkzMDAxYzRhZTRiNGU0ZmZiZjAwIiwidGkiOjE3MDk1NTI0MTE1ODAsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1970c6e7b90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:10 GMT

GET
H3 200 marketplace-styles.css Show response
cov.savings.workingadvantage.com/api/cov/ 32 KB
5 KB 618ms
617ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/cov/marketplace-styles.css

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45488e2eb081b32f43e0cbfe2ba9dce4a893e4f5ea5f43c0f110a21717c6e6e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-e19c144e0c81610c----1709552411581
traceparent: 00-8f54c4f716c43074f35c807a5fda9600-e19c144e0c81610c-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImUxOWMxNDRlMGM4MTYxMGMiLCJ0ciI6IjhmNTRjNGY3MTZjNDMwNzRmMzVjODA3YTVmZGE5NjAwIiwidGkiOjE3MDk1NTI0MTE1ODEsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:12 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8095-csWeogI50zjyoFXVCCvioZ8EkgE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1970c6e7c90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:11 GMT

GET
H3 200 colors.css Show response
cov.savings.workingadvantage.com/api/cov/ 3 KB
767 B 179ms
179ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/cov/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67550708dbc8934e8597cd5845d9a52786e40de76e56642378fc6edeb1459ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-d1dd79e90426b1cb----1709552411582
traceparent: 00-9ee1f43d90912fc3e73ed4713a28dc00-d1dd79e90426b1cb-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImQxZGQ3OWU5MDQyNmIxY2IiLCJ0ciI6IjllZTFmNDNkOTA5MTJmYzNlNzNlZDQ3MTNhMjhkYzAwIiwidGkiOjE3MDk1NTI0MTE1ODIsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"a5f-d4IlrjjUUtu1BTwST6NSe19xCA8"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1970c6e7f90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:10 GMT

GET
H2 200 RCea9d317d3a374e44b3f0f8711e38765e-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 2 KB
1019 B 10ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCea9d317d3a374e44b3f0f8711e38765e-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e197eefb3a6378c1636ca452e85b757536156c962cd4c96cbe86c6ec83b92510

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 751
expires: Mon, 04 Mar 2024 12:40:11 GMT

GET
H3

200

main.js Show response
cov.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/ Frame 7947
Redirect Chain

https://cov.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://cov.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js

8 KB
4 KB

15ms
15ms

Script
application/javascript

104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

325a37ec68b5442f927438171a8cd3c89f1bd67e7b2a5c1b32ae9f1f7d076470

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 85f1970cbea790e6-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Mon, 04 Mar 2024 11:40:11 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 85f1970c7e8990e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
94 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

88b56988a3cbd00f1d221464cb4892a2b4a11247f44826b4ea201f4b15d3aba5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96089
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:11 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 33ms
8ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Mar 2024 11:32:03 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 488
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Mar 2024 13:32:03 GMT

GET
H2 200 sync Show response
live.rezync.com/ 5 KB
6 KB 185ms
151ms Script
text/javascript 13.32.27.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=5ef4f9c1e806678f2ab0275df01d5ff4&zmpID=ebg-wag3&cache_buster=1709552411633&k=ebg-wag3-pixel-0988
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-113.fra56.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: f3ab03ea78ead820c14cbb3d69bb8002ea2b454fdecf1215d720c9f83826d82e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
via: 1.1 747e99d9d8c5e29fdc713cf866bc3f82.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 5446
x-amz-cf-id: Qq-LxZGJSvuvfF0jD62YnrgF6Gc7KiDbwRFX0HZldQ2i_oDb1SLw4A==

POST
H3 200 85f197049b5b3a82 Show response
cov.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 7947 0
347 B 32ms
31ms XHR
text/plain 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/jsd/r/85f197049b5b3a82

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 85f1970d7f1f90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 cov Show response
cov.savings.workingadvantage.com/api/controls/ 2 KB
1 KB 1149ms
1149ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/controls/cov

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7afd9a10c8ddc93d6ca6d3245a21999d408db30ab4bf31e792e213b0b80d7cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-e3c7a946100f505b----1709552411756
traceparent: 00-d49798d2d8c36cc51ac24763c85fd700-e3c7a946100f505b-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImUzYzdhOTQ2MTAwZjUwNWIiLCJ0ciI6ImQ0OTc5OGQyZDhjMzZjYzUxYWMyNDc2M2M4NWZkNzAwIiwidGkiOjE3MDk1NTI0MTE3NTYsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:12 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1970d7f2490e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:11 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
234 B 15ms
14ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=259335126&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=1221856384&gjid=1986891107&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&_r=1&_slc=1&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1993345401

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1da6ad9dfce9466037ec92e1f7699158c9a9347c669333c724f5cf6f3a7c0634

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:11 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
257 B 39ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je42t1v9112553684z878847533za220&_p=1709552410759&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1843357478.1709552412&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709552411&sct=1&seg=0&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&dt=Beneplace%20Team%20Discounts&en=page_view&_fv=1&_ss=1&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&up.pb_site_name=cov&up.page_path=%2Frelay&up.user_id_value=&up.zip_code=NaN&tfd=3090
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
358 B 70ms
31ms XHR
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-2876877-9&cid=1843357478.1709552412&jid=1221856384&gjid=1986891107&_gid=166212241.1709552412&_u=YEBAAEAAAAAAACAAI~&z=316254041

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 04 Mar 2024 11:40:11 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 262 KB
88 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c1e7e0ae9257818e4e87b7eec7d9a5bf770c717e9d4c1e25cd800d8a3f189dc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90496
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:11 GMT

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/ebg-wag3/ 93 KB
30 KB 59ms
10ms Script
application/javascript 18.66.122.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/ebg-wag3/p13n.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-57.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 62ec57b7f971a77af7380ce75ee21e1b881fd1fa628efdb36607125004cca092

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: wRWB6X7wlph0uyMEnzVVd.0l3.N4rmfh
Content-Encoding: gzip
Via: 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront)
Date: Mon, 04 Mar 2024 11:04:35 GMT
X-Amz-Cf-Pop: FRA60-P2
Age: 2137
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Fri, 01 Mar 2024 04:43:11 GMT
Server: AmazonS3
ETag: W/"a036c704209d386b667790a5a0757a3f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: MhYZ-p0Nu_CAdTlM6FgsdLnmvWHctYrMGw5vjDtu0cZhg2SMTaTGeQ==

GET
H/1.1 200
OK / Show response
com-wag3.netmng.com/ 0
240 B 406ms
87ms Script
text/html 199.38.167.54
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://com-wag3.netmng.com/?aid=6366&siclientid=105368&url=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&p5=&p6=&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.38.167.54 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Mon, 04 Mar 2024 11:40:12 GMT
X-Cnection: close
Content-Encoding: gzip
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2

200

;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552411.744019
adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CLWc8IHD2oQDFSrgOwIdNu8CIA;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=h...
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=12084042;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workin...
https://ad.doubleclick.net/ddm/activity/src=12084042;dc_pre=CLWc8IHD2oQDFSrgOwIdNu8CIA;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u...
https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CLWc8IHD2oQDFSrgOwIdNu8CIA;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u2...

42 B
401 B

121ms
77ms

Image
image/gif

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CLWc8IHD2oQDFSrgOwIdNu8CIA;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workingadvantage.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552411.744019

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 04 Mar 2024 11:40:11 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"5746888868401336771"}],"aggregatable_trigger_data":[{"filters":{"14":["12836263"]},"key_piece":"0x53f402ca3ba6efa","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x7fc39fb387ab29c2","not_filters":{"14":["12836263"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["12836263"]},"key_piece":"0x7dcc41a70aba3d22","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xd89ab4266f1d78ab","not_filters":{"14":["12836263"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"10911026588896301514","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"5746888868401336771","filters":{"14":["12836263"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"5746888868401336771","filters":{"14":["12836263"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"5746888868401336771","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"5746888868401336771","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["12084042"]}}
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: image/png
location: https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CLWc8IHD2oQDFSrgOwIdNu8CIA;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workingadvantage.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552411.744019
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?add=32509374&t=2
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2

43 B
1 KB

40ms
39ms

Image
image/gif

185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-54-74-69-97.eu-west-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:11 GMT
an-x-request-uuid: 5b248d0f-e0c1-428e-8596-c6b8f3bbdc15
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.200; 80.255.10.200; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:11 GMT
an-x-request-uuid: 20e60a7d-f7e6-4a3e-9cd7-08031ab5feb1
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2
x-proxy-origin: 80.255.10.200; 80.255.10.200; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 15ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je42t1v9126564266za220&_p=1709552410759&gcd=13l3l3l3l2&npa=0&dma_cps=sypham&dma=1&ul=en-us&sr=1600x1200&cid=1843357478.1709552412&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&dt=Beneplace%20Team%20Discounts&sid=1709552411&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=3192
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK resolve Show response
people.api.boomtrain.com/identify/ 142 B
457 B 424ms
115ms XHR
application/json 52.45.81.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/identify/resolve?data=eyJjb29raWUiOnsiYnNpbiI6IiJ9LCJxdWVyeXN0cmluZyI6e30sImV4dGVybmFsX2lkcyI6eyJ6eW5jIjoiYjhkNzMzNDEtZTA4Mi00NTBmLWJlYzUtYTc1MjdmOTFlYmE3OjE3MDk1NTI0MTEuNzQxMjEyNCJ9fQ%3D%3D&site_id=ebg-wag3
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.81.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-81-10.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6cf0418f57a18fd5b03ffdf48354cb6a3bf28d120ed8c3948913bccec6575967

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Mon, 04 Mar 2024 11:40:12 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 142

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
26 KB 37ms
7ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::649 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 04 Mar 2024 11:40:12 GMT
strict-transport-security: max-age=300
x-amz-request-id: XKNH2N4BMHCM512R
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: 4mexhU0yeIewKmDeZm96VoQ5sJoXlVDLPLvdECeQEQCLYnoSPdDtx9GVJ5S3Dd2cS0NTUzBv+mg=
x-served-by: cache-fra-etou8220080-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 305

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 40 B
469 B 470ms
365ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=3571&ck=0&s=41ef36ba9d343f7d&ref=https://cov.savings.workingadvantage.com/relay&af=err,xhr,stn,ins,spa&be=2018&fe=1501&dc=865&perf=%7B%22timing%22:%7B%22of%22:1709552408714,%22n%22:0,%22f%22:1576,%22dn%22:1603,%22dne%22:1603,%22c%22:1603,%22s%22:1609,%22ce%22:1621,%22rq%22:1621,%22rp%22:2018,%22rpe%22:2019,%22di%22:2251,%22ds%22:2869,%22de%22:2883,%22dc%22:3517,%22l%22:3517,%22le%22:3519%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 5ca742541d65d718402499ed1d84d003258ce2116562169b85744cf7d798485a

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:12 GMT
server: envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 40
x-served-by: cache-fra-etou8220135-FRA

POST
H2 200 track Show response
events.api.boomtrain.com/event/ 2 B
209 B 320ms
110ms XHR
text/plain 3.216.161.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.161.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-161-250.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Mon, 04 Mar 2024 11:40:12 GMT
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
408 B 98ms
97ms XHR
image/gif 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=4052&ck=0&s=41ef36ba9d343f7d&ref=https://cov.savings.workingadvantage.com/relay
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:12 GMT
server: envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: image/gif
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
Connection: keep-alive
Content-Length: 24
x-served-by: cache-fra-etou8220135-FRA

GET
H2 200 RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 451 B
554 B 268ms
268ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8c8854741b41041a55e30363186b3e943076de5f80c39d1bb82ed6efbc5f8a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 286
expires: Mon, 04 Mar 2024 12:40:13 GMT

GET
H3 200 872.194065e01ea991c5.js Show response
cov.savings.workingadvantage.com/ 4 KB
2 KB 123ms
123ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/872.194065e01ea991c5.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aba7991bfc62a413ff4a27b8882721bd3c3f0e858a75501979e34306e1b64fa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-11ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19714dc9590e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3

200

sign-in Show response
auth.savings.workingadvantage.com/cov/ Frame F389
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=cov&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refre...
https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html

10 KB
3 KB

117ms
117ms

Document
text/html

104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4264bfa87de5afd4b0236f34dfeee60b2231773a4b404c970c25c4543cd3b4ac

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cov.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85f19715fd4f90e6-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:13 GMT
last-modified: Thu, 29 Feb 2024 11:20:21 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 85f197151b393a82-FRA
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:13 GMT
expires: Mon, 04 Mar 2024 11:40:12 GMT
location: /cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H3 401 dlk-compare Show response
cov.savings.workingadvantage.com/api/known/ 182 B
513 B 176ms
176ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/known/dlk-compare?guid=5e4nklqbt00qx69grkzilygsg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

170287bbbfc14739c9b3aa6ce30abb0669d418f01118028f4b06c198fdbdde1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-f0de2f34379eaafe----1709552413060
traceparent: 00-b55a90899fcaef116a37bb04361bc800-f0de2f34379eaafe-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImYwZGUyZjM0Mzc5ZWFhZmUiLCJ0ciI6ImI1NWE5MDg5OWZjYWVmMTE2YTM3YmIwNDM2MWJjODAwIiwidGkiOjE3MDk1NTI0MTMwNjAsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by
etag: W/"b6-lGFIUF59ZyAYAhOl/ILN9N2OvBU"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cf-ray: 85f19715ad1590e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
content-length: 182
alt-svc: h3=":443"; ma=86400

GET
H3 200 info
cov.savings.workingadvantage.com/api/ 8 KB
3 KB 372ms
371ms XHR
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/info?authInfo=true

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-21702276bcde090d----1709552413063
traceparent: 00-5764a3402b09fd90dbdd36ac47b36600-21702276bcde090d-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjIxNzAyMjc2YmNkZTA5MGQiLCJ0ciI6IjU3NjRhMzQwMmIwOWZkOTBkYmRkMzZhYzQ3YjM2NjAwIiwidGkiOjE3MDk1NTI0MTMwNjMsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19715ad1990e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:12 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=259335126&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=2039428264

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49239
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 RC0c16579d5c704bd0a214633d669d35f2-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 1018 B
815 B 11ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC0c16579d5c704bd0a214633d669d35f2-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bb5b688508b532c8599179a5a20d10a399dff6e818f7d4299a2783cdaa72b284

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 547
expires: Mon, 04 Mar 2024 12:40:13 GMT

GET
H2 200 RC668a267ca36c45b5acca38f3e4360a76-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 340 B
482 B 10ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC668a267ca36c45b5acca38f3e4360a76-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8004dadb6b1625999c7de43a05d9c2d7fc4ac26ec644a95bfbd113c70b80c9a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Mon, 04 Mar 2024 12:40:13 GMT

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ Frame F389 661 KB
155 KB 13ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a5ff70f6ac07dd9865153de5810ff20130a8e033bc547a36598c01bd4de1dc74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:35 GMT
server: AkamaiNetStorage
etag: "f72c7e4973313980f51ed6fa9b44d977:1707952175.514279"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 158823
expires: Mon, 04 Mar 2024 12:40:13 GMT

GET
H3 200 new-relic-integration.js Show response
auth.savings.workingadvantage.com/assets/new-relic/ Frame F389 51 KB
18 KB 121ms
119ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:20 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06874-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f19716bdbd90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ Frame F389 157 KB
25 KB 21ms
19ms Stylesheet
text/css 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8327822
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230082-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2kXbce4CQF%2F4nWXuDya%2FaGA4DSJS777LuJA8M6SEVQ3UfrZ0vddD3ob%2BCtIS8ZItuRMV85W9fDLzjFxApgS3MceYuz5aG92cR4B5JeyiuO0m11Al7557MpdhuSd0uP5KC5bijwALo6LzhYkdq0E%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85f19716bffd380e-FRA

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ Frame F389 222 KB
74 KB 34ms
32ms Script
text/javascript 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

3522991d63b0d16a8d330947e3df263de29a664b90320655ce99bee43de8c82d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75427
x-xss-protection: 0

GET
H2 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ Frame F389 47 KB
14 KB 19ms
17ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1613970
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I4w0Ph6Lq4EYqua4NGG77F%2Bg6xtYTGYo4xbWnI92sVnjbmrdjvhtqb56LXX%2BMKe1x%2BCU7GjguQGzVbfFVI3lYtI9EdGiA1zp%2FxnbTZJKml5lhxYoOlPTy4JOPIgB6B0Qk%2FXJMAZtMscNwKrYLYZkExuf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f19716b8994da1-FRA
expires: Sat, 22 Feb 2025 11:40:13 GMT

GET
H3 200 runtime.13338c5d9c83d0b6.js Show response
auth.savings.workingadvantage.com/ Frame F389 1 KB
1 KB 124ms
123ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/runtime.13338c5d9c83d0b6.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

779700103eaa215226d17491070dd24cc4e6ae6533a0f3a4071140805119b45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-488"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19716bdc190e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.d382160f8481ef1c.js Show response
auth.savings.workingadvantage.com/ Frame F389 122 KB
43 KB 123ms
122ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/polyfills.d382160f8481ef1c.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c06c3b843d4bcf295909300bfad5473626575eaef96b98615d9d2f294d66058c

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-1e6bf"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19716bdc490e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.1baad6c013597821.js
auth.savings.workingadvantage.com/ Frame F389 166 KB
54 KB 131ms
130ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/scripts.1baad6c013597821.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06870-29758"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f197179e5190e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.376bcc3f5834c9a3.js
auth.savings.workingadvantage.com/ Frame F389 2 MB
409 KB 136ms
135ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/main.376bcc3f5834c9a3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-19e71e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19716bdc690e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame F389 241 KB
81 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

68255f902e91def032c150b749e33263a2cdaf1e2e9d02c9dc53620e1bfb8f45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82644
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:13 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ Frame F389 33 KB
12 KB 12ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 04 Mar 2024 12:40:13 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ Frame F389 3 KB
2 KB 11ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 04 Mar 2024 12:40:13 GMT

GET
H3 200 styles.4a62f33afffa2c84.css
auth.savings.workingadvantage.com/ Frame F389 39 KB
8 KB 118ms
118ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/styles.4a62f33afffa2c84.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06870-9b6a"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f197179e5390e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 js
www.googletagmanager.com/gtag/ Frame F389 281 KB
94 KB 17ms
17ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96089
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:13 GMT

GET
H3 200 analytics.js
www.google-analytics.com/ Frame F389 52 KB
21 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Mar 2024 11:32:03 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 490
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Mar 2024 13:32:03 GMT

GET
H3 200 gen_204
maps.googleapis.com/maps/api/mapsjs/ Frame F389 3 B
45 B 23ms
23ms XHR
application/json 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3

200

sign-in Show response
auth.savings.workingadvantage.com/cov/
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=cov&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%...
https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69...

10 KB
3 KB

405ms
404ms

Document
text/html

104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/main.1f738b905888de82.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4264bfa87de5afd4b0236f34dfeee60b2231773a4b404c970c25c4543cd3b4ac

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cov.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85f197190f3f90e6-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:13 GMT
last-modified: Thu, 29 Feb 2024 11:20:21 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 85f197182e9e90e6-FRA
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:13 GMT
expires: Mon, 04 Mar 2024 11:40:12 GMT
location: /cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

POST
H3 200 collect
www.google-analytics.com/j/ Frame F389 15 B
35 B 14ms
14ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=932797573&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Fsilent-refresh.html&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&_slc=1&gtm=45He42t1n815QN8HWMv78847533za220&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1697075514

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js
www.googletagmanager.com/gtag/ Frame F389 262 KB
88 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90496
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:13 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ Frame F389 0
17 B 15ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je42t1v9112553684z878847533za200&_p=1709552413240&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1843357478.1709552412&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709552411&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Fsilent-refresh.html&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Fsilent-refresh.html&up.pb_site_name=auth&up.page_path=%2Fcov%2Fsign-in&up.user_id_value=&up.zip_code=NaN&tfd=580
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:13 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles.4a62f33afffa2c84.css
auth.savings.workingadvantage.com/ Frame F389 39 KB
8 KB 123ms
123ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/styles.4a62f33afffa2c84.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refresh.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06870-9b6a"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f197188ee490e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 system-wide
cov.savings.beneplace.com/api/notifications/ Frame F389 2 B
807 B 190ms
144ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/notifications/system-wide

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197197f2c9bb2-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:12 GMT

GET
H2 200 info
cov.savings.beneplace.com/api/ Frame F389 8 KB
3 KB 202ms
157ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197197f2b9bb2-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:12 GMT

GET
H2 200 info
cov.savings.beneplace.com/api/ Frame F389 8 KB
3 KB 351ms
307ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197197f259bb2-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:12 GMT

GET
H2 200 cov
cov.savings.beneplace.com/api/controls/ Frame F389 2 KB
1 KB 202ms
158ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/controls/cov

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197197f229bb2-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:12 GMT

GET
H2 200 marketplace-styles.css
cov.savings.beneplace.com/api/cov/ Frame F389 32 KB
5 KB 322ms
279ms XHR
text/css 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/cov/marketplace-styles.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8095-csWeogI50zjyoFXVCCvioZ8EkgE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197197f289bb2-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:12 GMT

GET
H2 200 auth-v2
cov.savings.beneplace.com/api/google-experiments/ Frame F389 4 KB
2 KB 206ms
163ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/google-experiments/auth-v2

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"fd8-xTrkXE581f1SQMoUGwMfCAmZvJg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197197f299bb2-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:12 GMT

GET
H2 200 auth
cov.savings.beneplace.com/api/navigation/cov/auth_footer/US/ Frame F389 703 B
735 B 158ms
158ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/navigation/cov/auth_footer/US/auth

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:13 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"2bf-DBf4awcV4RPWhcxAtHTLDdgnDd8"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1971a78079bb2-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:12 GMT

GET cov
cov.savings.beneplace.com/api/controls/ Frame F389 0
0

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST collect
region1.google-analytics.com/g/ Frame F389 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 661 KB
155 KB 14ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a5ff70f6ac07dd9865153de5810ff20130a8e033bc547a36598c01bd4de1dc74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:35 GMT
server: AkamaiNetStorage
etag: "f72c7e4973313980f51ed6fa9b44d977:1707952175.514279"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 158823
expires: Mon, 04 Mar 2024 12:40:14 GMT

GET
H3 200 new-relic-integration.js Show response
auth.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 124ms
121ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:20 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06874-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f1971ba90a90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 27ms
25ms Stylesheet
text/css 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8327823
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230082-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sMvYeA6vpVZBWTUR1HcrA9%2Bt3udDnpvdHw375REKMXyYO9xgwikzgqlYY9eEMONmBFTg%2FhI4w1620nPO8A7UBb7cTLjKVFO14eNdvvEm54DtmOWYPmpFof5vAuP4HBsf%2FHFptr7EFphgCrWQWvo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85f1971baf8e196d-FRA

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 222 KB
74 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

3522991d63b0d16a8d330947e3df263de29a664b90320655ce99bee43de8c82d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75427
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 25ms
23ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5565736
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bVVIZXQ1MYZMNk7x9sv1dhY21hdSHYdcRmqBjspCdNpqQPE6oAB%2B5dFDxL8i3qBS9qW5jxBQgXptJSspSfAJZ3kwJ6uCNTlsAa8ocv3A%2BXOyTGgJW%2BsfIBxIm44Y7wcI6xnetechj1pgJFXLXqprTG7B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f1971baf3a372e-FRA
expires: Sat, 22 Feb 2025 11:40:14 GMT

GET
H3 200 runtime.13338c5d9c83d0b6.js Show response
auth.savings.workingadvantage.com/ 1 KB
1 KB 129ms
127ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/runtime.13338c5d9c83d0b6.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

779700103eaa215226d17491070dd24cc4e6ae6533a0f3a4071140805119b45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-488"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1971ba90b90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.d382160f8481ef1c.js Show response
auth.savings.workingadvantage.com/ 122 KB
43 KB 143ms
141ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/polyfills.d382160f8481ef1c.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c06c3b843d4bcf295909300bfad5473626575eaef96b98615d9d2f294d66058c

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-1e6bf"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1971ba90c90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.1baad6c013597821.js Show response
auth.savings.workingadvantage.com/ 166 KB
54 KB 496ms
495ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/scripts.1baad6c013597821.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aef73d8723fb7d91d516282c5a33140f448212e7d49898baab65f6c8b74ddc6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06870-29758"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f1971c798c90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.376bcc3f5834c9a3.js Show response
auth.savings.workingadvantage.com/ 2 MB
409 KB 128ms
126ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/main.376bcc3f5834c9a3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be8577e579d9924b36cda3f01fb7aea4f43ed90f9ae689955a0deda006a1ee11

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-19e71e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1971ba90d90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 241 KB
81 KB 29ms
28ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9d390bff49c893f0556cc3a63eaf4c927ccab393c48109845c85456ac0b62535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82643
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:14 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 14ms
13ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 04 Mar 2024 12:40:14 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 15ms
13ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 04 Mar 2024 12:40:14 GMT

GET
H3 200 styles.4a62f33afffa2c84.css
auth.savings.workingadvantage.com/ 39 KB
8 KB 133ms
132ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/styles.4a62f33afffa2c84.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0bf599966dd39864588776600dcc12f05f281fe550157d82950665735ab2da0c

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06870-9b6a"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f1971c798f90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:59:47 GMT
x-content-type-options: nosniff
age: 528027
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 08:59:47 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
94 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5bf91c2bd2bc169cf8a9016c6985f38582b9477cb5047dafc892d1d6859277a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96054
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:14 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Mar 2024 11:32:03 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 491
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Mar 2024 13:32:03 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 16ms
16ms XHR
application/json 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 14ms
14ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=42152850&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253Fdlk%253D5e4nklqbt00qx69grkzilygsg%2526corpRedirectUri%253D%2526subdomain%253Dcov&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&_slc=1&gtm=45He42t1n815QN8HWMv78847533za220&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1234866444

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 262 KB
88 KB 18ms
18ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

afef051e43df07501bff0f8636fec8be34b9c70d19c50ce7a5bf2ca48c8b095b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90496
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:14 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 16ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je42t1v9112553684z878847533za200&_p=1709552414025&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1843357478.1709552412&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709552411&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253Fdlk%253D5e4nklqbt00qx69grkzilygsg%2526corpRedirectUri%253D%2526subdomain%253Dcov&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253Fdlk%253D5e4nklqbt00qx69grkzilygsg%2526corpRedirectUri%253D%2526subdomain%253Dcov&up.pb_site_name=auth&up.page_path=%2Fcov%2Fsign-in&up.user_id_value=&up.zip_code=NaN&tfd=847
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 system-wide Show response
cov.savings.beneplace.com/api/notifications/ 2 B
721 B 365ms
364ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/notifications/system-wide

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19720480c049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:14 GMT

GET
H3 200 info Show response
cov.savings.beneplace.com/api/ 8 KB
3 KB 151ms
150ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09dc58b540d643885c9f181db56f87d3b1abbc3b3c3b63d8d12b43051620c0c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19720480f049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:13 GMT

GET
H3 200 info Show response
cov.savings.beneplace.com/api/ 8 KB
3 KB 138ms
138ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09dc58b540d643885c9f181db56f87d3b1abbc3b3c3b63d8d12b43051620c0c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197204810049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:13 GMT

GET
H3 200 cov Show response
cov.savings.beneplace.com/api/controls/ 2 KB
2 KB 157ms
156ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/controls/cov

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7afd9a10c8ddc93d6ca6d3245a21999d408db30ab4bf31e792e213b0b80d7cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197204811049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:13 GMT

GET
H3 200 marketplace-styles.css Show response
cov.savings.beneplace.com/api/cov/ 32 KB
5 KB 865ms
865ms XHR
text/css 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/cov/marketplace-styles.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45488e2eb081b32f43e0cbfe2ba9dce4a893e4f5ea5f43c0f110a21717c6e6e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8095-csWeogI50zjyoFXVCCvioZ8EkgE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197204813049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:14 GMT

GET
H3 200 auth-v2 Show response
cov.savings.beneplace.com/api/google-experiments/ 4 KB
3 KB 347ms
347ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/google-experiments/auth-v2

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a83eaf590f2c078872c01c0f332037dc8fef2a3a2f925d9d8ea5425d0172cf99

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"fd8-xTrkXE581f1SQMoUGwMfCAmZvJg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197204814049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:14 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
25 KB 7ms
7ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::649 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 04 Mar 2024 11:40:14 GMT
strict-transport-security: max-age=300
x-amz-request-id: XKNH2N4BMHCM512R
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: 4mexhU0yeIewKmDeZm96VoQ5sJoXlVDLPLvdECeQEQCLYnoSPdDtx9GVJ5S3Dd2cS0NTUzBv+mg=
x-served-by: cache-fra-etou8220080-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 306

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 40 B
470 B 365ms
365ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1316&ck=0&s=fe53cca7cce7133c&ref=https://auth.savings.workingadvantage.com/cov/sign-in&af=err,xhr,stn,ins,spa&be=540&fe=761&dc=759&perf=%7B%22timing%22:%7B%22of%22:1709552413465,%22n%22:0,%22r%22:1,%22re%22:135,%22f%22:135,%22dn%22:135,%22dne%22:135,%22c%22:135,%22s%22:135,%22ce%22:135,%22rq%22:135,%22rp%22:540,%22rpe%22:540,%22di%22:693,%22ds%22:1297,%22de%22:1299,%22dc%22:1299,%22l%22:1299,%22le%22:1301%7D,%22navigation%22:%7B%22rc%22:1%7D%7D
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 5ca742541d65d718402499ed1d84d003258ce2116562169b85744cf7d798485a

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
server: envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 40
x-served-by: cache-fra-etou8220039-FRA

GET
H3 200 auth Show response
cov.savings.beneplace.com/api/navigation/cov/auth_footer/US/ 703 B
1021 B 177ms
176ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/navigation/cov/auth_footer/US/auth

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8333099dc491414e5e20d0c8ae95419e9fbb3f8743ed94242569a6c633b33e7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"2bf-DBf4awcV4RPWhcxAtHTLDdgnDd8"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1972138ec049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:14 GMT

GET
H3 200 cov Show response
cov.savings.beneplace.com/api/controls/ 2 KB
2 KB 720ms
720ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/controls/cov

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7afd9a10c8ddc93d6ca6d3245a21999d408db30ab4bf31e792e213b0b80d7cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1972279dc049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:14 GMT

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
404 B 187ms
187ms XHR
image/gif 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1693&ck=0&s=fe53cca7cce7133c&ref=https://auth.savings.workingadvantage.com/cov/sign-in
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
server: envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: image/gif
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
Connection: close
Content-Length: 24
x-served-by: cache-fra-etou8220039-FRA

GET
H3 200 onetrust Show response
cov.savings.beneplace.com/api/platform/options/ 501 B
1 KB 135ms
135ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/platform/options/onetrust

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62ddcfd1e1318d9944204e7104ce0e982b8bd3ae870aa28e9b12148f251a1e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f5-qBdkJZdemwsY4VL06j2IaGB8E5Y"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197270e23049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:14 GMT

POST
H3 200 known
auth.savings.workingadvantage.com/auth/ 522 B
1 KB 252ms
252ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/auth/known?subdomain=cov

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

tracestate: 88831@nr=0-1-2647367-1120218725-dc42fb86b5c1ceac----1709552415873
traceparent: 00-0cb499c95f973e41e34dca82867db100-dc42fb86b5c1ceac-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImRjNDJmYjg2YjVjMWNlYWMiLCJ0ciI6IjBjYjQ5OWM5NWY5NzNlNDFlMzRkY2E4Mjg2N2RiMTAwIiwidGkiOjE3MDk1NTI0MTU4NzMsInRrIjoiODg4MzEifX0=
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https:%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"20a-VlN93Y5TLch6j+SUFOlU2UhIPYM"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19727390090e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:15 GMT

GET info
cov.savings.beneplace.com/api/ 0
0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=42152850&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%3A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253Fdlk%253D5e4nklqbt00qx69grkzilygsg%2526corpRedirectUri%253D%2526subdomain%253Dcov&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za220&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1647679762

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49241
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 id Show response
dpm.demdex.net/ 185 B
695 B 34ms
34ms XHR
application/json 54.74.69.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&d_mid=24525265414284735852720252461896046548&d_coppa=true&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=adobe_ecid%0124525265414284735852720252461896046548&d_cid_ic=ecid%0124525265414284735852720252461896046548&d_cid_ic=mcid%0124525265414284735852720252461896046548&ts=1709552415887

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.74.69.97 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e7b466d03c077be3cef87e5d269f794fcf58efd8c5752e57b3730665fb0d0854

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

dcs: dcs-prod-irl1-2-v057-0e8754189.edge-irl1.demdex.com 3 ms
pragma: no-cache
date: Mon, 04 Mar 2024 11:40:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: /WPPIJC4RGQ=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
x-error: 300,300
content-length: 186
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 RCfc27f81c245c44b78fbb03ff4af1a6be-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 343 B
483 B 11ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCfc27f81c245c44b78fbb03ff4af1a6be-source.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1870780f32d372a63e30a169bef356b78fc9a0ebfbbef37f99b410244fce3ce7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Mon, 04 Mar 2024 12:40:15 GMT

GET
H2 200 RC986b4d5825364bd4887033e40e20c549-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 757 B
697 B 11ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC986b4d5825364bd4887033e40e20c549-source.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 414a9f7ce391b6e34dab805c9dcea7be275b3e3079faf5947fb61e04278c897e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 428
expires: Mon, 04 Mar 2024 12:40:15 GMT

POST
H2 200 delivery Show response
starget.workingadvantage.com/rest/v1/ 781 B
954 B 135ms
44ms XHR
application/json 66.235.152.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://starget.workingadvantage.com/rest/v1/delivery?client=entertainmentbenefit&sessionId=967359bfbb384454bb7d50198f0e0b16&version=2.8.2

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.221 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

0ccd1675d03d7027b27c997c76fa82cd5c1e0ca589fbc9a20cb4191b18ca1dff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: cb2b04c2-a1a2-47eb-9f03-9f6e17caa069

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 241 KB
81 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

acb83c3648c06eec1ff391ab941b7b0cf52e11d513bf62bd8ac51d30f33874a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82642
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 193 KB
70 KB 25ms
25ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2876877-9

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b6717bc8b8ff3db6149c6047d49eb7f083f2c95aae789a7bbb7efebb813789a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71878
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:15 GMT

GET mouseflow
cov.savings.beneplace.com/api/platform/options/ 0
0

POST
H2 200 s15718677506273
smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LDQM/ 43 B
367 B 23ms
23ms XHR
image/gif 63.140.62.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LDQM/s15718677506273

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 05 Mar 2024 11:40:16 GMT
server: jag
etag: 3671235860807581696-4617844511926722210
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Sun, 03 Mar 2024 11:40:16 GMT

POST
H2 204 delivery
starget.workingadvantage.com/rest/v1/ 0
98 B 39ms
38ms Ping
text/plain 66.235.152.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://starget.workingadvantage.com/rest/v1/delivery?client=entertainmentbenefit&sessionId=967359bfbb384454bb7d50198f0e0b16&version=2.8.2

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.221 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
server: jag
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
x-request-id: 47e8a88b-0404-463b-9661-6c84307e4019

GET
H3 200 relay Show response
cov.savings.workingadvantage.com/ 8 KB
3 KB 114ms
113ms Document
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/main.376bcc3f5834c9a3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02d1688e9273d132504a4356fa8d9a822720341b320723e2215261a6971d1820

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85f19728ea2e90e6-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:16 GMT
last-modified: Thu, 29 Feb 2024 11:14:37 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=42152850&t=event&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26redirect_uri%3Dhttps%3A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253Fdlk%253D5e4nklqbt00qx69grkzilygsg%2526corpRedirectUri%253D%2526subdomain%253Dcov&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=dlk&ea=dlk-auth-success.interaction&el=%7Ccov%7C5e4nklqbt00qx69grkzilygsg%7Chttps%3A%2F%2Fcov.savings.workingadvantage.com%2F%7C&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za220&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1917239987

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49242
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 661 KB
155 KB 13ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a5ff70f6ac07dd9865153de5810ff20130a8e033bc547a36598c01bd4de1dc74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:35 GMT
server: AkamaiNetStorage
etag: "f72c7e4973313980f51ed6fa9b44d977:1707952175.514279"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 158823
expires: Mon, 04 Mar 2024 12:40:16 GMT

GET
H3 200 new-relic-integration.js Show response
cov.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 122ms
121ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:36 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e0671c-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f19729aaae90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 21ms
20ms Stylesheet
text/css 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8327825
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230082-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BhiG5eOPxvz1AEBJ01mecqVwAxncQV%2B%2Bu2WpS2OKaC%2FQHsssR2Utbcr1qH%2FVFHWw2HuAt3w6DItvz6qqLEYLOZE3DhV8QB3S7bH8VOkUl2ZRHrYNUNtnJpKymB3Qlu%2FZegoj6VlU67dHgwcIOBE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85f19729acbc196d-FRA

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 222 KB
74 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

3522991d63b0d16a8d330947e3df263de29a664b90320655ce99bee43de8c82d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75427
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 19ms
17ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5565738
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cLmK%2F2V5A4t6%2B4vd6ZUrMMdxTtEzQT9ypduoEl8r1Fuf7pGQZnjrPbiMNUYop6giDCsk7hXUNsF%2BjRTK%2FM0W3Q%2Bnc8i7%2BkbEScuniCSyp9q03mOa6q127nUmwF16pT7ZUkUEhAMDk%2FIry6qW45Z4tZs%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f19729bbb4372e-FRA
expires: Sat, 22 Feb 2025 11:40:16 GMT

GET
H3 200 runtime.06f1d45f19b2d7e5.js Show response
cov.savings.workingadvantage.com/ 4 KB
2 KB 401ms
400ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/runtime.06f1d45f19b2d7e5.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5328503ff5a99f4f34d62c11281034959485894d66071d3d71be1164fda8530

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-e90"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19729aaaf90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.0f88da5fdbf95761.js Show response
cov.savings.workingadvantage.com/ 141 KB
49 KB 140ms
139ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/polyfills.0f88da5fdbf95761.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46f16c323557a318dd6604bab3ebe8dbd9d23bc318b55eec33b0b0a4502c0bd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-234ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19729aab090e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.1baad6c013597821.js Show response
cov.savings.workingadvantage.com/ 166 KB
54 KB 132ms
130ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/scripts.1baad6c013597821.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aef73d8723fb7d91d516282c5a33140f448212e7d49898baab65f6c8b74ddc6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06713-29758"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f1972a8b3e90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.1f738b905888de82.js Show response
cov.savings.workingadvantage.com/ 5 MB
1 MB 128ms
126ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/main.1f738b905888de82.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3f35557d144f6010fca4fe85acdd228c963c1b078c0fb4d7dedb8072fbe5866

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-504fdd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19729aab190e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 241 KB
81 KB 33ms
32ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a2f575e992a274662155ef7fc420be7e7bbf01a37d8a1c2bc671bb6c0d8fe1eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82653
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:16 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 14ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 04 Mar 2024 12:40:16 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 14ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 04 Mar 2024 12:40:16 GMT

GET
H3 200 styles.f02f3e4d86a48b3e.css
cov.savings.workingadvantage.com/ 95 KB
16 KB 118ms
117ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/styles.f02f3e4d86a48b3e.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3d356230da20a9876271fbb4c85ffa912fe03868fe3021069d1a1c3415a072

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06713-17af1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f1972a8b3f90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 12ms
12ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:59:47 GMT
x-content-type-options: nosniff
age: 528029
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 08:59:47 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 24ms
23ms XHR
application/json 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
94 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

82f6bf68f7edd86a0272506bd126ebb2bef059131a1dd3949d1694dfcfcf71fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96087
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:16 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Mar 2024 11:32:03 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 493
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Mar 2024 13:32:03 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 15ms
15ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1618608613&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%2540cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%2540cov.com&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&_slc=1&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1038798551

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles.f02f3e4d86a48b3e.css
cov.savings.workingadvantage.com/ 95 KB
16 KB 498ms
497ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/styles.f02f3e4d86a48b3e.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3d356230da20a9876271fbb4c85ffa912fe03868fe3021069d1a1c3415a072

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06713-17af1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f1972b4bb090e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 262 KB
88 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6de626cb6ba2ea085e513e47283c6067abdc5da39cd2ebb836c5245fa7163a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90509
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:16 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 15ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je42t1v9112553684z878847533za200&_p=1709552416273&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1843357478.1709552412&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709552411&sct=1&seg=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%2540cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%2540cov.com&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%2540cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%2540cov.com&up.pb_site_name=cov&up.page_path=%2Frelay&up.user_id_value=&up.zip_code=NaN&tfd=440
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
cov.savings.workingadvantage.com/api/ 7 KB
2 KB 141ms
140ms XHR
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/info

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5f1c401aa792d1a1cca07a225fd018f36cb64b2d53680b68003dfbf50653eb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
tracestate: 88831@nr=0-1-2647367-1120218725-5dc6e50879c0ea16----1709552416996
traceparent: 00-a3c27d5ac296bc9978135f9a72389e00-5dc6e50879c0ea16-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjVkYzZlNTA4NzljMGVhMTYiLCJ0ciI6ImEzYzI3ZDVhYzI5NmJjOTk3ODEzNWY5YTcyMzg5ZTAwIiwidGkiOjE3MDk1NTI0MTY5OTYsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1972e3d6990e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:16 GMT

GET
H3 200 marketplace-styles.css Show response
cov.savings.workingadvantage.com/api/cov/ 32 KB
5 KB 256ms
255ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/cov/marketplace-styles.css

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45488e2eb081b32f43e0cbfe2ba9dce4a893e4f5ea5f43c0f110a21717c6e6e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
tracestate: 88831@nr=0-1-2647367-1120218725-a8490c1ade5af117----1709552416996
traceparent: 00-9b2a24be86beca7162d74a1bd3bb5c00-a8490c1ade5af117-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImE4NDkwYzFhZGU1YWYxMTciLCJ0ciI6IjliMmEyNGJlODZiZWNhNzE2MmQ3NGExYmQzYmI1YzAwIiwidGkiOjE3MDk1NTI0MTY5OTYsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8095-csWeogI50zjyoFXVCCvioZ8EkgE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1972e3d6a90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:16 GMT

GET
H3 200 colors.css Show response
cov.savings.workingadvantage.com/api/cov/ 3 KB
767 B 142ms
142ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/cov/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67550708dbc8934e8597cd5845d9a52786e40de76e56642378fc6edeb1459ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
tracestate: 88831@nr=0-1-2647367-1120218725-224e1421af0e20ef----1709552416997
traceparent: 00-2393e04ce0ba9b50341df4712a8bd400-224e1421af0e20ef-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjIyNGUxNDIxYWYwZTIwZWYiLCJ0ciI6IjIzOTNlMDRjZTBiYTliNTAzNDFkZjQ3MTJhOGJkNDAwIiwidGkiOjE3MDk1NTI0MTY5OTcsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"a5f-d4IlrjjUUtu1BTwST6NSe19xCA8"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1972e3d6b90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:16 GMT

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCea9d317d3a374e44b3f0f8711e38765e-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e197eefb3a6378c1636ca452e85b757536156c962cd4c96cbe86c6ec83b92510

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 751
expires: Mon, 04 Mar 2024 12:40:17 GMT

GET
H2 200 sync Show response
live.rezync.com/ 5 KB
6 KB 155ms
154ms Script
text/javascript 13.32.27.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=5ef4f9c1e806678f2ab0275df01d5ff4&zmpID=ebg-wag3&cache_buster=1709552417042&k=ebg-wag3-pixel-0988
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-113.fra56.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: c54deb27bd39dcafa7ba19ad6287b990beb5ad720f50e530d6f5ee767933b69b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
via: 1.1 747e99d9d8c5e29fdc713cf866bc3f82.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 5446
x-amz-cf-id: ge6ZhEyY52tnacpv839DZ4r1-kvu_faI3u-hR3CY_1Y3_mxHt8VV8w==

GET
H3 200 cov Show response
cov.savings.workingadvantage.com/api/controls/ 2 KB
1 KB 152ms
152ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/controls/cov

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7afd9a10c8ddc93d6ca6d3245a21999d408db30ab4bf31e792e213b0b80d7cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
tracestate: 88831@nr=0-1-2647367-1120218725-1671e52b55750ff9----1709552417139
traceparent: 00-dd4aca06b8e54f61be7f5b048afeee00-1671e52b55750ff9-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjE2NzFlNTJiNTU3NTBmZjkiLCJ0ciI6ImRkNGFjYTA2YjhlNTRmNjFiZTdmNWIwNDhhZmVlZTAwIiwidGkiOjE3MDk1NTI0MTcxMzksInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1972f1dd690e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:16 GMT

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/ebg-wag3/ 93 KB
30 KB 10ms
10ms Script
application/javascript 18.66.122.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/ebg-wag3/p13n.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-57.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 62ec57b7f971a77af7380ce75ee21e1b881fd1fa628efdb36607125004cca092

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: wRWB6X7wlph0uyMEnzVVd.0l3.N4rmfh
Content-Encoding: gzip
Via: 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront)
Date: Mon, 04 Mar 2024 11:04:35 GMT
X-Amz-Cf-Pop: FRA60-P2
Age: 2143
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Fri, 01 Mar 2024 04:43:11 GMT
Server: AmazonS3
ETag: W/"a036c704209d386b667790a5a0757a3f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: W3VFMn08b4435CraHhr7GjJrRszOH3O9n3AghKDaHxv5wpwELN_h9Q==

GET
H/1.1 200
OK / Show response
com-wag3.netmng.com/ 0
240 B 88ms
87ms Script
text/html 199.38.167.54
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://com-wag3.netmng.com/?aid=6366&siclientid=105368&url=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%2540cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%2540cov.com&p5=&p6=&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=&ref=https%3A%2F%2Fauth.savings.workingadvantage.com%2F
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.38.167.54 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Mon, 04 Mar 2024 11:40:17 GMT
X-Cnection: close
Content-Encoding: gzip
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2

200

;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552417.120193
adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CKrRtoTD2oQDFSTJOwIdAbcIIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=h...
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=12084042;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workin...
https://ad.doubleclick.net/ddm/activity/src=12084042;dc_pre=CKrRtoTD2oQDFSTJOwIdAbcIIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u...
https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CKrRtoTD2oQDFSTJOwIdAbcIIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u2...

42 B
107 B

43ms
43ms

Image
image/gif

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CKrRtoTD2oQDFSTJOwIdAbcIIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workingadvantage.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552417.120193

Requested by

Protocol

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 04 Mar 2024 11:40:17 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"2820240056842077969"}],"aggregatable_trigger_data":[{"filters":{"14":["12836263"]},"key_piece":"0x53f402ca3ba6efa","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x7fc39fb387ab29c2","not_filters":{"14":["12836263"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["12836263"]},"key_piece":"0x7dcc41a70aba3d22","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xd89ab4266f1d78ab","not_filters":{"14":["12836263"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"4138330568102955959","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"2820240056842077969","filters":{"14":["12836263"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"2820240056842077969","filters":{"14":["12836263"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"2820240056842077969","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"2820240056842077969","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["12084042"]}}
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: image/png
location: https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CKrRtoTD2oQDFSTJOwIdAbcIIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workingadvantage.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552417.120193
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 seg
secure.adnxs.com/ 43 B
1 KB 16ms
16ms Image
image/gif 185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/seg?add=32509374&t=2

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:17 GMT
an-x-request-uuid: 6a73a489-9f4e-46e4-8053-3dcca39ea31b
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.200; 80.255.10.200; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 track Show response
events.api.boomtrain.com/event/ 2 B
208 B 118ms
118ms XHR
text/plain 3.216.161.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.161.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-161-250.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Mon, 04 Mar 2024 11:40:17 GMT
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain

GET
H3 200 872.194065e01ea991c5.js Show response
cov.savings.workingadvantage.com/ 4 KB
2 KB 119ms
119ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/872.194065e01ea991c5.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aba7991bfc62a413ff4a27b8882721bd3c3f0e858a75501979e34306e1b64fa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-11ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f197301e9990e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3

200

silent-refresh.html
cov.savings.workingadvantage.com/ Frame 19B3
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=cov&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fsilent-refre...
https://cov.savings.workingadvantage.com/silent-refresh.html

166 B
674 B

119ms
119ms

Document
text/html

104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/silent-refresh.html

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cov.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85f197310f6190e6-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:17 GMT
last-modified: Thu, 29 Feb 2024 11:14:35 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 85f197302e9d90e6-FRA
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:17 GMT
expires: Mon, 04 Mar 2024 11:40:16 GMT
location: https://cov.savings.workingadvantage.com/silent-refresh.html#grant_type=authorization_code&code=43tAMFuDEIMky65RCTBDKl&subdomain=cov&client_id=9ezalirn45mF43imJTdf53&user_guid=5e4nklqbt00qx69grkzilygsg&token_refreshed=true
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H2 200 RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 451 B
554 B 11ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8c8854741b41041a55e30363186b3e943076de5f80c39d1bb82ed6efbc5f8a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 286
expires: Mon, 04 Mar 2024 12:40:17 GMT

GET
H2 200 RC668a267ca36c45b5acca38f3e4360a76-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 340 B
482 B 18ms
17ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC668a267ca36c45b5acca38f3e4360a76-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8004dadb6b1625999c7de43a05d9c2d7fc4ac26ec644a95bfbd113c70b80c9a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Mon, 04 Mar 2024 12:40:17 GMT

GET
H3 401 dlk-compare
cov.savings.workingadvantage.com/api/known/ 182 B
513 B 129ms
128ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/known/dlk-compare?guid=5e4nklqbt00qx69grkzilygsg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-3f218508616cca74----1709552417435
traceparent: 00-08f1e83dee7ee715d05e3f2d80667100-3f218508616cca74-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjNmMjE4NTA4NjE2Y2NhNzQiLCJ0ciI6IjA4ZjFlODNkZWU3ZWU3MTVkMDVlM2YyZDgwNjY3MTAwIiwidGkiOjE3MDk1NTI0MTc0MzUsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by
etag: W/"b6-lGFIUF59ZyAYAhOl/ILN9N2OvBU"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cf-ray: 85f19730ff5490e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
content-length: 182
alt-svc: h3=":443"; ma=86400

GET
H3 200 info
cov.savings.workingadvantage.com/api/ 8 KB
3 KB 130ms
129ms XHR
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/info?authInfo=true

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-59c1b6a7ac7fc613----1709552417437
traceparent: 00-9651d69ab718dec554ba8871d9714b00-59c1b6a7ac7fc613-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjU5YzFiNmE3YWM3ZmM2MTMiLCJ0ciI6Ijk2NTFkNjlhYjcxOGRlYzU1NGJhODg3MWQ5NzE0YjAwIiwidGkiOjE3MDk1NTI0MTc0MzcsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19730ff5690e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:16 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1618608613&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=943882841

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49243
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
9ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1618608613&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=839173198

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49243
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3

200

relay Show response
cov.savings.workingadvantage.com/
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=cov&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%...
https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

8 KB
3 KB

124ms
123ms

Document
text/html

104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/main.1f738b905888de82.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02d1688e9273d132504a4356fa8d9a822720341b320723e2215261a6971d1820

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cov.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85f19732c8ce90e6-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:17 GMT
last-modified: Thu, 29 Feb 2024 11:14:37 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 85f19731e80090e6-FRA
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:17 GMT
expires: Mon, 04 Mar 2024 11:40:16 GMT
location: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov#grant_type=authorization_code&code=5tGMLexIHWYo4dgsFDO2m8&subdomain=cov&client_id=9ezalirn45mF43imJTdf53&user_guid=5e4nklqbt00qx69grkzilygsg&token_refreshed=true
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H3 200 token
cov.savings.workingadvantage.com/auth/ 768 B
1 KB 239ms
238ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/auth/token?grant_type=authorization_code&client_id=9ezalirn45mF43imJTdf53&code=43tAMFuDEIMky65RCTBDKl&user_guid=5e4nklqbt00qx69grkzilygsg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/
tracestate: 88831@nr=0-1-2647367-1120218725-d62c8a6c948cc146----1709552417577
traceparent: 00-214022e143be2c73629a9aa0942b1f00-d62c8a6c948cc146-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImQ2MmM4YTZjOTQ4Y2MxNDYiLCJ0ciI6IjIxNDAyMmUxNDNiZTJjNzM2MjlhOWFhMDk0MmIxZjAwIiwidGkiOjE3MDk1NTI0MTc1NzcsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"300-aZksHzl2hEAmFqlqfz76yPUukAc"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19731efff90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:16 GMT

POST collect
region1.google-analytics.com/g/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 661 KB
155 KB 13ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a5ff70f6ac07dd9865153de5810ff20130a8e033bc547a36598c01bd4de1dc74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:35 GMT
server: AkamaiNetStorage
etag: "f72c7e4973313980f51ed6fa9b44d977:1707952175.514279"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 158823
expires: Mon, 04 Mar 2024 12:40:17 GMT

GET
H3 200 new-relic-integration.js Show response
cov.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 126ms
125ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:36 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e0671c-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f19733994f90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 20ms
19ms Stylesheet
text/css 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8327826
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230082-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8fbuwt0EdOAAYbrEHs01ooxO1ZydXoeQJ6tvRlw98q37QQrL8X9zpRaRazn6Dyb243gOJP5K%2BXSr%2BSDq%2BnR3LrFw1EStliGsmSovcpH6NL31fbuNgkzSDg4riBQWQbs7wQwKkpTKflU0ta3HzWM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85f197339d6c196d-FRA

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 222 KB
74 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

3522991d63b0d16a8d330947e3df263de29a664b90320655ce99bee43de8c82d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75427
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 18ms
17ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5565739
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jW10CQaskhnfiGaZ%2FFJ9oIaSKJWVAOwo4pCW4SMm69tM1P3jjd8LUOPkwDf84A%2BxzK0x6yudvydOgSHUVFVSZZAP4iVHbI2B%2BUQl5XxpPCEymNi%2BjlJCld6sgRE5eB%2B1JlOjESVEkGivJ31oomvP1m58"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f197339d61372e-FRA
expires: Sat, 22 Feb 2025 11:40:17 GMT

GET
H3 200 runtime.06f1d45f19b2d7e5.js Show response
cov.savings.workingadvantage.com/ 4 KB
2 KB 120ms
118ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/runtime.06f1d45f19b2d7e5.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5328503ff5a99f4f34d62c11281034959485894d66071d3d71be1164fda8530

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-e90"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19733995190e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.0f88da5fdbf95761.js Show response
cov.savings.workingadvantage.com/ 141 KB
49 KB 123ms
122ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/polyfills.0f88da5fdbf95761.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46f16c323557a318dd6604bab3ebe8dbd9d23bc318b55eec33b0b0a4502c0bd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-234ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19733995290e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.1baad6c013597821.js Show response
cov.savings.workingadvantage.com/ 166 KB
54 KB 120ms
119ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/scripts.1baad6c013597821.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aef73d8723fb7d91d516282c5a33140f448212e7d49898baab65f6c8b74ddc6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06713-29758"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f1973479c490e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.1f738b905888de82.js Show response
cov.savings.workingadvantage.com/ 5 MB
1 MB 157ms
156ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/main.1f738b905888de82.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3f35557d144f6010fca4fe85acdd228c963c1b078c0fb4d7dedb8072fbe5866

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-504fdd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f19733995390e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 241 KB
81 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9d390bff49c893f0556cc3a63eaf4c927ccab393c48109845c85456ac0b62535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82643
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:17 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 12ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 04 Mar 2024 12:40:17 GMT

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:17 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 04 Mar 2024 12:40:17 GMT

GET
H3 200 styles.f02f3e4d86a48b3e.css
cov.savings.workingadvantage.com/ 95 KB
16 KB 125ms
124ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/styles.f02f3e4d86a48b3e.css

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3d356230da20a9876271fbb4c85ffa912fe03868fe3021069d1a1c3415a072

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06713-17af1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f1973479c590e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:59:47 GMT
x-content-type-options: nosniff
age: 528030
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 08:59:47 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
94 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

82f6bf68f7edd86a0272506bd126ebb2bef059131a1dd3949d1694dfcfcf71fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96087
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:18 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Mar 2024 11:32:03 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 495
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Mar 2024 13:32:03 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 16ms
15ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=851984552&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&_slc=1&gtm=45He42t1n815QN8HWMv78847533za220&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1787754463

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 21ms
19ms XHR
application/json 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 262 KB
88 KB 19ms
19ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c1e7e0ae9257818e4e87b7eec7d9a5bf770c717e9d4c1e25cd800d8a3f189dc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90496
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:18 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 16ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je42t1v9112553684z878847533za200&_p=1709552417861&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1843357478.1709552412&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709552411&sct=1&seg=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&up.pb_site_name=cov&up.page_path=%2Frelay&up.user_id_value=&up.zip_code=NaN&tfd=556
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:18 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles.f02f3e4d86a48b3e.css
cov.savings.workingadvantage.com/ 95 KB
16 KB 150ms
149ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/styles.f02f3e4d86a48b3e.css

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov#grant_type=authorization_code&code=5tGMLexIHWYo4dgsFDO2m8&subdomain=cov&client_id=9ezalirn45mF43imJTdf53&user_guid=5e4nklqbt00qx69grkzilygsg&token_refreshed=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3d356230da20a9876271fbb4c85ffa912fe03868fe3021069d1a1c3415a072

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06713-17af1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f197357a7290e6-FRA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
cov.savings.workingadvantage.com/api/ 7 KB
3 KB 194ms
193ms XHR
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/info

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5f1c401aa792d1a1cca07a225fd018f36cb64b2d53680b68003dfbf50653eb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxNywiZXhwIjoxNzA5NTU2MDE3fQ.uCENoInqoIdAVe1Y90FYyi1TJa7dEmFR5lI_AY2OvqI
tracestate: 88831@nr=0-1-2647367-1120218725-f7dde7d9fc1443c8----1709552418266
traceparent: 00-2e1dc88e2c362ba33afa8e7a28e6ec00-f7dde7d9fc1443c8-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImY3ZGRlN2Q5ZmMxNDQzYzgiLCJ0ciI6IjJlMWRjODhlMmMzNjJiYTMzYWZhOGU3YTI4ZTZlYzAwIiwidGkiOjE3MDk1NTI0MTgyNjYsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197362ad990e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:17 GMT

GET
H3 200 marketplace-styles.css Show response
cov.savings.workingadvantage.com/api/cov/ 32 KB
5 KB 300ms
299ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/cov/marketplace-styles.css

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45488e2eb081b32f43e0cbfe2ba9dce4a893e4f5ea5f43c0f110a21717c6e6e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxNywiZXhwIjoxNzA5NTU2MDE3fQ.uCENoInqoIdAVe1Y90FYyi1TJa7dEmFR5lI_AY2OvqI
tracestate: 88831@nr=0-1-2647367-1120218725-4719d9b3c65d9b75----1709552418267
traceparent: 00-f9c8d59158ab9dc0a33be3cc3b078500-4719d9b3c65d9b75-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjQ3MTlkOWIzYzY1ZDliNzUiLCJ0ciI6ImY5YzhkNTkxNThhYjlkYzBhMzNiZTNjYzNiMDc4NTAwIiwidGkiOjE3MDk1NTI0MTgyNjcsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8095-csWeogI50zjyoFXVCCvioZ8EkgE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197362ada90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:17 GMT

GET
H3 200 colors.css Show response
cov.savings.workingadvantage.com/api/cov/ 3 KB
767 B 190ms
190ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/cov/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67550708dbc8934e8597cd5845d9a52786e40de76e56642378fc6edeb1459ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxNywiZXhwIjoxNzA5NTU2MDE3fQ.uCENoInqoIdAVe1Y90FYyi1TJa7dEmFR5lI_AY2OvqI
tracestate: 88831@nr=0-1-2647367-1120218725-9cc5916343c0f041----1709552418267
traceparent: 00-a41100fe09a231312634c7e671ebf900-9cc5916343c0f041-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjljYzU5MTYzNDNjMGYwNDEiLCJ0ciI6ImE0MTEwMGZlMDlhMjMxMzEyNjM0YzdlNjcxZWJmOTAwIiwidGkiOjE3MDk1NTI0MTgyNjcsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"a5f-d4IlrjjUUtu1BTwST6NSe19xCA8"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197362adc90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:17 GMT

GET
H2 200 RCea9d317d3a374e44b3f0f8711e38765e-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 2 KB
1019 B 17ms
16ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCea9d317d3a374e44b3f0f8711e38765e-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e197eefb3a6378c1636ca452e85b757536156c962cd4c96cbe86c6ec83b92510

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 751
expires: Mon, 04 Mar 2024 12:40:18 GMT

GET
H2 200 sync Show response
live.rezync.com/ 5 KB
6 KB 288ms
288ms Script
text/javascript 13.32.27.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=5ef4f9c1e806678f2ab0275df01d5ff4&zmpID=ebg-wag3&cache_buster=1709552418310&k=ebg-wag3-pixel-0988
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-113.fra56.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: f0f67419a0860edb8b8202200dd5e9f25954be68e85e3f40241f66e44326cd80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
via: 1.1 747e99d9d8c5e29fdc713cf866bc3f82.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 5448
x-amz-cf-id: jFREdJfukRmW2D4NtTetRh3NOh-_yahWrUFylswqQ_eo8FwmYCDreg==

GET
H3 200 cov Show response
cov.savings.workingadvantage.com/api/controls/ 2 KB
1 KB 643ms
643ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/controls/cov

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7afd9a10c8ddc93d6ca6d3245a21999d408db30ab4bf31e792e213b0b80d7cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxNywiZXhwIjoxNzA5NTU2MDE3fQ.uCENoInqoIdAVe1Y90FYyi1TJa7dEmFR5lI_AY2OvqI
tracestate: 88831@nr=0-1-2647367-1120218725-8ac914793cddeaeb----1709552418462
traceparent: 00-ce526804fe8494f6c197778b1e228f00-8ac914793cddeaeb-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjhhYzkxNDc5M2NkZGVhZWIiLCJ0ciI6ImNlNTI2ODA0ZmU4NDk0ZjZjMTk3Nzc4YjFlMjI4ZjAwIiwidGkiOjE3MDk1NTI0MTg0NjIsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197376b9a90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:18 GMT

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/ebg-wag3/ 93 KB
30 KB 8ms
8ms Script
application/javascript 18.66.122.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/ebg-wag3/p13n.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-57.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 62ec57b7f971a77af7380ce75ee21e1b881fd1fa628efdb36607125004cca092

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: wRWB6X7wlph0uyMEnzVVd.0l3.N4rmfh
Content-Encoding: gzip
Via: 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront)
Date: Mon, 04 Mar 2024 11:04:35 GMT
X-Amz-Cf-Pop: FRA60-P2
Age: 2144
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Fri, 01 Mar 2024 04:43:11 GMT
Server: AmazonS3
ETag: W/"a036c704209d386b667790a5a0757a3f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: 7A5254k3QIudIburnyw4y98xnHEYC2h7Epc9l9RghooSdEh9ed-Kmw==

GET
H/1.1 200
OK / Show response
com-wag3.netmng.com/ 0
240 B 87ms
87ms Script
text/html 199.38.167.54
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://com-wag3.netmng.com/?aid=6366&siclientid=105368&url=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%23grant_type%3Dauthorization_code%26code%3D5tGMLexIHWYo4dgsFDO2m8%26subdomain%3Dcov%26client_id%3D9ezalirn45mF43imJTdf53%26user_guid%3D5e4nklqbt00qx69grkzilygsg%26token_refreshed%3Dtrue&p5=&p6=&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.38.167.54 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Mon, 04 Mar 2024 11:40:18 GMT
X-Cnection: close
Content-Encoding: gzip
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3

200

;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552418.5250459
adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CIeUjIXD2oQDFRb0OwIdHdYFIQ;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=h...
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=12084042;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workin...
https://ad.doubleclick.net/ddm/activity/src=12084042;dc_pre=CIeUjIXD2oQDFRb0OwIdHdYFIQ;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u...
https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CIeUjIXD2oQDFRb0OwIdHdYFIQ;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u2...

42 B
63 B

41ms
41ms

Image
image/gif

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CIeUjIXD2oQDFRb0OwIdHdYFIQ;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workingadvantage.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552418.5250459

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 04 Mar 2024 11:40:18 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"8515113986291237932"}],"aggregatable_trigger_data":[{"filters":{"14":["12836263"]},"key_piece":"0x53f402ca3ba6efa","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x7fc39fb387ab29c2","not_filters":{"14":["12836263"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["12836263"]},"key_piece":"0x7dcc41a70aba3d22","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xd89ab4266f1d78ab","not_filters":{"14":["12836263"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"7620548473384100336","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"8515113986291237932","filters":{"14":["12836263"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"8515113986291237932","filters":{"14":["12836263"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"8515113986291237932","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"8515113986291237932","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["12084042"]}}
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: image/png
location: https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CIeUjIXD2oQDFRb0OwIdHdYFIQ;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workingadvantage.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552418.5250459
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 seg
secure.adnxs.com/ 43 B
1 KB 15ms
15ms Image
image/gif 185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/seg?add=32509374&t=2

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:18 GMT
an-x-request-uuid: d66cc0f8-b6a1-4f07-ad10-7d5aa4e3495a
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.200; 80.255.10.200; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 track Show response
events.api.boomtrain.com/event/ 2 B
208 B 110ms
110ms XHR
text/plain 3.216.161.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.161.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-161-250.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Mon, 04 Mar 2024 11:40:18 GMT
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
25 KB 8ms
8ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::649 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=300
x-amz-request-id: XKNH2N4BMHCM512R
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: 4mexhU0yeIewKmDeZm96VoQ5sJoXlVDLPLvdECeQEQCLYnoSPdDtx9GVJ5S3Dd2cS0NTUzBv+mg=
x-served-by: cache-fra-etou8220080-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 307

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 40 B
469 B 399ms
399ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1220&ck=0&s=41ef36ba9d343f7d&ref=https://cov.savings.workingadvantage.com/relay&af=err,xhr,stn,ins,spa&be=277&fe=891&dc=423&perf=%7B%22timing%22:%7B%22of%22:1709552417570,%22n%22:0,%22f%22:153,%22dn%22:153,%22dne%22:153,%22c%22:153,%22s%22:153,%22ce%22:153,%22rq%22:154,%22rp%22:277,%22rpe%22:277,%22di%22:424,%22ds%22:698,%22de%22:700,%22dc%22:1166,%22l%22:1167,%22le%22:1168%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 5ca742541d65d718402499ed1d84d003258ce2116562169b85744cf7d798485a

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
server: envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 40
x-served-by: cache-fra-etou8220135-FRA

GET
H3 200 token Show response
cov.savings.workingadvantage.com/auth/ 768 B
1 KB 191ms
190ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/auth/token?grant_type=authorization_code&client_id=9ezalirn45mF43imJTdf53&code=5tGMLexIHWYo4dgsFDO2m8&user_guid=5e4nklqbt00qx69grkzilygsg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c7b61634f0b0ba4d0d79b30132254a563e48693fb403ef43a9fbd59c85f9333

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
tracestate: 88831@nr=0-1-2647367-1120218725-50d8181ba89245cf----1709552418807
traceparent: 00-5b39547199428701b47a69b088bb4d00-50d8181ba89245cf-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjUwZDgxODFiYTg5MjQ1Y2YiLCJ0ciI6IjViMzk1NDcxOTk0Mjg3MDFiNDdhNjliMDg4YmI0ZDAwIiwidGkiOjE3MDk1NTI0MTg4MDcsInRrIjoiODg4MzEifX0=

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"300-4kLt8enqjRJ+/3H1dycsULFK98Q"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197398d1290e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:17 GMT

GET
H2 200 RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 451 B
554 B 10ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8c8854741b41041a55e30363186b3e943076de5f80c39d1bb82ed6efbc5f8a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 286
expires: Mon, 04 Mar 2024 12:40:18 GMT

GET
H2 200 RC0c16579d5c704bd0a214633d669d35f2-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 1018 B
815 B 11ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC0c16579d5c704bd0a214633d669d35f2-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bb5b688508b532c8599179a5a20d10a399dff6e818f7d4299a2783cdaa72b284

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 547
expires: Mon, 04 Mar 2024 12:40:18 GMT

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC668a267ca36c45b5acca38f3e4360a76-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8004dadb6b1625999c7de43a05d9c2d7fc4ac26ec644a95bfbd113c70b80c9a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:18 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Mon, 04 Mar 2024 12:40:18 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=851984552&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za220&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=394806713

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49245
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 872.194065e01ea991c5.js
cov.savings.workingadvantage.com/ 4 KB
2 KB 137ms
128ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/872.194065e01ea991c5.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-11ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1973b9e4d90e6-FRA
alt-svc: h3=":443"; ma=86400

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H3 200 sign-in Show response
auth.savings.workingadvantage.com/cov/ 10 KB
3 KB 116ms
116ms Document
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/main.1f738b905888de82.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4264bfa87de5afd4b0236f34dfeee60b2231773a4b404c970c25c4543cd3b4ac

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cov.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85f1973c6ed790e6-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:19 GMT
last-modified: Thu, 29 Feb 2024 11:20:21 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

GET 415.4bab11708e71df5e.js
cov.savings.workingadvantage.com/ 0
0

GET common.7b463af6ac6cff81.js
cov.savings.workingadvantage.com/ 0
0

GET 765.09b507eebafd579c.js
cov.savings.workingadvantage.com/ 0
0

GET 811.40ccd40dcf1e23e9.js
cov.savings.workingadvantage.com/ 0
0

GET 182.baea2c870d8d1e44.js
cov.savings.workingadvantage.com/ 0
0

GET 439.6bac25321cbf5331.js
cov.savings.workingadvantage.com/ 0
0

GET 380.69d0ae77386089cf.js
cov.savings.workingadvantage.com/ 0
0

GET 488.b314d764eef2f542.js
cov.savings.workingadvantage.com/ 0
0

GET 521.0616133d4b981c59.js
cov.savings.workingadvantage.com/ 0
0

GET 286.b2048c7b020ae8f0.js
cov.savings.workingadvantage.com/ 0
0

GET 230.6ee89c44dfdd4e41.js
cov.savings.workingadvantage.com/ 0
0

GET 889.3a83cf909e03a570.js
cov.savings.workingadvantage.com/ 0
0

GET 436.bd69dbd57bbc0a77.js
cov.savings.workingadvantage.com/ 0
0

GET 125.e62b3ee14c2c1379.js
cov.savings.workingadvantage.com/ 0
0

GET 417.1a13af1bc3bede6a.js
cov.savings.workingadvantage.com/ 0
0

GET 341.765d455724ecaf82.js
cov.savings.workingadvantage.com/ 0
0

GET
H3 200 S6u9w4BMUTPHh7USSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 11ms
8ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ3q5d0.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 02:36:50 GMT
x-content-type-options: nosniff
age: 464609
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13912
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Feb 2025 02:36:50 GMT

GET onetrust
cov.savings.workingadvantage.com/api/platform/options/ 0
0

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 18:20:53 GMT
x-content-type-options: nosniff
age: 580766
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14168
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:29:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 Feb 2025 18:20:53 GMT

GET system-wide
cov.savings.workingadvantage.com/api/notifications/ 0
0

GET profile
cov.savings.workingadvantage.com/api/ 0
0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=851984552&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za220&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=887987179

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49245
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET Drone_WA_primary_color.gif
cov.savings.workingadvantage.com/assets/relay/ 0
0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=851984552&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fhome&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za220&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=2030830903

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49245
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET shopping-cart.svg
cov.savings.workingadvantage.com/assets/header/ 0
0

GET cov_logo_wide_03.png
g3i.imgix.net/uploads/ 0
0

GET profile
cov.savings.workingadvantage.com/api/ 0
0

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 661 KB
155 KB 19ms
12ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a5ff70f6ac07dd9865153de5810ff20130a8e033bc547a36598c01bd4de1dc74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:35 GMT
server: AkamaiNetStorage
etag: "f72c7e4973313980f51ed6fa9b44d977:1707952175.514279"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 158823
expires: Mon, 04 Mar 2024 12:40:19 GMT

GET
H3 200 new-relic-integration.js Show response
auth.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 126ms
121ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:20 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06874-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f1973d3f7c90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 32ms
26ms Stylesheet
text/css 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8327828
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230082-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nqDCr%2FMqzFiISMJUyNS8KZgPUZLJbov53sQfPspFlQn8Ivxf66VVhhJgDNm1la30oy2GL207rEmMFWO4NOysebkGw2lEZiWht1lkNTcbQ5ccX6iMYF6V6W5Zs6OkN26unwUqK4Sa7GFGoyIIENw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85f1973d3f6c196d-FRA

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 222 KB
74 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

3522991d63b0d16a8d330947e3df263de29a664b90320655ce99bee43de8c82d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75427
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 24ms
18ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5565741
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9%2BbjgIZne8GtH3twe7sYPlUzbew2KayIaWxsJBp1jV%2Fj5eD%2F6U9Ac64KzBKvnB3qhwU7%2BmYDHUMHzv2xWVzUOxB%2B8h2ZdKDY3ZsGO%2F5mcgRhCAZqXg5pFAM%2BupyhQvJ7Bk8hGFpFBY2Rs9%2Bfjk4CeIiz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f1973d3d98372e-FRA
expires: Sat, 22 Feb 2025 11:40:19 GMT

GET
H3 200 runtime.13338c5d9c83d0b6.js Show response
auth.savings.workingadvantage.com/ 1 KB
1 KB 125ms
119ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/runtime.13338c5d9c83d0b6.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

779700103eaa215226d17491070dd24cc4e6ae6533a0f3a4071140805119b45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-488"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1973d3f7d90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.d382160f8481ef1c.js Show response
auth.savings.workingadvantage.com/ 122 KB
43 KB 124ms
119ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/polyfills.d382160f8481ef1c.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c06c3b843d4bcf295909300bfad5473626575eaef96b98615d9d2f294d66058c

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-1e6bf"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1973d3f7e90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.1baad6c013597821.js Show response
auth.savings.workingadvantage.com/ 166 KB
54 KB 134ms
132ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/scripts.1baad6c013597821.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aef73d8723fb7d91d516282c5a33140f448212e7d49898baab65f6c8b74ddc6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06870-29758"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f1973e181c90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.376bcc3f5834c9a3.js Show response
auth.savings.workingadvantage.com/ 2 MB
409 KB 129ms
123ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/main.376bcc3f5834c9a3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be8577e579d9924b36cda3f01fb7aea4f43ed90f9ae689955a0deda006a1ee11

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06870-19e71e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1973d3f7f90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 241 KB
81 KB 22ms
20ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9d390bff49c893f0556cc3a63eaf4c927ccab393c48109845c85456ac0b62535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82643
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:19 GMT

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 04 Mar 2024 12:40:19 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 13ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 04 Mar 2024 12:40:19 GMT

GET
H3 200 styles.4a62f33afffa2c84.css
auth.savings.workingadvantage.com/ 39 KB
8 KB 125ms
123ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/styles.4a62f33afffa2c84.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0bf599966dd39864588776600dcc12f05f281fe550157d82950665735ab2da0c

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:20:16 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06870-9b6a"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f1973e181f90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:59:47 GMT
x-content-type-options: nosniff
age: 528032
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 08:59:47 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
94 KB 27ms
27ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1ef572c8a4cd4f09169c51d0e1f7e2cc5fe1c4dd0a34a7774d3ce8c5a38dfdca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96088
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:19 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Mar 2024 11:32:03 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 496
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Mar 2024 13:32:03 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 20ms
18ms XHR
application/json 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 17ms
17ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1701265131&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253FcorpRedirectUri%253D%2526subdomain%253Dcov%26client_id%3D9ezalirn45mF43imJTdf53&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&_slc=1&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=754568170

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 system-wide Show response
cov.savings.beneplace.com/api/notifications/ 2 B
720 B 134ms
134ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/notifications/system-wide

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1973f2c95049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:18 GMT

GET
H3 200 info Show response
cov.savings.beneplace.com/api/ 8 KB
3 KB 484ms
483ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09dc58b540d643885c9f181db56f87d3b1abbc3b3c3b63d8d12b43051620c0c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1973f2c9f049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

GET
H3 200 info Show response
cov.savings.beneplace.com/api/ 8 KB
3 KB 131ms
130ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09dc58b540d643885c9f181db56f87d3b1abbc3b3c3b63d8d12b43051620c0c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1973f2ca4049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:18 GMT

GET
H3 200 cov Show response
cov.savings.beneplace.com/api/controls/ 2 KB
2 KB 367ms
367ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/controls/cov

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7afd9a10c8ddc93d6ca6d3245a21999d408db30ab4bf31e792e213b0b80d7cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1973f2ca9049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

GET
H3 200 marketplace-styles.css Show response
cov.savings.beneplace.com/api/cov/ 32 KB
5 KB 366ms
366ms XHR
text/css 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/cov/marketplace-styles.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45488e2eb081b32f43e0cbfe2ba9dce4a893e4f5ea5f43c0f110a21717c6e6e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8095-csWeogI50zjyoFXVCCvioZ8EkgE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1973f2cac049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

GET
H3 200 auth-v2 Show response
cov.savings.beneplace.com/api/google-experiments/ 4 KB
3 KB 494ms
494ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/google-experiments/auth-v2

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a83eaf590f2c078872c01c0f332037dc8fef2a3a2f925d9d8ea5425d0172cf99

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"fd8-xTrkXE581f1SQMoUGwMfCAmZvJg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1973f2cae049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 262 KB
88 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

afef051e43df07501bff0f8636fec8be34b9c70d19c50ce7a5bf2ca48c8b095b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:19 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90496
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:19 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 15ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je42t1v9112553684z878847533za200&_p=1709552419397&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1843357478.1709552412&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709552411&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253FcorpRedirectUri%253D%2526subdomain%253Dcov%26client_id%3D9ezalirn45mF43imJTdf53&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26redirect_uri%3Dhttps%253A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253FcorpRedirectUri%253D%2526subdomain%253Dcov%26client_id%3D9ezalirn45mF43imJTdf53&up.pb_site_name=auth&up.page_path=%2Fcov%2Fsign-in&up.user_id_value=&up.zip_code=NaN&tfd=529
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:19 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
25 KB 7ms
7ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::649 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 04 Mar 2024 11:40:19 GMT
strict-transport-security: max-age=300
x-amz-request-id: XKNH2N4BMHCM512R
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: 4mexhU0yeIewKmDeZm96VoQ5sJoXlVDLPLvdECeQEQCLYnoSPdDtx9GVJ5S3Dd2cS0NTUzBv+mg=
x-served-by: cache-fra-etou8220080-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 308

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 40 B
470 B 362ms
362ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=585&ck=0&s=fe53cca7cce7133c&ref=https://auth.savings.workingadvantage.com/cov/sign-in&af=err,xhr,stn,ins,spa&be=118&fe=454&dc=330&perf=%7B%22timing%22:%7B%22of%22:1709552419262,%22n%22:0,%22f%22:0,%22dn%22:0,%22dne%22:0,%22c%22:0,%22s%22:0,%22ce%22:0,%22rq%22:2,%22rp%22:118,%22rpe%22:119,%22di%22:272,%22ds%22:446,%22de%22:447,%22dc%22:570,%22l%22:570,%22le%22:571%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 5ca742541d65d718402499ed1d84d003258ce2116562169b85744cf7d798485a

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
server: envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 40
x-served-by: cache-fra-etou8220101-FRA

GET
H3 200 auth Show response
cov.savings.beneplace.com/api/navigation/cov/auth_footer/US/ 703 B
1019 B 149ms
149ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/navigation/cov/auth_footer/US/auth

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8333099dc491414e5e20d0c8ae95419e9fbb3f8743ed94242569a6c633b33e7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"2bf-DBf4awcV4RPWhcxAtHTLDdgnDd8"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197423f96049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

GET
H3 200 cov Show response
cov.savings.beneplace.com/api/controls/ 2 KB
2 KB 144ms
143ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/controls/cov

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7afd9a10c8ddc93d6ca6d3245a21999d408db30ab4bf31e792e213b0b80d7cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197424fae049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
409 B 97ms
97ms XHR
image/gif 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=960&ck=0&s=fe53cca7cce7133c&ref=https://auth.savings.workingadvantage.com/cov/sign-in
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
server: envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: image/gif
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
Connection: keep-alive
Content-Length: 24
x-served-by: cache-fra-etou8220101-FRA

GET
H3 200 onetrust Show response
cov.savings.beneplace.com/api/platform/options/ 501 B
1 KB 137ms
136ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/platform/options/onetrust

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62ddcfd1e1318d9944204e7104ce0e982b8bd3ae870aa28e9b12148f251a1e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f5-qBdkJZdemwsY4VL06j2IaGB8E5Y"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974338ec049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

POST
H3 200 known
auth.savings.workingadvantage.com/auth/ 522 B
1 KB 408ms
407ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/auth/known?subdomain=cov

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

tracestate: 88831@nr=0-1-2647367-1120218725-d427a231b5f7473b----1709552420375
traceparent: 00-98662fa04440a894a14d261b46d3f000-d427a231b5f7473b-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImQ0MjdhMjMxYjVmNzQ3M2IiLCJ0ciI6Ijk4NjYyZmEwNDQ0MGE4OTRhMTRkMjYxYjQ2ZDNmMDAwIiwidGkiOjE3MDk1NTI0MjAzNzUsInRrIjoiODg4MzEifX0=
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/cov/sign-in?dlk=5e4nklqbt00qx69grkzilygsg&corpRedirectUri=&subdomain=cov&redirect_uri=https:%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&client_id=9ezalirn45mF43imJTdf53

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"20a-VlN93Y5TLch6j+SUFOlU2UhIPYM"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197435bb990e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

GET
H3 200 info Show response
cov.savings.beneplace.com/api/ 8 KB
3 KB 398ms
398ms XHR
text/html 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09dc58b540d643885c9f181db56f87d3b1abbc3b3c3b63d8d12b43051620c0c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19743590c049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1701265131&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26redirect_uri%3Dhttps%3A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253FcorpRedirectUri%253D%2526subdomain%253Dcov%26client_id%3D9ezalirn45mF43imJTdf53&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1554404407

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49246
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 RCfc27f81c245c44b78fbb03ff4af1a6be-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 343 B
483 B 10ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCfc27f81c245c44b78fbb03ff4af1a6be-source.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1870780f32d372a63e30a169bef356b78fc9a0ebfbbef37f99b410244fce3ce7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Mon, 04 Mar 2024 12:40:20 GMT

GET
H2 200 RC986b4d5825364bd4887033e40e20c549-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 757 B
697 B 10ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC986b4d5825364bd4887033e40e20c549-source.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 414a9f7ce391b6e34dab805c9dcea7be275b3e3079faf5947fb61e04278c897e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 428
expires: Mon, 04 Mar 2024 12:40:20 GMT

POST
H2 200 delivery Show response
starget.workingadvantage.com/rest/v1/ 781 B
501 B 38ms
38ms XHR
application/json 66.235.152.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://starget.workingadvantage.com/rest/v1/delivery?client=entertainmentbenefit&sessionId=967359bfbb384454bb7d50198f0e0b16&version=2.8.2

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.221 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

fdde9833df1c87719ea6d10b00f8de3b4edb4d0dd3f3c59e3defbc073dbbc790

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: 079b45d7-ac8a-4bc1-998c-178f8c32e787

POST
H2 204 delivery
starget.workingadvantage.com/rest/v1/ 0
48 B 38ms
37ms Ping
text/plain 66.235.152.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://starget.workingadvantage.com/rest/v1/delivery?client=entertainmentbenefit&sessionId=967359bfbb384454bb7d50198f0e0b16&version=2.8.2

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.221 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
server: jag
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
x-request-id: 5c250fc8-7a00-4e05-90a9-3f5f56e66f0d

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 241 KB
81 KB 28ms
28ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

68255f902e91def032c150b749e33263a2cdaf1e2e9d02c9dc53620e1bfb8f45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82644
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:20 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 193 KB
70 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2876877-9

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0bc293cf7a94acb547913788151ea35046e8ab13d38cb91e339eccd9dd19516f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71831
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:20 GMT

GET
H3 200 mouseflow Show response
cov.savings.beneplace.com/api/platform/options/ 94 B
805 B 128ms
128ms XHR
application/json 172.64.150.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.beneplace.com/api/platform/options/mouseflow?name=workingadvantage_mouseflow_script_id

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.150.236 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61b4579ddd9500f72669998271f04641a6f956554326995c3000531a9a57e4d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"5e-xWERRy+8FVp8nFwecehLclRX7Go"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197442a2f049b-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:19 GMT

POST
H2 200 s12115761889293 Show response
smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LDQM/ 43 B
304 B 22ms
21ms XHR
image/gif 63.140.62.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LDQM/s12115761889293

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://auth.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 05 Mar 2024 11:40:20 GMT
server: jag
etag: 3671235869276307456-4617826321664877046
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Sun, 03 Mar 2024 11:40:20 GMT

GET
H2 200 07e508d2-aee2-481f-ac8e-6e200d46af80.js
cdn.mouseflow.com/projects/ 196 KB
58 KB 149ms
115ms Script
application/javascript 2606:4700::6812:1a32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mouseflow.com/projects/07e508d2-aee2-481f-ac8e-6e200d46af80.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1a32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:20 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
x-cache-status: MISS
alt-svc: h3=":443"; ma=86400
x-mf-script-region: enforced-privacy
last-modified: Thu, 15 Feb 2024 22:03:35 GMT
server: cloudflare
etag: W/"b36785d25a60da1:0"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cf-ray: 85f197452bec360f-FRA
expires: Tue, 05 Mar 2024 11:40:20 GMT

GET
H3 200 Primary Request relay Show response
cov.savings.workingadvantage.com/ 8 KB
3 KB 194ms
194ms Document
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/main.376bcc3f5834c9a3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02d1688e9273d132504a4356fa8d9a822720341b320723e2215261a6971d1820

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85f19745fd5290e6-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Mon, 04 Mar 2024 11:40:20 GMT
last-modified: Thu, 29 Feb 2024 11:14:37 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1701265131&t=event&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Fcov%2Fsign-in%3Fdlk%3D5e4nklqbt00qx69grkzilygsg%26corpRedirectUri%3D%26subdomain%3Dcov%26redirect_uri%3Dhttps%3A%252F%252Fcov.savings.workingadvantage.com%252Frelay%253FcorpRedirectUri%253D%2526subdomain%253Dcov%26client_id%3D9ezalirn45mF43imJTdf53&dr=https%3A%2F%2Fcov.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=dlk&ea=dlk-auth-success.interaction&el=%7Ccov%7C5e4nklqbt00qx69grkzilygsg%7Chttps%3A%2F%2Fcov.savings.workingadvantage.com%2F%7C&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=294755890

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49246
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET init
n2.mouseflow.com/ 0
0

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 661 KB
155 KB 13ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a5ff70f6ac07dd9865153de5810ff20130a8e033bc547a36598c01bd4de1dc74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:35 GMT
server: AkamaiNetStorage
etag: "f72c7e4973313980f51ed6fa9b44d977:1707952175.514279"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 158823
expires: Mon, 04 Mar 2024 12:40:21 GMT

GET
H3 200 new-relic-integration.js Show response
cov.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 502ms
500ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:36 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e0671c-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f197474e1f90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 20ms
19ms Stylesheet
text/css 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8327830
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230082-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xJwOyKfFM1IBJk%2BW4GQwmtyvnkiV5LxWeqLzDQF2DEkn%2BT8IlGIIxkQjW4j5S6MIfxXCshSyoISOBwI%2FX6YUaubP%2B2xukp7TFn%2FZoD5t0ZYEE1uNdeJgqP%2BysNhPcbc1UyrLqbAVYUQiaK5BUWU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 85f197474987196d-FRA

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 222 KB
74 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

3522991d63b0d16a8d330947e3df263de29a664b90320655ce99bee43de8c82d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75427
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 18ms
16ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5565743
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kTYVfaz%2BVP%2FOieteEI16YhkSAmlFV6DjS9BPifgrIK%2FxQCmWWgFKYaih0gynVy9BtSgEr%2BrY1YNo0FrUNBw6rD5xll6mB6%2B8Hc4hx%2BWO6lwrkfHHaEeW6TgEeXnanZvM5CMK4gpOUvst%2F6FkrIEBl6m7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85f197474e97372e-FRA
expires: Sat, 22 Feb 2025 11:40:21 GMT

GET
H3 200 runtime.06f1d45f19b2d7e5.js Show response
cov.savings.workingadvantage.com/ 4 KB
2 KB 111ms
110ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/runtime.06f1d45f19b2d7e5.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5328503ff5a99f4f34d62c11281034959485894d66071d3d71be1164fda8530

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-e90"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f197474e2090e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.0f88da5fdbf95761.js Show response
cov.savings.workingadvantage.com/ 141 KB
49 KB 129ms
127ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/polyfills.0f88da5fdbf95761.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46f16c323557a318dd6604bab3ebe8dbd9d23bc318b55eec33b0b0a4502c0bd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-234ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f197474e2190e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.1baad6c013597821.js Show response
cov.savings.workingadvantage.com/ 166 KB
54 KB 120ms
119ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/scripts.1baad6c013597821.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aef73d8723fb7d91d516282c5a33140f448212e7d49898baab65f6c8b74ddc6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06713-29758"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 85f1974a1ffa90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.1f738b905888de82.js Show response
cov.savings.workingadvantage.com/ 5 MB
1 MB 115ms
113ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/main.1f738b905888de82.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3f35557d144f6010fca4fe85acdd228c963c1b078c0fb4d7dedb8072fbe5866

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-504fdd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f197474e2290e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 241 KB
81 KB 18ms
18ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

68255f902e91def032c150b749e33263a2cdaf1e2e9d02c9dc53620e1bfb8f45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82644
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 14ms
12ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Mon, 04 Mar 2024 12:40:21 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 13ms
12ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Mon, 04 Mar 2024 12:40:21 GMT

GET
H3 200 styles.f02f3e4d86a48b3e.css
cov.savings.workingadvantage.com/ 95 KB
16 KB 117ms
117ms Stylesheet
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/styles.f02f3e4d86a48b3e.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3d356230da20a9876271fbb4c85ffa912fe03868fe3021069d1a1c3415a072

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e06713-17af1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 85f1974a885290e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 11ms
10ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 27 Feb 2024 08:59:47 GMT
x-content-type-options: nosniff
age: 528034
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Feb 2025 08:59:47 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 22ms
19ms XHR
application/json 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
cov.savings.workingadvantage.com/api/ 7 KB
2 KB 133ms
132ms XHR
text/html 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/info

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5f1c401aa792d1a1cca07a225fd018f36cb64b2d53680b68003dfbf50653eb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-a271c081dd636531----1709552421649
traceparent: 00-388b335f6b548bc4a689bf6200b08300-a271c081dd636531-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImEyNzFjMDgxZGQ2MzY1MzEiLCJ0ciI6IjM4OGIzMzVmNmI1NDhiYzRhNjg5YmY2MjAwYjA4MzAwIiwidGkiOjE3MDk1NTI0MjE2NDksInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974b58f490e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:20 GMT

GET
H3 200 marketplace-styles.css Show response
cov.savings.workingadvantage.com/api/cov/ 32 KB
5 KB 263ms
262ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/cov/marketplace-styles.css

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45488e2eb081b32f43e0cbfe2ba9dce4a893e4f5ea5f43c0f110a21717c6e6e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-28cb9654c29f25de----1709552421650
traceparent: 00-e49e75aff01abda64532cd3fc7bd2500-28cb9654c29f25de-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjI4Y2I5NjU0YzI5ZjI1ZGUiLCJ0ciI6ImU0OWU3NWFmZjAxYWJkYTY0NTMyY2QzZmM3YmQyNTAwIiwidGkiOjE3MDk1NTI0MjE2NTAsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8095-csWeogI50zjyoFXVCCvioZ8EkgE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974b58f990e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:20 GMT

GET
H3 200 colors.css Show response
cov.savings.workingadvantage.com/api/cov/ 3 KB
767 B 323ms
321ms XHR
text/css 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/cov/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67550708dbc8934e8597cd5845d9a52786e40de76e56642378fc6edeb1459ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-1c16c3050c8a5016----1709552421651
traceparent: 00-7df9714f6f6bb00fe6cbe138fafd5e00-1c16c3050c8a5016-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjFjMTZjMzA1MGM4YTUwMTYiLCJ0ciI6IjdkZjk3MTRmNmY2YmIwMGZlNmNiZTEzOGZhZmQ1ZTAwIiwidGkiOjE3MDk1NTI0MjE2NTEsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"a5f-d4IlrjjUUtu1BTwST6NSe19xCA8"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974b58fb90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:20 GMT

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCea9d317d3a374e44b3f0f8711e38765e-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e197eefb3a6378c1636ca452e85b757536156c962cd4c96cbe86c6ec83b92510

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 751
expires: Mon, 04 Mar 2024 12:40:21 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
94 KB 18ms
18ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1ef572c8a4cd4f09169c51d0e1f7e2cc5fe1c4dd0a34a7774d3ce8c5a38dfdca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96088
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 04 Mar 2024 11:32:03 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 498
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 04 Mar 2024 13:32:03 GMT

GET
H2 200 sync Show response
live.rezync.com/ 6 KB
7 KB 300ms
299ms Script
text/javascript 13.32.27.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=5ef4f9c1e806678f2ab0275df01d5ff4&zmpID=ebg-wag3&cache_buster=1709552421678&k=ebg-wag3-pixel-0988
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-113.fra56.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: 6d2702cbd05e2fa660fef92202d434a84272abf0ff8bbaab74d833468240ec7b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
via: 1.1 747e99d9d8c5e29fdc713cf866bc3f82.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 6150
x-amz-cf-id: 7Pq5aI1l9voLjbt1mG2f1f7ypX3r0Rh0Nc8hkchIuPQ41gWZO2UaYg==

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 15ms
14ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=30295832&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%2540cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%2540cov.com&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&_slc=1&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=2007121272

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 262 KB
88 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cf8c8eb84fc8a8f83eae31bfe52f9842d68f5b722eb84b885877105db9b573db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90495
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 04 Mar 2024 11:40:21 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 16ms
16ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je42t1v9112553684z878847533za200&_p=1709552421011&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1843357478.1709552412&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709552411&sct=1&seg=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%2540cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%2540cov.com&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%2540cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%2540cov.com&up.pb_site_name=cov&up.page_path=%2Frelay&up.user_id_value=&up.zip_code=NaN&tfd=942
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:21 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 15ms
15ms Image
text/html 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-2K753Z6D0L&v=3&t=t&pid=1278514530&cv=2&rv=42t1&tc=27&es=1&e=gtm.init_consent&eid=-1&dl=cov.savings.workingadvantage.com%2Frelay&tdp=G-2K753Z6D0L;126564266;1;5;0&z=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 td
www.googletagmanager.com/ 0
15 B 28ms
26ms Image
image/gif 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=G-2K753Z6D0L&v=3&t=t&pid=1278514530&cv=2&rv=42t1&tc=27&es=1&e=gtm.init_consent&eid=-1&dl=cov.savings.workingadvantage.com%2Frelay&tdp=G-2K753Z6D0L;126564266;1;5;0&z=0
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:21 GMT
server: Golfe2
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 16ms
15ms Image
text/html 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-2K753Z6D0L&v=3&t=t&pid=1278514530&cv=2&rv=42t1&tc=27&es=1&e=gtm.init&eid=0&tr=1ogtgasend.1ogtipmark.1ogtreferralexclusion.1ogtsessiontimeout.1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ogtgooglesignals.1ccdgaregscope.1ccdemsitesearch.1ccdconversionmarking.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ogteventcreate.1ccdautoredact.1ccdgalast&ti=2ogtgasend.2ogtipmark.2ogtreferralexclusion.2ogtsessiontimeout.2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ogtgooglesignals.2ccdgaregscope.2ccdemsitesearch.2ccdconversionmarking.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ogteventcreate.2ccdautoredact.2ccdgalast&z=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 18ms
17ms Image
text/html 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-2K753Z6D0L&v=3&t=t&pid=1278514530&cv=2&rv=42t1&tc=27&es=1&e=gtag.config&eid=1&tr=1gct&ti=1gct&z=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 17ms
16ms Image
text/html 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-2K753Z6D0L&v=3&t=t&pid=1278514530&cv=2&rv=42t1&tc=27&es=1&e=gtm.dom&eid=3&z=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 22ms
22ms Image
text/html 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-2K753Z6D0L&v=3&t=t&pid=1278514530&cv=2&rv=42t1&tc=27&es=1&e=gtag.config&eid=5&u=AAAAAAAI&epr=1G.3G&z=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 cov Show response
cov.savings.workingadvantage.com/api/controls/ 2 KB
1 KB 143ms
142ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/controls/cov

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7afd9a10c8ddc93d6ca6d3245a21999d408db30ab4bf31e792e213b0b80d7cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-e71c6469de6dcfda----1709552421804
traceparent: 00-8d8296e0d5bf2bcdf83c97e6ac56b400-e71c6469de6dcfda-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImU3MWM2NDY5ZGU2ZGNmZGEiLCJ0ciI6IjhkODI5NmUwZDViZjJiY2RmODNjOTdlNmFjNTZiNDAwIiwidGkiOjE3MDk1NTI0MjE4MDQsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com

Response headers

date: Mon, 04 Mar 2024 11:40:21 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"7e1-QzUZ6tuVa8wnoxHfM4ebNWFGbtg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974c49d690e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:20 GMT

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/ebg-wag3/ 93 KB
30 KB 8ms
8ms Script
application/javascript 18.66.122.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/ebg-wag3/p13n.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-57.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 62ec57b7f971a77af7380ce75ee21e1b881fd1fa628efdb36607125004cca092

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: wRWB6X7wlph0uyMEnzVVd.0l3.N4rmfh
Content-Encoding: gzip
Via: 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront)
Date: Mon, 04 Mar 2024 11:04:35 GMT
X-Amz-Cf-Pop: FRA60-P2
Age: 2147
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Fri, 01 Mar 2024 04:43:11 GMT
Server: AmazonS3
ETag: W/"a036c704209d386b667790a5a0757a3f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: Wnvpx8bF7Uf81kja-FhjVfTncwD4fhiuhKn88XKMEsr6T1FDpH7voQ==

GET
H/1.1 200
OK / Show response
com-wag3.netmng.com/ 0
240 B 88ms
87ms Script
text/html 199.38.167.54
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://com-wag3.netmng.com/?aid=6366&siclientid=105368&url=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%2540cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%2540cov.com&p5=&p6=&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=&ref=https%3A%2F%2Fauth.savings.workingadvantage.com%2F
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.38.167.54 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Mon, 04 Mar 2024 11:40:22 GMT
X-Cnection: close
Content-Encoding: gzip
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3

200

;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552421.9027278
adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CL7Q2obD2oQDFXrHOwIdhZ0Mcw;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=h...
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=12084042;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workin...
https://ad.doubleclick.net/ddm/activity/src=12084042;dc_pre=CL7Q2obD2oQDFXrHOwIdhZ0Mcw;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u...
https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CL7Q2obD2oQDFXrHOwIdhZ0Mcw;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u2...

42 B
63 B

44ms
44ms

Image
image/gif

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CL7Q2obD2oQDFXrHOwIdhZ0Mcw;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workingadvantage.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552421.9027278

Requested by

Protocol

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 04 Mar 2024 11:40:22 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"10679349237627819144"}],"aggregatable_trigger_data":[{"filters":{"14":["12836263"]},"key_piece":"0x53f402ca3ba6efa","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x7fc39fb387ab29c2","not_filters":{"14":["12836263"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["12836263"]},"key_piece":"0x7dcc41a70aba3d22","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xd89ab4266f1d78ab","not_filters":{"14":["12836263"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"4903982113336332310","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"10679349237627819144","filters":{"14":["12836263"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"10679349237627819144","filters":{"14":["12836263"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"10679349237627819144","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"10679349237627819144","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["12084042"]}}
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: image/png
location: https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=CL7Q2obD2oQDFXrHOwIdhZ0Mcw;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://cov.savings.workingadvantage.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1709552421.9027278
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 seg
secure.adnxs.com/ 43 B
1 KB 16ms
15ms Image
image/gif 185.89.211.84
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/seg?add=32509374&t=2

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-54-74-69-97.eu-west-1.compute.amazonaws.com

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 11:40:21 GMT
an-x-request-uuid: cb5d0cbc-3426-4480-beea-b25967fd00db
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.200; 80.255.10.200; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 track Show response
events.api.boomtrain.com/event/ 2 B
208 B 115ms
115ms XHR
text/plain 3.216.161.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.161.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-161-250.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Mon, 04 Mar 2024 11:40:22 GMT
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain

GET
H3 200 872.194065e01ea991c5.js Show response
cov.savings.workingadvantage.com/ 4 KB
2 KB 114ms
113ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/872.194065e01ea991c5.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aba7991bfc62a413ff4a27b8882721bd3c3f0e858a75501979e34306e1b64fa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov&known_email=BHalpin%40cov.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=5e4nklqbt00qx69grkzilygsg&known_email_contact=BHalpin%40cov.com
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-11ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974d9b0890e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 onetrust Show response
cov.savings.workingadvantage.com/api/platform/options/ 501 B
730 B 144ms
144ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/platform/options/onetrust

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62ddcfd1e1318d9944204e7104ce0e982b8bd3ae870aa28e9b12148f251a1e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-de7b1d450f0fb29d----1709552422167
traceparent: 00-6068cddb9987d8b7ec793e12164c2000-de7b1d450f0fb29d-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImRlN2IxZDQ1MGYwZmIyOWQiLCJ0ciI6IjYwNjhjZGRiOTk4N2Q4YjdlYzc5M2UxMjE2NGMyMDAwIiwidGkiOjE3MDk1NTI0MjIxNjcsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f5-qBdkJZdemwsY4VL06j2IaGB8E5Y"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974e8bad90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H3 200 S6u9w4BMUTPHh7USSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ3q5d0.woff2

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bb29c58eadc0f0c7b704f5fce2490d10cb62efa55797a09c9b8f91b3b54cb34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 28 Feb 2024 02:36:50 GMT
x-content-type-options: nosniff
age: 464612
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13912
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Feb 2025 02:36:50 GMT

GET
H3 200 415.4bab11708e71df5e.js Show response
cov.savings.workingadvantage.com/ 55 KB
13 KB 131ms
130ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/415.4bab11708e71df5e.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8bd38f086fa2e86e47cda397eaa2250421580e38dcf6b2a5fd00f2aa720a423

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-dbb0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974edc1290e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 common.7b463af6ac6cff81.js Show response
cov.savings.workingadvantage.com/ 12 KB
4 KB 111ms
110ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/common.7b463af6ac6cff81.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e96d9b1acbb7f093ff716050281df97d06c2dff740b31d9af8d17fc2533873a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-2f71"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974edc1390e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 765.09b507eebafd579c.js Show response
cov.savings.workingadvantage.com/ 78 KB
15 KB 140ms
138ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/765.09b507eebafd579c.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0f77d0a3c951c6fab9ba404b60229a49578790c0b2ebc0e44c5ff30cee4e6f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-1378f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974edc1790e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 811.40ccd40dcf1e23e9.js Show response
cov.savings.workingadvantage.com/ 14 KB
4 KB 111ms
108ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/811.40ccd40dcf1e23e9.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e07b1a8567a54ec8183648cce5128eb991dc95b25212e353b3746c37741a1f1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-3673"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974edc1890e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 182.baea2c870d8d1e44.js Show response
cov.savings.workingadvantage.com/ 9 KB
3 KB 118ms
115ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/182.baea2c870d8d1e44.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f19a3f08fa20637fdf007ace96efb7a886969f5108743e1e9e7bedcaee6b63df

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-221c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec1a90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 439.6bac25321cbf5331.js Show response
cov.savings.workingadvantage.com/ 2 KB
1 KB 115ms
111ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/439.6bac25321cbf5331.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f705f9d030a566dba98d636b97d5855f27247649776f05eea94c8c7c4f286826

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-73d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec1e90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 380.69d0ae77386089cf.js Show response
cov.savings.workingadvantage.com/ 27 KB
7 KB 114ms
109ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/380.69d0ae77386089cf.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1aef749ed9fc9c5d9484eea742d413b4de82e7665fa17823f678091635be37e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-6c0d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2090e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 488.b314d764eef2f542.js Show response
cov.savings.workingadvantage.com/ 53 KB
18 KB 508ms
503ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/488.b314d764eef2f542.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9f5aa82f2fd26bc3264a2e7969aeed2cbc2cd82e15d5c58608da64a4f0c47a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-d4e1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2190e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 521.0616133d4b981c59.js Show response
cov.savings.workingadvantage.com/ 18 KB
5 KB 130ms
126ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/521.0616133d4b981c59.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8be232b7f25d7694c048aea215133fccbbafa3376722d38448ea4be609a417c

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-4738"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2490e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 286.b2048c7b020ae8f0.js Show response
cov.savings.workingadvantage.com/ 19 KB
6 KB 125ms
121ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/286.b2048c7b020ae8f0.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b09826016a0afff75d52b2b6b85156674ec7fd07fe978a5c01dc8fb1570718e

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-4af5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2690e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 230.6ee89c44dfdd4e41.js Show response
cov.savings.workingadvantage.com/ 29 KB
8 KB 128ms
125ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/230.6ee89c44dfdd4e41.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17124351c3841fbb2b0f97b8d7f36ab8bf8ca52a3f4df4b18c1fe1b3c960f083

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-754a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2790e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 889.3a83cf909e03a570.js Show response
cov.savings.workingadvantage.com/ 3 KB
1 KB 109ms
106ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/889.3a83cf909e03a570.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

281ef42e41943e92bdbc9c80a1646ebd0b02fd002ed91ed2ebd9437ce2689ab6

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-b5b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2990e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 436.bd69dbd57bbc0a77.js Show response
cov.savings.workingadvantage.com/ 174 KB
27 KB 127ms
124ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/436.bd69dbd57bbc0a77.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4340e9a573c0bed7117eea822e0b877fbbb171417f359f85a5a799a5be00c8f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-2b7d8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2a90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 125.e62b3ee14c2c1379.js Show response
cov.savings.workingadvantage.com/ 214 KB
42 KB 132ms
129ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/125.e62b3ee14c2c1379.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59b48bad1b058596ea9d230ec1ce184a256cd8dd9796c36dc750c83e6677f0df

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-35753"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2b90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 417.1a13af1bc3bede6a.js Show response
cov.savings.workingadvantage.com/ 239 KB
47 KB 120ms
118ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/417.1a13af1bc3bede6a.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a4baa294f3ed119e4248f6d697b5dc5fe4992d3eb9eaa8fdbf2e49d22a39de1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-3ba51"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2c90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 341.765d455724ecaf82.js Show response
cov.savings.workingadvantage.com/ 9 KB
3 KB 119ms
117ms Script
application/javascript 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/341.765d455724ecaf82.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

921fe8d9bc97f2eefc39e8cc600f16f9ca5bc82afb8705031787cbb3565a1033

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 29 Feb 2024 11:14:27 GMT
server: cloudflare
content-encoding: br
etag: W/"65e06713-2226"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com, https://cov.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 85f1974eec2d90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 onetrust Show response
cov.savings.workingadvantage.com/api/platform/options/ 501 B
730 B 131ms
130ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/platform/options/onetrust

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62ddcfd1e1318d9944204e7104ce0e982b8bd3ae870aa28e9b12148f251a1e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-16b5986bd1f07f11----1709552422228
traceparent: 00-f1f2a118cf3014f0211027dfbdfe3200-16b5986bd1f07f11-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjE2YjU5ODZiZDFmMDdmMTEiLCJ0ciI6ImYxZjJhMTE4Y2YzMDE0ZjAyMTEwMjdkZmJkZmUzMjAwIiwidGkiOjE3MDk1NTI0MjIyMjgsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/relay?corpRedirectUri=&subdomain=cov

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f5-qBdkJZdemwsY4VL06j2IaGB8E5Y"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974efc3390e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/home

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a7ce1a34f3e9944fe88fc61abbc93b6db383afa2b90815fd7ccea456fbce4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cov.savings.workingadvantage.com/
Origin: https://cov.savings.workingadvantage.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 18:20:53 GMT
x-content-type-options: nosniff
age: 580769
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14168
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:29:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 Feb 2025 18:20:53 GMT

GET
H3 200 system-wide Show response
cov.savings.workingadvantage.com/api/notifications/ 2 B
405 B 426ms
425ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/notifications/system-wide

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-9ff07a7f71fba3ca----1709552422258
traceparent: 00-a874a56b2636740b1bb77cf055633800-9ff07a7f71fba3ca-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjlmZjA3YTdmNzFmYmEzY2EiLCJ0ciI6ImE4NzRhNTZiMjYzNjc0MGIxYmI3N2NmMDU1NjMzODAwIiwidGkiOjE3MDk1NTI0MjIyNTgsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974f2cae90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H3 200 profile Show response
cov.savings.workingadvantage.com/api/ 1 KB
1 KB 653ms
652ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/profile?userGuid=5e4nklqbt00qx69grkzilygsg&knownEmail=bhalpin%40cov.com&knownEmailContact=bhalpin%40cov.com

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2db85440f5c4112815f77dc9fbca7e326da42707588c85ebb55024672a22d9b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-9dbca34c8466061b----1709552422263
traceparent: 00-e9c37eaadab310064802b5730d454600-9dbca34c8466061b-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjlkYmNhMzRjODQ2NjA2MWIiLCJ0ciI6ImU5YzM3ZWFhZGFiMzEwMDY0ODAyYjU3MzBkNDU0NjAwIiwidGkiOjE3MDk1NTI0MjIyNjMsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"564-eyxrKrfURqPTyCgN3Mh8OfR4Urc"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974f2cb490e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=30295832&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1362307161

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/home

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49248
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
7ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=30295832&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Frelay%3FcorpRedirectUri%3D%26subdomain%3Dcov%26known_email%3DBHalpin%40cov.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D5e4nklqbt00qx69grkzilygsg%26known_email_contact%3DBHalpin%40cov.com&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1175719267

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/home

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49248
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 10ms
9ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/home

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49248
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Drone_WA_primary_color.gif
cov.savings.workingadvantage.com/assets/relay/ 2 MB
2 MB 113ms
112ms Image
image/gif 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cov.savings.workingadvantage.com/assets/relay/Drone_WA_primary_color.gif

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/home

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a89c66670bfdfc2e5a899a820d21a9f667d8c4f459b526abe8b166244eb9ede

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/home
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:36 GMT
server: cloudflare
cf-cache-status: DYNAMIC
etag: "65e0671c-1b2cae"
x-frame-options: DENY
content-type: image/gif
accept-ranges: bytes
cf-ray: 85f1974f2cb890e6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1780910

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 10ms
9ms Image
image/gif 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=30295832&t=pageview&_s=1&dl=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fhome&dr=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&ul=en-us&de=UTF-8&dt=Covington%20%26%20Burling%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1843357478.1709552412&tid=UA-2876877-9&_gid=166212241.1709552412&gtm=45He42t1n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=983519099

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/home

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 21:59:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49248
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 shopping-cart.svg
cov.savings.workingadvantage.com/assets/header/ 1 KB
1 KB 121ms
120ms Image
image/svg+xml 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cov.savings.workingadvantage.com/assets/header/shopping-cart.svg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/home

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c846a8c3ba4fb719a679d929f2ef9a2c90f75d1400c5667d25fa70e4831aa7e

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/home
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:35 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e0671b-5d4"
x-frame-options: DENY
content-type: image/svg+xml
cf-ray: 85f1974f2cba90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 cov_logo_wide_03.png
g3i.imgix.net/uploads/ 11 KB
11 KB 8ms
7ms Image
image/png 2a04:4e42:200::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g3i.imgix.net/uploads/cov_logo_wide_03.png?w=440&h=40&crop=entropy&fit=clip&trim=color&trim-color=FFFFFF

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/home

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

6c13114c5cb1475ecc60ab884818db95b57f4b2af948e222b79efbd494d6d1cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
x-content-type-options: nosniff
age: 482036
x-cache: HIT, HIT
x-imgix-id: 833fef44344d773852271b78f22acccc9a49f1b5
cross-origin-resource-policy: cross-origin
content-length: 10948
x-served-by: cache-sjc10038-SJC, cache-fra-eddf8230094-FRA
x-imgix-render-farm: 02.131592
last-modified: Tue, 27 Feb 2024 21:46:27 GMT
server: Google Frontend
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8c8854741b41041a55e30363186b3e943076de5f80c39d1bb82ed6efbc5f8a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 286
expires: Mon, 04 Mar 2024 12:40:22 GMT

GET
H3 200 profile Show response
cov.savings.workingadvantage.com/api/ 1 KB
1 KB 159ms
159ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/profile?userGuid=5e4nklqbt00qx69grkzilygsg&knownEmail=bhalpin%40cov.com&knownEmailContact=bhalpin%40cov.com

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2db85440f5c4112815f77dc9fbca7e326da42707588c85ebb55024672a22d9b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-a35c762261a0a80f----1709552422285
traceparent: 00-055e5eaaf13893a08d29cf6ac45b1200-a35c762261a0a80f-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImEzNWM3NjIyNjFhMGE4MGYiLCJ0ciI6IjA1NWU1ZWFhZjEzODkzYTA4ZDI5Y2Y2YWM0NWIxMjAwIiwidGkiOjE3MDk1NTI0MjIyODUsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"564-eyxrKrfURqPTyCgN3Mh8OfR4Urc"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974f4cc490e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC0c16579d5c704bd0a214633d669d35f2-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bb5b688508b532c8599179a5a20d10a399dff6e818f7d4299a2783cdaa72b284

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 547
expires: Mon, 04 Mar 2024 12:40:22 GMT

GET
H2 200 RC668a267ca36c45b5acca38f3e4360a76-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 340 B
482 B 11ms
9ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC668a267ca36c45b5acca38f3e4360a76-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8004dadb6b1625999c7de43a05d9c2d7fc4ac26ec644a95bfbd113c70b80c9a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Mon, 04 Mar 2024 12:40:22 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 241 KB
81 KB 17ms
17ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a2f575e992a274662155ef7fc420be7e7bbf01a37d8a1c2bc671bb6c0d8fe1eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82653
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:22 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 193 KB
70 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2876877-9

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

19c47ede54a00c86864798c4b49eb3f90dc778b4cf1bc7a4e43ecaa0f528588d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71817
x-xss-protection: 0
last-modified: Mon, 04 Mar 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 04 Mar 2024 11:40:22 GMT

GET
H3 200 mouseflow Show response
cov.savings.workingadvantage.com/api/platform/options/ 94 B
491 B 140ms
140ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/platform/options/mouseflow?name=workingadvantage_mouseflow_script_id

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61b4579ddd9500f72669998271f04641a6f956554326995c3000531a9a57e4d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-165c8c30e596ecfe----1709552422317
traceparent: 00-9421f5bc3a511deef9c41a0f65bb9500-165c8c30e596ecfe-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjE2NWM4YzMwZTU5NmVjZmUiLCJ0ciI6Ijk0MjFmNWJjM2E1MTFkZWVmOWM0MWEwZjY1YmI5NTAwIiwidGkiOjE3MDk1NTI0MjIzMTcsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"5e-xWERRy+8FVp8nFwecehLclRX7Go"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974f7cf090e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H3 200 mouseflow Show response
cov.savings.workingadvantage.com/api/platform/options/ 94 B
491 B 135ms
134ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/platform/options/mouseflow?name=workingadvantage_mouseflow_script_id

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61b4579ddd9500f72669998271f04641a6f956554326995c3000531a9a57e4d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-89e30dd3e3ea36bc----1709552422371
traceparent: 00-60ace8415656755acc684fb8a2b8f100-89e30dd3e3ea36bc-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6Ijg5ZTMwZGQzZTNlYTM2YmMiLCJ0ciI6IjYwYWNlODQxNTY1Njc1NWFjYzY4NGZiOGEyYjhmMTAwIiwidGkiOjE3MDk1NTI0MjIzNzEsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"5e-xWERRy+8FVp8nFwecehLclRX7Go"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f1974fdd3990e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H3 200 profile Show response
cov.savings.workingadvantage.com/api/ 1 KB
1 KB 147ms
146ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/profile?userGuid=5e4nklqbt00qx69grkzilygsg&knownEmail=bhalpin%40cov.com&knownEmailContact=bhalpin%40cov.com

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2db85440f5c4112815f77dc9fbca7e326da42707588c85ebb55024672a22d9b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-d8711f8f2280e830----1709552422448
traceparent: 00-160979de347ea76c99f6b9a1504eb600-d8711f8f2280e830-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImQ4NzExZjhmMjI4MGU4MzAiLCJ0ciI6IjE2MDk3OWRlMzQ3ZWE3NmM5OWY2YjlhMTUwNGViNjAwIiwidGkiOjE3MDk1NTI0MjI0NDgsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"564-eyxrKrfURqPTyCgN3Mh8OfR4Urc"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197505d9b90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H2 200 07e508d2-aee2-481f-ac8e-6e200d46af80.js Show response
cdn.mouseflow.com/projects/ 196 KB
58 KB 27ms
24ms Script
application/javascript 2606:4700::6812:1a32
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mouseflow.com/projects/07e508d2-aee2-481f-ac8e-6e200d46af80.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1a32 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c82f080db2b97dea4c680e7d745d3e09b574cd414197ddab211421cbf97f691

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 2
x-cache-status: MISS
alt-svc: h3=":443"; ma=86400
x-mf-script-region: enforced-privacy
last-modified: Thu, 15 Feb 2024 22:03:35 GMT
server: cloudflare
etag: W/"b36785d25a60da1:0"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cf-ray: 85f197506d6c360f-FRA
expires: Tue, 05 Mar 2024 11:40:22 GMT

GET
H2 200 init Show response
n2.mouseflow.com/ 0
253 B 93ms
91ms XHR
text/plain 192.96.202.198
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL

https://n2.mouseflow.com/init?v=17.98&p=07e508d2-aee2-481f-ac8e-6e200d46af80&s=41522e2a3aa724230de4495116e739a0&page=030422003adf6bd7ebd8c65ac06d88ab3c20ec2d&ret=0&u=ae257f1c1d7a754e359039b363be1282&href=https%3A%2F%2Fcov.savings.workingadvantage.com%2Fhome&url=%2Fhome&ref=https%3A%2F%2Fauth.savings.workingadvantage.com%2F&title=Covington%20%26%20Burling%27s%20Savings%20Marketplace&res=1600x1200&tz=-60&to=0&dnt=0&ori=&dw=1600&dh=1200&time=1495&pxr=1&gdpr=1

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.96.202.198 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),

Reverse DNS

Software

Mouseflow /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: Mouseflow
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 search Show response
cov.savings.workingadvantage.com/api/zones/ 444 B
688 B 137ms
136ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/zones/search?page=navigation&section=2&known_user_email=bhalpin@cov.com

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e239fe12eb693104a05d7fec02bd693e3d477fd9057a0abe2965c0c08f366ade

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-aa3321549f2326d3----1709552422690
traceparent: 00-1224582703bec1752a75278cf3594200-aa3321549f2326d3-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImFhMzMyMTU0OWYyMzI2ZDMiLCJ0ciI6IjEyMjQ1ODI3MDNiZWMxNzUyYTc1Mjc4Y2YzNTk0MjAwIiwidGkiOjE3MDk1NTI0MjI2OTAsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1bc-MtqxF3NWKzu+olrehzlgILe4fnk"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19751ded790e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:21 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
25 KB 7ms
6ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::649 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=300
x-amz-request-id: XKNH2N4BMHCM512R
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: 4mexhU0yeIewKmDeZm96VoQ5sJoXlVDLPLvdECeQEQCLYnoSPdDtx9GVJ5S3Dd2cS0NTUzBv+mg=
x-served-by: cache-fra-etou8220080-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 309

GET
H2 200 / Show response
znbpitzqupa333rvi-ebg.siteintercept.qualtrics.com/SIE/ 9 KB
4 KB 148ms
30ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://znbpitzqupa333rvi-ebg.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_bpItZqUpA333RVI

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

731623b5ce08b927850ab77e54864a52bc8891fc97710e945cbdb354805a5a70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 82929
cf-polished: origSize=9889
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"26a1-4UCKlR1aNtI9Z1GuoqJc07LSVi0"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f19752dbf38edc-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 40 B
469 B 369ms
368ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2064&ck=0&s=41ef36ba9d343f7d&ref=https://cov.savings.workingadvantage.com/home&af=err,xhr,stn,ins,spa&be=195&fe=1748&dc=665&perf=%7B%22timing%22:%7B%22of%22:1709552420795,%22n%22:0,%22f%22:0,%22dn%22:0,%22dne%22:0,%22c%22:0,%22s%22:0,%22ce%22:0,%22rq%22:1,%22rp%22:195,%22rpe%22:196,%22di%22:731,%22ds%22:857,%22de%22:860,%22dc%22:1940,%22l%22:1940,%22le%22:1943%7D,%22navigation%22:%7B%7D%7D&fp=1477&fcp=1477
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 5ca742541d65d718402499ed1d84d003258ce2116562169b85744cf7d798485a

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
server: envoy
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://cov.savings.workingadvantage.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 40
x-served-by: cache-fra-etou8220069-FRA

GET
H2 200 12.93f2ca20511a668d8998.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 73 KB
22 KB 28ms
27ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.93f2ca20511a668d8998.chunk.js?Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web&Q_BRANDID=cov.savings.workingadvantage.com

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

490f73ccaadf6bf9f121713e241e05fc959039104fdbca9c72780b2822296375

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 561028
cf-polished: origSize=75209
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 19 Feb 2024 20:16:06 GMT
cf-bgj: minify
server: cloudflare
etag: W/"125c9-18dc302ef70"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f197531c278edc-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 id Show response
dpm.demdex.net/ 185 B
699 B 43ms
42ms XHR
application/json 54.74.69.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&d_mid=24525265414284735852720252461896046548&d_coppa=true&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=userid%015e4nklqbt00qx69grkzilygsg%011&d_cid_ic=adobe_ecid%0124525265414284735852720252461896046548%011&d_cid_ic=ecid%0124525265414284735852720252461896046548%011&d_cid_ic=mcid%0124525265414284735852720252461896046548%011&d_cid_ic=email%01bbf78482bbd0f4cc676f340aa1e6c4dde9ea46a4451e34ea1e700106b01e8baa%011&ts=1709552422921

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.74.69.97 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

09f1fcc1a35838e140756defbbc202abdde439733c1e4bf13351e57ae137194e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

dcs: dcs-prod-irl1-1-v057-07a72610a.edge-irl1.demdex.com 5 ms
pragma: no-cache
date: Mon, 04 Mar 2024 11:40:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: K9bUxVcbTHk=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
x-error: 300,300,300,300
content-length: 186
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 RCfc27f81c245c44b78fbb03ff4af1a6be-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 343 B
482 B 12ms
12ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCfc27f81c245c44b78fbb03ff4af1a6be-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1870780f32d372a63e30a169bef356b78fc9a0ebfbbef37f99b410244fce3ce7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Mon, 04 Mar 2024 12:40:22 GMT

GET
H3 200 enrollment-info Show response
cov.savings.workingadvantage.com/api/marketplace/ 0
342 B 134ms
133ms XHR
text/plain 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/marketplace/enrollment-info?draft=false&known_user_email=bhalpin@cov.com&country=EMEA

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-3d3b7827b829e14d----1709552422933
traceparent: 00-f2c4c705ff170aa269f46f9e53091e00-3d3b7827b829e14d-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjNkM2I3ODI3YjgyOWUxNGQiLCJ0ciI6ImYyYzRjNzA1ZmYxNzBhYTI2OWY0NmY5ZTUzMDkxZTAwIiwidGkiOjE3MDk1NTI0MjI5MzMsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197535fd490e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
content-length: 0
alt-svc: h3=":443"; ma=86400
expires: Mon, 04 Mar 2024 11:40:22 GMT

GET
H3 200 search Show response
cov.savings.workingadvantage.com/api/zones/ 18 KB
3 KB 154ms
154ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/zones/search?page=homepage&section=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15&country_last=EMEA&known_user_email=bhalpin@cov.com

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f2fb28f6037797dd79580be56d17e5e32f8f93549193bee0dd261165d5f3672

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-c6058c353a2ac677----1709552422934
traceparent: 00-b6e5f9ab473d4e0b9a4e58aed3b5aa00-c6058c353a2ac677-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImM2MDU4YzM1M2EyYWM2NzciLCJ0ciI6ImI2ZTVmOWFiNDczZDRlMGI5YTRlNThhZWQzYjVhYTAwIiwidGkiOjE3MDk1NTI0MjI5MzQsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"48d8-evVtxG9gNkFOa5CyZI/e1PqOaJI"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197535fd690e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:22 GMT

POST
H3 200 search Show response
cov.savings.workingadvantage.com/decisions/ 12 B
417 B 139ms
139ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/decisions/search

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eef46741adfc3a9f76294d3b78f37a45f113092ac9d44ee77c7a038a88ff09a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

tracestate: 88831@nr=0-1-2647367-1120218725-e910e08e49101fb8----1709552422936
traceparent: 00-594f17104966516737973d22958b6700-e910e08e49101fb8-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImU5MTBlMDhlNDkxMDFmYjgiLCJ0ciI6IjU5NGYxNzEwNDk2NjUxNjczNzk3M2QyMjk1OGI2NzAwIiwidGkiOjE3MDk1NTI0MjI5MzYsInRrIjoiODg4MzEifX0=
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 12
server: cloudflare
etag: W/"c-F6g7sByJuuOcYYkgTnzj94yg+ZE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197535fd990e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:22 GMT

GET
H3 200 cart Show response
cov.savings.workingadvantage.com/api/profile/ 38 B
442 B 145ms
145ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/profile/cart

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ba82b07a2aea98e052b28ab5b168bb4b23390e173e49c5268b4b46a62d45ad2

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-b25f3bd9acbe6b11----1709552422937
traceparent: 00-783fc5715b0830cce13cf76f6ef40800-b25f3bd9acbe6b11-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImIyNWYzYmQ5YWNiZTZiMTEiLCJ0ciI6Ijc4M2ZjNTcxNWIwODMwY2NlMTNjZjc2ZjZlZjQwODAwIiwidGkiOjE3MDk1NTI0MjI5MzcsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 38
server: cloudflare
etag: W/"26-tz3qWAnbILhEdj8Lnffc3ME2W7I"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197535fdb90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:22 GMT

GET
H3 200 ebg-query-params Show response
cov.savings.workingadvantage.com/api/ 410 B
746 B 146ms
146ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/ebg-query-params

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5b2613148cb027cba68d19d4e220fa42c15248fcb68f85c87ad6d64380f55da

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-351bd522c04e2012----1709552422938
traceparent: 00-505e3eeb8b058af6883e7723699c1200-351bd522c04e2012-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjM1MWJkNTIyYzA0ZTIwMTIiLCJ0ciI6IjUwNWUzZWViOGIwNThhZjY4ODNlNzcyMzY5OWMxMjAwIiwidGkiOjE3MDk1NTI0MjI5MzgsInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"19a-7Hf86ocWd7p7eH0GVtXVg4yk04s"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f197536fde90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:22 GMT

GET
H3 200 shopping-cart.svg
cov.savings.workingadvantage.com/assets/header/ 1 KB
1 KB 139ms
138ms Image
image/svg+xml 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cov.savings.workingadvantage.com/assets/header/shopping-cart.svg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/main.1f738b905888de82.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c846a8c3ba4fb719a679d929f2ef9a2c90f75d1400c5667d25fa70e4831aa7e

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/home
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:35 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e0671b-5d4"
x-frame-options: DENY
content-type: image/svg+xml
cf-ray: 85f197538fef90e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 ic-arrow-down.svg
cov.savings.workingadvantage.com/assets/icons/ 199 B
742 B 138ms
138ms Image
image/svg+xml 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cov.savings.workingadvantage.com/assets/icons/ic-arrow-down.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9875607b3cd826344501113c6aebdf1eb8119f2fc118b9e14d287ba39c9f6f18

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/home
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 29 Feb 2024 11:14:35 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65e0671b-c7"
x-frame-options: DENY
content-type: image/svg+xml
cf-ray: 85f197538ff090e6-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 icon-EMEA.png
g3i.imgix.net/uploads/ 876 B
1019 B 12ms
12ms Image
image/png 2a04:4e42:200::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://g3i.imgix.net/uploads/icon-EMEA.png?w=18&h=18&crop=entropy&fit=crop

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

322f90e6a5578f0fc93f3115da4d528182cb1488a4e25ba9f0f400ff514b982c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
x-content-type-options: nosniff
age: 1623018
x-cache: HIT, HIT
x-imgix-id: 460372ca6ead6aa20e704f1982b35e4fbf3296ab
cross-origin-resource-policy: cross-origin
content-length: 876
x-served-by: cache-sjc10031-SJC, cache-fra-eddf8230094-FRA
x-imgix-render-farm: 02.131624
last-modified: Wed, 14 Feb 2024 16:50:03 GMT
server: Google Frontend
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 4 KB
2 KB 142ms
141ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_bpItZqUpA333RVI&Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74d51a966ba311b00072b8bcd7652b66bd72b7006516ed09e487eeafb935453c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: e7cf1cfc3cf58f62
cf-ray: 85f197539ca18edc-FRA
timing-allow-origin: *

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 4 KB
1 KB 168ms
167ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_bpItZqUpA333RVI&Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74d51a966ba311b00072b8bcd7652b66bd72b7006516ed09e487eeafb935453c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 62e18521e17e6b26
cf-ray: 85f197539ca38edc-FRA
timing-allow-origin: *

GET
H2 200 RC986b4d5825364bd4887033e40e20c549-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 757 B
696 B 11ms
10ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RC986b4d5825364bd4887033e40e20c549-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 414a9f7ce391b6e34dab805c9dcea7be275b3e3079faf5947fb61e04278c897e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:22 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 428
expires: Mon, 04 Mar 2024 12:40:22 GMT

POST
H2 200 delivery Show response
starget.workingadvantage.com/rest/v1/ 1 KB
624 B 127ms
127ms XHR
application/json 66.235.152.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://starget.workingadvantage.com/rest/v1/delivery?client=entertainmentbenefit&sessionId=967359bfbb384454bb7d50198f0e0b16&version=2.8.2

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.221 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

0872944f66742f33cf651736751fd1a563f23fedb5f45dd78f2b52deb31c6d64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: 67b8eb42-bd4f-4e51-95ae-a8c2b54a9a6f

GET
H2 200 RCeae189b6ffaa4d18a4348fba9835c4f9-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 379 B
497 B 11ms
11ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCeae189b6ffaa4d18a4348fba9835c4f9-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9320b4d9524656170cdcdb01871e8c71181393d3637f5321f86e7514cecc09d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 230
expires: Mon, 04 Mar 2024 12:40:23 GMT

GET
H2 200 RCe8a7cfb17a4944e9af69d2d19438ec62-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/ 767 B
655 B 13ms
13ms Script
application/x-javascript 2a02:26f0:280:194::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/0870a348fba5/RCe8a7cfb17a4944e9af69d2d19438ec62-source.min.js
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:194::1e80 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f222df956df830f98f3f1798eb246f7019b1b882cdd76aca5d03b3a2ff0c0f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
content-encoding: gzip
last-modified: Wed, 14 Feb 2024 23:09:38 GMT
server: AkamaiNetStorage
etag: "c2c6de46c90c909501aada279b8b0209:1707952178.118178"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 387
expires: Mon, 04 Mar 2024 12:40:23 GMT

GET
H3 200 known Show response
cov.savings.workingadvantage.com/api/navigation/cov/header/EMEA/ 12 B
416 B 146ms
145ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/api/navigation/cov/header/EMEA/known?siteTag=WAG3

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eef46741adfc3a9f76294d3b78f37a45f113092ac9d44ee77c7a038a88ff09a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

short-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJndWlkIjoiMnVxdWRwZjlsNnNncXpicjE1a2FqMG5sdiIsImlhdCI6MTcwOTU1MjQxOCwiZXhwIjoxNzA5NTU2MDE4fQ.j5wOkyLj0pgns2SwMDLC7M9HspFW7biF2_CxUgeRd-s
tracestate: 88831@nr=0-1-2647367-1120218725-289ea62a56080c5b----1709552423099
traceparent: 00-e6beba6f1eff05306dc9d42ef4f0fd00-289ea62a56080c5b-01
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY1YmNmOWZkYTVlMTc5NjE4OTVkODUzYSIsInJvbGVzIjpbIm1hcmtldHBsYWNlX2tub3duIl0sIm9yaWdpbmFsX3VzZXJfZ3VpZCI6IjVlNG5rbHFidDAwcXg2OWdya3ppbHlnc2ciLCJpYXQiOjE3MDk1NTI0MTcsImV4cCI6MTcwOTU1NjAxN30._Xrs71CPhpP87vu-zLXYiNTA6DGqf3CjzdaQZY0mmvs
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjI4OWVhNjJhNTYwODBjNWIiLCJ0ciI6ImU2YmViYTZmMWVmZjA1MzA2ZGM5ZDQyZWY0ZjBmZDAwIiwidGkiOjE3MDk1NTI0MjMwOTksInRrIjoiODg4MzEifX0=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 12
server: cloudflare
etag: W/"c-F6g7sByJuuOcYYkgTnzj94yg+ZE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19754688f90e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:22 GMT

POST
H3 200 search Show response
cov.savings.workingadvantage.com/decisions/ 12 B
417 B 156ms
155ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/decisions/search

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eef46741adfc3a9f76294d3b78f37a45f113092ac9d44ee77c7a038a88ff09a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

tracestate: 88831@nr=0-1-2647367-1120218725-095e3fc2b4f71e27----1709552423103
traceparent: 00-124d94e02ed9dc503722b16a8739ed00-095e3fc2b4f71e27-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjA5NWUzZmMyYjRmNzFlMjciLCJ0ciI6IjEyNGQ5NGUwMmVkOWRjNTAzNzIyYjE2YTg3MzllZDAwIiwidGkiOjE3MDk1NTI0MjMxMDMsInRrIjoiODg4MzEifX0=
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 12
server: cloudflare
etag: W/"c-F6g7sByJuuOcYYkgTnzj94yg+ZE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19754689490e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:22 GMT

POST
H3 200 search Show response
cov.savings.workingadvantage.com/decisions/ 12 B
417 B 164ms
164ms XHR
application/json 104.18.39.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cov.savings.workingadvantage.com/decisions/search

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.39.111 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eef46741adfc3a9f76294d3b78f37a45f113092ac9d44ee77c7a038a88ff09a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

tracestate: 88831@nr=0-1-2647367-1120218725-33c5f8b0533f68ef----1709552423105
traceparent: 00-cdc6ccfe6e7aacf2341ae8f3958dc500-33c5f8b0533f68ef-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjMzYzVmOGIwNTMzZjY4ZWYiLCJ0ciI6ImNkYzZjY2ZlNmU3YWFjZjIzNDFhZThmMzk1OGRjNTAwIiwidGkiOjE3MDk1NTI0MjMxMDUsInRrIjoiODg4MzEifX0=
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://cov.savings.workingadvantage.com/home

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 12
server: cloudflare
etag: W/"c-F6g7sByJuuOcYYkgTnzj94yg+ZE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 85f19754689690e6-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Mon, 04 Mar 2024 11:40:22 GMT

GET
H/1.1 200
OK persons Show response
people.api.boomtrain.com/ 179 B
494 B 157ms
156ms XHR
application/json 52.45.81.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/persons?data=eyIkc2V0Ijp7InVzZXJfaWQiOiI1ZTRua2xxYnQwMHF4Njlncmt6aWx5Z3NnIn0sImJzaW4iOiJhQUNGckxxb3RPSFZ6dDVxWEw0UlNkUmk2TDNxdHBHOGs0aDJrVXlWR1Noa0Q5a29qUEZ4U1FodHVCdkduald6VjdZdUV4elpwSk52cHdQTVZrTG5VQT09In0%3D&site_id=ebg-wag3
Requested by: Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.81.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-81-10.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3c7837665760507ad1ce145c942e973604423587ab738ab471d0975a6bb65ade

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Mon, 04 Mar 2024 11:40:23 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 179

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 101 KB
31 KB 25ms
25ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web&Q_BRANDID=cov.savings.workingadvantage.com

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d356ee389de59db1fbab4a45c7abe6b7bc3d3e9c9260e0fce55ebd2c3bd2e23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 561010
cf-polished: origSize=103878
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 19 Feb 2024 20:16:06 GMT
cf-bgj: minify
server: cloudflare
etag: W/"195c6-18dc302ef70"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f197548e128edc-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 101 KB
31 KB 26ms
26ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web&Q_BRANDID=ebg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d356ee389de59db1fbab4a45c7abe6b7bc3d3e9c9260e0fce55ebd2c3bd2e23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 561010
cf-polished: origSize=103878
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 19 Feb 2024 20:16:06 GMT
cf-bgj: minify
server: cloudflare
etag: W/"195c6-18dc302ef70"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f19754ae2b8edc-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

POST
H2 204 delivery
starget.workingadvantage.com/rest/v1/ 0
48 B 39ms
38ms Ping
text/plain 66.235.152.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://starget.workingadvantage.com/rest/v1/delivery?client=entertainmentbenefit&sessionId=967359bfbb384454bb7d50198f0e0b16&version=2.8.2

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.221 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cov.savings.workingadvantage.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
server: jag
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-origin: https://cov.savings.workingadvantage.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
x-request-id: bd8a51bc-d179-4444-b5a6-b4ceb1afe554

GET
H2 200 7.5f000cafeed9b3b29059.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 2 KB
1 KB 29ms
28ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.5f000cafeed9b3b29059.chunk.js?Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web&Q_BRANDID=ebg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9863e955ed039e7f56ae28ece3c54e5d029cd566154ac973365c2505880c2872

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 561010
cf-polished: origSize=2898
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 19 Feb 2024 20:16:06 GMT
cf-bgj: minify
server: cloudflare
etag: W/"b52-18dc302ef70"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f19754ee7e8edc-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 1.5f4f8c3e3982904758f5.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 28 KB
7 KB 29ms
29ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.5f4f8c3e3982904758f5.chunk.js?Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web&Q_BRANDID=ebg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93bedc0adfe3f37ae0156fc936a5b15f2b769369ed30b469a9d872b684597732

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 561010
cf-polished: origSize=29688
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 19 Feb 2024 20:16:06 GMT
cf-bgj: minify
server: cloudflare
etag: W/"73f8-18dc302ef70"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f19754ee808edc-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 63 KB
23 KB 31ms
31ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web&Q_BRANDID=ebg

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1eaa61116a44b60d15c87e58db63270223e677db1d546e128906d77d11c8a572

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 560924
cf-polished: origSize=65276
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 19 Feb 2024 20:16:06 GMT
cf-bgj: minify
server: cloudflare
etag: W/"fefc-18dc302ef70"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f19754ee828edc-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
2 KB 45ms
23ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_a3DMTKPsH4osgZw&Version=18&Q_ORIGIN=https://cov.savings.workingadvantage.com&Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web&Q_BRANDTIER=lIjhYuMl2g&Q_ARCACHEVERSION=21

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6aad41f621a2320a6dd8d292ef55a75c43e4610af55a68916978504d1d80a945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

servershortname
date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 227415
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 01 Mar 2024 20:30:08 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f197551ebb9bc8-FRA
expires: Mon, 27 Feb 2034 20:30:08 GMT

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
588 B 46ms
24ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_51P1mCE4hMvzcjA&Version=1&Q_InterceptID=SI_a3DMTKPsH4osgZw&Q_ORIGIN=https://cov.savings.workingadvantage.com&Q_CLIENTVERSION=2.1.0&Q_CLIENTTYPE=web&Q_BRANDTIER=lIjhYuMl2g&Q_ARCACHEVERSION=21

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cda4821256c63a64e154b5b581b0e72537e5ff1ce249a99132c507ed448269fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

servershortname
date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 227415
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 01 Mar 2024 20:30:08 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f197551ebf9bc8-FRA
expires: Mon, 27 Feb 2034 20:30:08 GMT

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1 KB 41ms
26ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6aad41f621a2320a6dd8d292ef55a75c43e4610af55a68916978504d1d80a945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

servershortname
date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 227415
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 01 Mar 2024 20:30:08 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f197551ec09bc8-FRA
expires: Mon, 27 Feb 2034 20:30:08 GMT

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
588 B 40ms
25ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cda4821256c63a64e154b5b581b0e72537e5ff1ce249a99132c507ed448269fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cov.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

servershortname
date: Mon, 04 Mar 2024 11:40:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 227415
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 01 Mar 2024 20:30:08 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 85f197551ec19bc8-FRA
expires: Mon, 27 Feb 2034 20:30:08 GMT

POST
H2 200 s1863229676424 Show response
smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LDQM/ 43 B
304 B 25ms
24ms XHR
image/gif 63.140.62.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.workingadvantage.com/b/ss/entbenwag3/1/JS-2.22.4-LDQM/s1863229676424

Requested by

Host: cov.savings.workingadvantage.com
URL: https://cov.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS