refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::6812:2021 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html#qs=r-adbaibjhffjffafjdgfcfacdhgfhjgafghhhabababajfadggac...
Effective URL:
https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid...
Submission: On February 02 via manual (February 2nd 2023, 12:38:16 pm UTC) from US — Scanned from US

Summary HTTP 152 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 53 IPs in 4 countries across 45 domains to perform 152 HTTP transactions. The main IP is 2606:4700:4400::6812:2021, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 606258.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 21st 2023. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.216.60.32 52.216.60.32	16509 (AMAZON-02) (AMAZON-02)
1 1	51.15.152.186 51.15.152.186	12876 (Online SAS) (Online SAS)
1	41.216.176.9 41.216.176.9	212738 (LUSOVPS) (LUSOVPS)
1 3	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
12	2606:4700:440... 2606:4700:4400::6812:2021	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.161.34.94 18.161.34.94	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:440... 2606:4700:4400::ac40:9bdf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2600:1400:d:5... 2600:1400:d:586::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:440... 2606:4700:4400::ac40:9792	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	18.164.124.56 18.164.124.56	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4006:81c::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3965	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 6	52.25.196.209 52.25.196.209	16509 (AMAZON-02) (AMAZON-02)
1	13.225.224.171 13.225.224.171	16509 (AMAZON-02) (AMAZON-02)
19	2607:f8b0:400... 2607:f8b0:4006:820::2008	15169 (GOOGLE) (GOOGLE)
1	34.200.94.148 34.200.94.148	14618 (AMAZON-AES) (AMAZON-AES)
1 3	52.46.128.147 52.46.128.147	16509 (AMAZON-02) (AMAZON-02)
1 3	142.250.65.194 142.250.65.194	15169 (GOOGLE) (GOOGLE)
3 14	2607:f8b0:400... 2607:f8b0:4006:823::2002	15169 (GOOGLE) (GOOGLE)
14	2607:f8b0:400... 2607:f8b0:4006:807::2004	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80f::200e	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::15	15169 (GOOGLE) (GOOGLE)
4 4	142.250.65.166 142.250.65.166	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:820::2003	15169 (GOOGLE) (GOOGLE)
2	63.140.36.103 63.140.36.103	16509 (AMAZON-02) (AMAZON-02)
8 8	44.210.217.65 44.210.217.65	14618 (AMAZON-AES) (AMAZON-AES)
1	34.233.25.80 34.233.25.80	14618 (AMAZON-AES) (AMAZON-AES)
1 1	108.139.29.103 108.139.29.103	16509 (AMAZON-02) (AMAZON-02)
7 8	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42:46::84 2a04:4e42:46::84	54113 (FASTLY) (FASTLY)
3	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	135.148.151.99 135.148.151.99	16276 (OVH) (OVH)
1	2600:9000:23c... 2600:9000:23cb:b000:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
10	151.101.1.44 151.101.1.44	54113 (FASTLY) (FASTLY)
1	2606:4700:440... 2606:4700:4400::ac40:98bb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2001:4998:1c:... 2001:4998:1c:800::1000	14779 (YAHOO) (YAHOO)
1	2a04:4e42:400... 2a04:4e42:400::396	54113 (FASTLY) (FASTLY)
1	108.138.113.246 108.138.113.246	16509 (AMAZON-02) (AMAZON-02)
4	23.41.168.211 23.41.168.211	16625 (AKAMAI-AS) (AKAMAI-AS)
2	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
1	2600:9000:251... 2600:9000:2514:a000:a:8e7d:9900:93a1	16509 (AMAZON-02) (AMAZON-02)
6 12	34.202.55.214 34.202.55.214	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
2	216.223.26.54 216.223.26.54	14744 (INTERNAP-...) (INTERNAP-BLOCK-4)
1 1	2600:1f18:730... 2600:1f18:730:b140:7681:9678:781c:27c9	14618 (AMAZON-AES) (AMAZON-AES)
1	54.204.59.49 54.204.59.49	14618 (AMAZON-AES) (AMAZON-AES)
1	76.13.32.146 76.13.32.146	26101 (YAHOO-BF1) (YAHOO-BF1)
2	23.197.32.188 23.197.32.188	16625 (AKAMAI-AS) (AKAMAI-AS)
2	54.209.198.197 54.209.198.197	14618 (AMAZON-AES) (AMAZON-AES)
2	52.201.63.27 52.201.63.27	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
8 8	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	192.40.39.223 192.40.39.223	27381 (CASALE-MEDIA) (CASALE-MEDIA)
1 2	68.67.161.182 68.67.161.182	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	192.35.249.137 192.35.249.137	11742 (SPOTX-IAD) (SPOTX-IAD)
152	53

1 52.216.60.32 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.15.152.186 (Barcelona, Spain) 1 redirects

ASN12876 (Online SAS, FR)
PTR: operator-crest.insuretechguide.com

klsdkfkw.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 41.216.176.9 (Lisbon, Portugal)

ASN212738 (LUSOVPS, PT)

educatescreen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.76.131 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700:4400::6812:2021 (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.161.34.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-161-34-94.bos50.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::ac40:9bdf (United States)

ASN13335 (CLOUDFLARENET, US)

trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:1400:d:586::1e80 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9792 (United States)

ASN13335 (CLOUDFLARENET, US)

content.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.164.124.56 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-124-56.jfk50.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:81c::200a (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3965 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.25.196.209 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-25-196-209.us-west-2.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.224.171 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-224-171.jfk51.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2607:f8b0:4006:820::2008 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.200.94.148 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-94-148.compute-1.amazonaws.com

pixel1083.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.46.128.147 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.65.194 (Glen Cove, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2607:f8b0:4006:823::2002 (Nutley, United States) 3 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2607:f8b0:4006:807::2004 (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80f::200e (Nutley, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::15 (United States)

ASN15169 (GOOGLE, US)

sgtm.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.65.166 (Glen Cove, United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:820::2002 (Nutley, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:820::2003 (Nutley, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.36.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-36-103.data.adobedc.net

somni.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 44.210.217.65 (Ashburn, United States) 8 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-210-217-65.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.233.25.80 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-233-25-80.compute-1.amazonaws.com

quickenloans.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.29.103 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-103.jfk50.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.72.98 (Glen Cove, United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:46::84 (United States)

ASN54113 (FASTLY, US)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 135.148.151.99 (Warrenton, United States)

ASN16276 (OVH, FR)
PTR: ext.svh191.incmdb.net

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23cb:b000:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.1.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:98bb (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mortgage.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4998:1c:800::1000 (United States)

ASN14779 (YAHOO, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.113.246 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-113-246.jfk50.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.41.168.211 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-41-168-211.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

cdn1.decide.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn1.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2514:a000:a:8e7d:9900:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.pmsrv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 34.202.55.214 (Ashburn, United States) 6 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-55-214.compute-1.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.223.26.54 (Secaucus, United States)

ASN14744 (INTERNAP-BLOCK-4, US)

pix.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b140:7681:9678:781c:27c9 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.204.59.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-59-49.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.13.32.146 (Lockport, United States)

ASN26101 (YAHOO-BF1, US)
PTR: spdc.pbp.vip.bf1.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.197.32.188 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-197-32-188.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.209.198.197 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-209-198-197.compute-1.amazonaws.com

psp.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.201.63.27 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-201-63-27.compute-1.amazonaws.com

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.130.49 (United States) 8 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.40.39.223 (Canada) 1 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.161.182 (New York, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.35.249.137 (Ashburn, United States) 1 redirects

ASN11742 (SPOTX-IAD, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	everesttech.net 22 redirects pixel1083.everesttech.net — Cisco Umbrella Rank: 618252 cm.everesttech.net — Cisco Umbrella Rank: 1000 pixel.everesttech.net — Cisco Umbrella Rank: 4359 sync-tm.everesttech.net — Cisco Umbrella Rank: 556	11 KB
26	doubleclick.net 14 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 29 ad.doubleclick.net — Cisco Umbrella Rank: 184 cm.g.doubleclick.net — Cisco Umbrella Rank: 211	16 KB
19	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	1 MB
17	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 606258 static-msql-prod.refinance.quickenloans.com — Cisco Umbrella Rank: 772813 trackpixel.refinance.quickenloans.com — Cisco Umbrella Rank: 782140 content.refinance.quickenloans.com — Cisco Umbrella Rank: 824509 somni.quickenloans.com — Cisco Umbrella Rank: 254792 cdn.mortgage.quickenloans.com	301 KB
16	google.com www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 70	2 KB
10	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 886 trc.taboola.com — Cisco Umbrella Rank: 639	19 KB
6	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 197 quicken.demdex.net — Cisco Umbrella Rank: 76973	9 KB
6	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 4501 psp.pushnami.com — Cisco Umbrella Rank: 19640 trc.pushnami.com — Cisco Umbrella Rank: 4729	20 KB
4	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 975	4 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	3 KB
4	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 475	119 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 2573 rp.liadm.com — Cisco Umbrella Rank: 1488 rp4.liadm.com — Cisco Umbrella Rank: 6738	14 KB
3	revjet.com ads.revjet.com — Cisco Umbrella Rank: 4083 pix.revjet.com — Cisco Umbrella Rank: 4795	9 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	91 KB
3	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 167	18 KB
3	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 271	3 KB
3	lmbahsj2.com 1 redirects www.lmbahsj2.com — Cisco Umbrella Rank: 728621	19 KB
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 660	951 B
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 417	482 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 203	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 524	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	853 B
2	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 779	1 KB
2	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1195 ads.yahoo.com — Cisco Umbrella Rank: 2562	680 B
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 471	7 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 724	20 KB
2	gstatic.com fonts.gstatic.com	46 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 21	20 KB
2	lowermybills.com content.lowermybills.com — Cisco Umbrella Rank: 662590 sgtm.lowermybills.com — Cisco Umbrella Rank: 720446	4 KB
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 872	450 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 308	752 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1512	157 B
1	lockerdomecdn.com cdn1.lockerdomecdn.com — Cisco Umbrella Rank: 14734	1 KB
1	pmsrv.co c.pmsrv.co — Cisco Umbrella Rank: 52675	4 KB
1	decide.dev cdn1.decide.dev — Cisco Umbrella Rank: 19039	936 B
1	sc-static.net sc-static.net — Cisco Umbrella Rank: 903	13 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1394	8 KB
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 457	634 B
1	omtrdc.net quickenloans.tt.omtrdc.net — Cisco Umbrella Rank: 77178	723 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1787	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 958	6 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 4766	6 KB
1	educatescreen.com educatescreen.com	443 B
1	duckdns.org 1 redirects klsdkfkw.duckdns.org	408 B
1	amazonaws.com s3.amazonaws.com	464 B
152	45

	Domain	Requested by
19	www.googletagmanager.com	refinance.quickenloans.com assets.adobedtm.com www.googletagmanager.com trackpixel.refinance.quickenloans.com
14	www.google.com	refinance.quickenloans.com
14	googleads.g.doubleclick.net	3 redirects www.googletagmanager.com
12	pixel.everesttech.net	6 redirects
9	trc.taboola.com	cdn.taboola.com
8	sync-tm.everesttech.net	8 redirects
8	cm.g.doubleclick.net	7 redirects
8	cm.everesttech.net	8 redirects
5	content.refinance.quickenloans.com	refinance.quickenloans.com static-msql-prod.refinance.quickenloans.com
5	dpm.demdex.net	1 redirects refinance.quickenloans.com
5	refinance.quickenloans.com	educatescreen.com www.datadoghq-browser-agent.com
4	pixel.mathtag.com	trackpixel.refinance.quickenloans.com pixel.mathtag.com refinance.quickenloans.com
4	ad.doubleclick.net	4 redirects
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
4	assets.adobedtm.com	refinance.quickenloans.com assets.adobedtm.com
3	connect.facebook.net	s3.amazonaws.com connect.facebook.net
3	www.googleadservices.com	1 redirects www.googletagmanager.com trackpixel.refinance.quickenloans.com
3	s.amazon-adsystem.com	1 redirects refinance.quickenloans.com
3	www.lmbahsj2.com	1 redirects trackpixel.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	sync.search.spotxchange.com	1 redirects
2	us-u.openx.net	1 redirects
2	ib.adnxs.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	www.facebook.com	refinance.quickenloans.com
2	trc.pushnami.com	www.datadoghq-browser-agent.com
2	psp.pushnami.com	www.datadoghq-browser-agent.com
2	ct.pinterest.com	s.pinimg.com refinance.quickenloans.com
2	pix.revjet.com	ads.revjet.com
2	s.yimg.com	s3.amazonaws.com www.datadoghq-browser-agent.com
2	s.pinimg.com	s3.amazonaws.com s.pinimg.com
2	somni.quickenloans.com	www.datadoghq-browser-agent.com
2	fonts.gstatic.com	fonts.googleapis.com
2	adservice.google.com	refinance.quickenloans.com
2	www.google-analytics.com	www.googletagmanager.com www.datadoghq-browser-agent.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
1	image2.pubmatic.com
1	pixel.rubiconproject.com
1	ads.yahoo.com
1	sp.analytics.yahoo.com
1	rp4.liadm.com	refinance.quickenloans.com
1	rp.liadm.com	1 redirects
1	alb.reddit.com
1	cdn1.lockerdomecdn.com	trackpixel.refinance.quickenloans.com
1	c.pmsrv.co	trackpixel.refinance.quickenloans.com
1	cdn1.decide.dev	trackpixel.refinance.quickenloans.com
1	sc-static.net	s3.amazonaws.com
1	www.redditstatic.com	s3.amazonaws.com
1	cdn.mortgage.quickenloans.com	trackpixel.refinance.quickenloans.com
1	cdn.taboola.com	s3.amazonaws.com
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	s3.amazonaws.com
1	aa.agkn.com	1 redirects
1	quickenloans.tt.omtrdc.net	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	sgtm.lowermybills.com	www.datadoghq-browser-agent.com
1	pixel1083.everesttech.net	refinance.quickenloans.com
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	content.lowermybills.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
1	educatescreen.com	s3.amazonaws.com
1	klsdkfkw.duckdns.org	1 redirects
1	s3.amazonaws.com
152	65

This site contains links to these domains. Also see Links.

Domain
mortgage.quickenloans.com
privacyportal-cdn.onetrust.com
www.fhfa.gov
capitalmarkets.freddiemac.com
www.nmlsconsumeraccess.org
www.rocketmortgage.com
www.remodelingcalculator.org
www.nytimes.com
www.lendingtree.com
marketing.lowermybills.com

Subject Issuer	Validity	Valid
s3.amazonaws.com Amazon RSA 2048 M01	`2022-12-06` - `2023-12-05`	a year	crt.sh
educatescreen.com Sectigo RSA Domain Validation Secure Server CA	`2022-11-16` - `2023-11-16`	a year	crt.sh
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2023-01-21` - `2024-01-21`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M02	`2023-02-02` - `2024-03-02`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
lowermybills.com Cloudflare Inc ECC CA-3	`2022-11-10` - `2023-11-10`	a year	crt.sh
*.pushnami.com Amazon	`2022-04-03` - `2023-05-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-11` - `2023-05-10`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-14` - `2024-01-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.tmogul.com Amazon	`2022-06-15` - `2023-07-14`	a year	crt.sh
sgtm.lowermybills.com GTS CA 1D4	`2023-01-09` - `2023-04-09`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
somni.quickenloans.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-12` - `2023-04-12`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-28` - `2023-08-08`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-11-11` - `2023-02-09`	3 months	crt.sh
*.revjet.com Sectigo RSA Domain Validation Secure Server CA	`2022-03-14` - `2023-04-11`	a year	crt.sh
*.liadm.com Amazon	`2023-01-01` - `2024-01-30`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2022-12-08` - `2023-12-31`	a year	crt.sh
mortgage.quickenloans.com Cloudflare Inc ECC CA-3	`2022-11-10` - `2023-11-10`	a year	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-01-19` - `2023-03-08`	2 months	crt.sh
www.redditstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-16` - `2023-05-15`	6 months	crt.sh
sc-static.net Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
pixel.mathtag.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-05` - `2023-07-05`	a year	crt.sh
cdn1.decide.dev R3	`2023-01-06` - `2023-04-06`	3 months	crt.sh
pmsrv.co Amazon	`2022-10-16` - `2023-11-14`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2022-05-13` - `2023-05-13`	a year	crt.sh
cdn1.lockerdomecdn.com R3	`2023-01-06` - `2023-04-06`	3 months	crt.sh
s.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-21`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-16` - `2023-05-14`	6 months	crt.sh
*.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-01-03` - `2023-06-28`	6 months	crt.sh

This page contains 5 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
Frame ID: 845FF1690C751160ADCBE2119E96116E
Requests: 97 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: 618664AA58A013167B7EE7D06E630C3B
Requests: 19 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: 3FAC8653FA11BFBBD0704FD173B96285
Requests: 31 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: 01D525E1290A05B76E4ACEC4198DC0DE
Requests: 1 HTTP requests in this frame

Frame: https://pixel.mathtag.com/sync/iframe?mt_uuid=173f63db-aeaf-4100-b41a-3270295efc91&no_iframe=1&mt_adid=245296&source=mathtag
Frame ID: 77E7FEB3E3C68AA0E0CDB748E7544D4F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

QuickenLoans

Page URL History Show full URLs

https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html Page URL
http://klsdkfkw.duckdns.org/qs=r-adbaibjhffjffafjdgfcfacdhgfhjgafghhhabababajfadggaccadggkadhjgackejfkacb HTTP 302
https://educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZ... Page URL
https://www.lmbahsj2.com/2813G1N/FGXLG/?sub1=690488&sub2=1321261393 HTTP 302
https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

152
Requests

83 %
HTTPS

37 %
IPv6

45
Domains

65
Subdomains

53
IPs

4
Countries

1886 kB
Transfer

5264 kB
Size

64
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://mortgage.quickenloans.com/legal/MSQL_stateprivacy.php
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: http://capitalmarkets.freddiemac.com/debt/pdf/guide_gse_debtsecurities.pdf
Title: http://capitalmarkets.freddiemac.com/debt/pdf/guide_gse_debtsecurities.pdf

Search URL Search Domain Scan URL

URL: https://www.nmlsconsumeraccess.org/
Title: www.NMLSConsumerAccess.org

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/email-policy
Title: E-Mail Policy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/security-privacy
Title: Security and Privacy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/disclosures-licenses
Title: Disclosures and Licenses

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/opt-out?show=email
Title: Communication Opt-Out

Search URL Search Domain Scan URL

URL: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/
Title: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates
Title: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates

Search URL Search Domain Scan URL

URL: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/
Title: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/MSQL_terms.php
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/MSQL_privacy.php
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/licenses.php
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/ad-targeting.php
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://marketing.lowermybills.com/api/marketing/redirect?uid=214966&prd=MS
Title: Go To LowerMyBills

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html Page URL
http://klsdkfkw.duckdns.org/qs=r-adbaibjhffjffafjdgfcfacdhgfhjgafghhhabababajfadggaccadggkadhjgackejfkacb HTTP 302
https://educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZFoEzWlRhCzvxeQaiSgEAWeVGqObMn/84 Page URL
https://www.lmbahsj2.com/2813G1N/FGXLG/?sub1=690488&sub2=1321261393 HTTP 302
https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://klsdkfkw.duckdns.org/qs=r-adbaibjhffjffafjdgfcfacdhgfhjgafghhhabababajfadggaccadggkadhjgackejfkacb HTTP 302
https://educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZFoEzWlRhCzvxeQaiSgEAWeVGqObMn/84

Request Chain 15

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675341485562 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675341485562

Request Chain 23

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894 HTTP 302
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Request Chain 24

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=ra7bY6m0NK2boPMPzLC8iAI&random=2127602569&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=2127602569&sscte=1&crd=&is_vtc=1&ocp_id=ra7bY6m0NK2boPMPzLC8iAI&random=4275305614

Request Chain 33

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=1476893159.1675341486;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CKWtn7Ht9vwCFZMY5woddSwLcw;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=1476893159.1675341486;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CKWtn7Ht9vwCFZMY5woddSwLcw;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851

Request Chain 34

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=1476893159.1675341486;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=COevn7Ht9vwCFcoFrQYdqyEN3A;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=1476893159.1675341486;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=COevn7Ht9vwCFcoFrQYdqyEN3A;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851

Request Chain 47

https://cm.everesttech.net/cm/dd?d_uuid=08959822291591697470595548003812924015 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y9uurgAABJeUPlM5&d_uuid=08959822291591697470595548003812924015

Request Chain 50

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=1592898691&cv=11&fst=1675341486012&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=rq7bY_2_AtuBoPMPvYSV0As&sscte=1&crd=&pscrd=Ek5DaEFJZ052dG5nWVFsX19fMHRfdWpaUmJFaVlBYk5ST24xQy03SVZwZlRCbWhkTjB5Y1RnSWkxVXpuOWhDRGJCdTBmdE1DOElXMWQ4ZFEaWkNoRUlnTnZ0bmdZUTdKV0Q5Yl9XaWVDc0FSSXVBSDJTNUtpZjVBX1oxNUo2VW5JWERoeHlORnBvY1RqeGZobGFHRVk3VmtXcTZsdGVsZlZ4MUM5WjlKQ2Rldw HTTP 302
https://www.google.com/pagead/1p-conversion/1062919768/?random=1592898691&cv=11&fst=1675341486012&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ052dG5nWVFsX19fMHRfdWpaUmJFaVlBYk5ST24xQy03SVZwZlRCbWhkTjB5Y1RnSWkxVXpuOWhDRGJCdTBmdE1DOElXMWQ4ZFEaWkNoRUlnTnZ0bmdZUTdKV0Q5Yl9XaWVDc0FSSXVBSDJTNUtpZjVBX1oxNUo2VW5JWERoeHlORnBvY1RqeGZobGFHRVk3VmtXcTZsdGVsZlZ4MUM5WjlKQ2Rldw&is_vtc=1&ocp_id=rq7bY_2_AtuBoPMPvYSV0As&cid=CAQSKQDUE5ymqsYbd2g1deNVJzQhhQs86U-D0v4sQQ59XKFggk4dYupXlOmx&random=191828440

Request Chain 52

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=08959822291591697470595548003812924015 HTTP 302
https://dpm.demdex.net/ibs:dpid=21&dpuuid=214900604415006472544

Request Chain 53

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935 HTTP 302
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=3463286174

Request Chain 54

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MDg5NTk4MjIyOTE1OTE2OTc0NzA1OTU1NDgwMDM4MTI5MjQwMTU= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEOphAjI1Kc43PGgucnbCZ6g&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 84

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEIAOonN3uQXttaJrsNjsT1k&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 88

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEIAOonN3uQXttaJrsNjsT1k&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 96

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESEIAOonN3uQXttaJrsNjsT1k&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 108

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESEIAOonN3uQXttaJrsNjsT1k&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 110

https://rp.liadm.com/j?dtstmp=1675341488331&aid=a-06d7&se=e30&duid=ddc3c751f117--01gr924qj49k8zc883c8r0s53e&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ext_s_ecid=MCMID%7C08747214497915888910580760187436015271&wpn=lc-bundle&refr=https%3A%2F%2Feducatescreen.com%2F HTTP 302
https://rp4.liadm.com/j?dtstmp=1675341488331&aid=a-06d7&se=e30&duid=ddc3c751f117--01gr924qj49k8zc883c8r0s53e&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ext_s_ecid=MCMID%7C08747214497915888910580760187436015271&wpn=lc-bundle&refr=https%3A%2F%2Feducatescreen.com%2F&i6=MjYwMjpmZmM4OjI6MTA0OjoxMA%3D%3D&n3pc=true

Request Chain 115

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEIAOonN3uQXttaJrsNjsT1k&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 122

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEIAOonN3uQXttaJrsNjsT1k&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 134

https://cm.everesttech.net/cm/yh HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y9uurgAABJeUPlM5&sigv=1&esig=1~ed2d7eb4efc4882ecb8e91b44297b1b180d2963b

Request Chain 137

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTl1dXJnQUFCSmVVUGxNNQ==

Request Chain 138

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y9uurgAABJeUPlM5&expires=90

Request Chain 139

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y9uurgAABJeUPlM5 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y9uurgAABJeUPlM5&C=1

Request Chain 140

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=Y9uurgAABJeUPlM5 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY9uurgAABJeUPlM5

Request Chain 141

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y9uurgAABJeUPlM5 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=Y9uurgAABJeUPlM5

Request Chain 142

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y9uurgAABJeUPlM5

Request Chain 143

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y9uurgAABJeUPlM5&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y9uurgAABJeUPlM5&img=1&__user_check__=1&sync_id=7340dca4-a2f6-11ed-9e58-18ede64a0503

Request Chain 147

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y9uurgAABJeUPlM5&t=2592000&o=0

152 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK d.html
s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/ 108 B
464 B 115ms
44ms Document
text/html 52.216.60.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.60.32 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Content-Length: 108
Content-Type: text/html
Date: Thu, 02 Feb 2023 12:38:03 GMT
ETag: "302d7ff95b82117f2bff97d1c3d8d7f1"
Last-Modified: Thu, 02 Feb 2023 11:54:15 GMT
Server: AmazonS3
x-amz-id-2: aZyXaB09W+BB+HMgqTG++8ySxjL5+UGajKVCKJgadXZfB/0VQash7DMLKguYJQ3el1eVDdvrUik=
x-amz-request-id: V1VXJDMHHAQFP4C8

GET
H/1.1

200
OK

84
educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZFoEzWlRhCzvxeQaiSgEAWeVGqObMn/
Redirect Chain

http://klsdkfkw.duckdns.org/qs=r-adbaibjhffjffafjdgfcfacdhgfhjgafghhhabababajfadggaccadggkadhjgackejfkacb
https://educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZFoEzWlRhCzvxeQaiSgEAWeVGqObMn/84

130 B
443 B

1972ms
629ms

Document
text/html

41.216.176.9
LUSOVPS

General

Check archive.org

Show headers Download Go to

Full URL: https://educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZFoEzWlRhCzvxeQaiSgEAWeVGqObMn/84
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 41.216.176.9 Lisbon, Portugal, ASN212738 (LUSOVPS, PT),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html#qs=r-adbaibjhffjffafjdgfcfacdhgfhjgafghhhabababajfadggaccadggkadhjgackejfkacb
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language: en-US,en;q=0.9

Response headers

Connection: close
Content-Length: 130
Content-Type: text/html; charset=UTF-8
Date: Thu, 02 Feb 2023 12:38:03 GMT
Server: Apache

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 02 Feb 2023 12:38:02 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16
X-Powered-By: PHP/5.4.16
location: https://educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZFoEzWlRhCzvxeQaiSgEAWeVGqObMn/84

GET
H2

200

Primary Request / Show response
refinance.quickenloans.com/
Redirect Chain

https://www.lmbahsj2.com/2813G1N/FGXLG/?sub1=690488&sub2=1321261393
https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304...

120 KB
23 KB

656ms
577ms

Document
text/html

2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851

Requested by

Host: educatescreen.com
URL: https://educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZFoEzWlRhCzvxeQaiSgEAWeVGqObMn/84

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

9b12db25717b1f4f1c1c4733066ce57b31ee8d6e1d799cfbc38384c3356e86b8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://educatescreen.com/176507d57b59b34d800/45666_12654685_11_2685_84/rdcqTUXDvwzwZFUeUqGlyAOMZBZFzZFoEzWlRhCzvxeQaiSgEAWeVGqObMn/84
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language: en-US,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 7932fb56df1bd163-BUF
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Thu, 02 Feb 2023 12:38:05 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 275
content-type: text/html; charset=utf-8
date: Thu, 02 Feb 2023 12:38:04 GMT
location: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: acccc73d-bd31-49e7-b51c-365826422ca4

GET
H2 200 main.b4d3d5254949875ebdfb.css
static-msql-prod.refinance.quickenloans.com/ 66 KB
12 KB 132ms
80ms Stylesheet
text/css 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a6cf3b6daf39a9b2f236a2b3449bc004378762c6ddc1fc09c98673ad247a691

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
x-amz-version-id: bgWoTF6nOFJSd2LdMoXh6CzSOHrLR3yB
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 5d3699e517195152b2b0917312ab80b8.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P4
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Thu, 20 Oct 2022 17:38:42 GMT
server: cloudflare
etag: W/"bec2a4f40238e442b516b45d05a11752"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 7932fb5acf62d14f-BUF
x-amz-cf-id: PLPoJXfkUXR6hDusyjR-DiJkrMJv-Dpu5ZXDAMvU0jk4Uq_02wFjtw==
expires: Thu, 02 Feb 2023 16:38:05 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 19 KB
6 KB 102ms
34ms Script
application/x-javascript 18.161.34.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.161.34.94 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-161-34-94.bos50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f3496bc7c277d917d35553c46ed1597a86065494cac582e42a3a1d55aedef7fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 10:16:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
via: 1.1 747aa0aabf4e8bc9807d0bc2f5a6d7c0.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P2
age: 8518
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6124
x-xss-protection: 1; mode=block
last-modified: Mon, 30 May 2022 14:38:02 GMT
server: AmazonS3
etag: "5add60196e5f96a414fb4b9586764e5d"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: Ufa6yalcmn0NZisry5-seM0-62sHFKgekgrBNXTN_C3N2qP5vGF_QA==

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
882 B 139ms
78ms Script
application/javascript 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0093220d4c1b5e63d15fb4e0086a3f1a5e352c183335c5ec2b26dc0397804b65

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-f9ce7dd407c990d717ff.js
date: Thu, 02 Feb 2023 12:38:05 GMT
via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: IAD12-P1
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 25 Jan 2023 05:07:22 GMT
server: cloudflare
etag: W/"ece8253d43bc7b407b5150bffe3e81a6"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7932fb5adf66d14f-BUF
x-amz-cf-id: 2wq2g5fyQRyoKcaas0dTJRoN-S7XXAznwZtGvLM9lVxcaUkW82ejWg==
expires: Thu, 02 Feb 2023 16:38:05 GMT

GET
H2 200 launch-ENac0456a305144bd1997bb2b709c90a1c.min.js Show response
assets.adobedtm.com/ 304 KB
96 KB 144ms
26ms Script
application/x-javascript 2600:1400:d:586::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:586::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4cd749cb1a66ca42afac2d38a803da602eef0619f6a9efba23a8ab454226575e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
last-modified: Tue, 04 Oct 2022 13:43:04 GMT
server: AkamaiNetStorage
etag: "0fb6aa3c4bf73f5d329f4861a8e0c874:1664890984.616336"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 97479
expires: Thu, 02 Feb 2023 13:38:05 GMT

GET
H2 200 deviceatlas-1.6.min.js Show response
content.lowermybills.com/deviceatlas-1.6/ 7 KB
3 KB 87ms
32ms Script
application/javascript 2606:4700:4400::ac40:9792
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://content.lowermybills.com/deviceatlas-1.6/deviceatlas-1.6.min.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9792 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d60aa838e099599b51126886e7fa0334ad2022c7b4f76977c86f45463b55bfe9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: IAD12-P1
age: 2519
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 25 Jan 2023 22:43:09 GMT
server: cloudflare
etag: W/"67510dbcee1857a225b8f76bdc940c26"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 7932fb5c5932d153-BUF
x-amz-cf-id: WPT1rZX6HLQgLvisvw-EBfEsLjVZMdceWQuKID6jap5BJlepGlX8Eg==
expires: Thu, 02 Feb 2023 14:38:05 GMT

GET
H2 200 623bac6703b37600138f67a3 Show response
api.pushnami.com/scripts/v1/push/ 87 KB
18 KB 95ms
30ms Script
application/javascript 18.164.124.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-56.jfk50.r.cloudfront.net
Software: /
Resource Hash: ca74681b2e650027d2baff22e721ebeb61686988c51db5a86944f36f1b2b6901

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:31:41 GMT
content-encoding: gzip
via: 1.1 d0abe8e02f00bbb3378a9a4149801740.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P7
age: 384
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: pahLVOUJTXaXStnzEQ96U-uaHSA-wxC-pmU5pMs5sDI8fp6V2-vnRw==

GET
H2 200 css2
fonts.googleapis.com/ 822 B
822 B 103ms
40ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4b01f9a7a6886d1fa34e50af146b0c0df3e7582547121f00f307afd7766b5d54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security: max-age=31536000
date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:38:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
752 B 105ms
42ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7a3bcc4ea246253c762bbf4df2af7be93a663ec62af9fea8188e9c8a7f8b8c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security: max-age=31536000
date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:38:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
781 B 116ms
54ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

19094c592aeeebae116447ed13c90636e41825350032b21a7c4e8eb202d448bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security: max-age=31536000
date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:38:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H2 200 css2
fonts.googleapis.com/ 403 B
367 B 103ms
41ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dbe0bf1b9db8912770e849b979650a616b44dc78930290df944591d75d292a08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security: max-age=31536000
date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:38:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H2 200 pixel-f9ce7dd407c990d717ff.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 175 KB
23 KB 78ms
78ms Script
application/javascript 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a541998b9c385a9e7c8aa59980b151070459d8fd8f1dc4a5f469cd1d57d43d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
via: 1.1 06ebe0ab523bf2d4fc9ffb022fd19e36.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: BOS50-P2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Nov 2022 16:36:05 GMT
server: cloudflare
etag: W/"f17f655e0dd528d1e5dcac0495fd9f58"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7932fb5c1fa2d14f-BUF
x-amz-cf-id: 7GPbRgkoHsJi0StI3mOVVLOMP2r55zJJ_Le2W7a_pZZ1SDU3BxEj0g==
expires: Thu, 02 Feb 2023 16:38:05 GMT

GET
H2 200 main.b4d3d5254949875ebdfb.js Show response
static-msql-prod.refinance.quickenloans.com/ 502 KB
143 KB 64ms
63ms Script
application/javascript 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3e9287e2c3b20f9f8d9afb0c8117d6a3cec13f3b8587f362dc5476ed1eedaad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
x-amz-version-id: MMnA..uCDYi40sShNeTo5YQbb274gJAz
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 877f105eccbc5cf798a3a34d16fc0c74.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P3
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 06 Dec 2022 08:46:25 GMT
server: cloudflare
etag: W/"791cb2470b6581813f72f27d0aa68286"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7932fb5c7fb1d14f-BUF
x-amz-cf-id: o6uxyFUMSmLg_XekOw20kyqRU8RfTZ1M9KAImHnkHNlwLFluB3Gm_g==
expires: Thu, 02 Feb 2023 16:38:05 GMT

GET
H2 200 vaafb692b2aea4879b33c060e79fe94621666317369993 Show response
static.cloudflareinsights.com/beacon.min.js/ 17 KB
6 KB 112ms
61ms Script
text/javascript 2606:4700::6810:3965
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
server: cloudflare
etag: W/2022.10.1
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7932fb5d8ea6d157-BUF

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675341485562
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675341485562

4 KB
2 KB

79ms
79ms

XHR
application/json

52.25.196.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675341485562

Requested by

Protocol

HTTP/1.1

Server

52.25.196.209 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-25-196-209.us-west-2.compute.amazonaws.com

Software

Resource Hash

8ce9cb041fadcdc6eabbab3358a66971cd36e977014dda4b6559782c00a5c992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

DCS: dcs-prod-usw2-2-v041-0c345fe98.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: HYFcq6f7QV0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1250
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-usw2-2-v041-0fbbb389d.edge-usw2.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: mlahV413TLs=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1675341485562
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 34 KB
12 KB 30ms
29ms Script
application/x-javascript 2600:1400:d:586::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:586::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "dfdd9e1f988805f0c2fbb10cd6b8f034:1663863409.614694"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12384
expires: Thu, 02 Feb 2023 13:38:05 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 3 KB
2 KB 27ms
27ms Script
application/x-javascript 2600:1400:d:586::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:586::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "b89fcb8870ac40eecb6d3cc844d35389:1663863409.92483"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1598
expires: Thu, 02 Feb 2023 13:38:05 GMT

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 25 KB
9 KB 31ms
31ms Script
application/x-javascript 2600:1400:d:586::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:586::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:50 GMT
server: AkamaiNetStorage
etag: "d220d501715e0484d0dddeac614f902c:1663863410.217006"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8755
expires: Thu, 02 Feb 2023 13:38:05 GMT

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 119ms
30ms Script
application/javascript 13.225.224.171
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.224.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-224-171.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:37:42 GMT
content-encoding: br
via: 1.1 d77f2f1d7dfcddde244aedf1c9ed7a8e.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK51-C1
age: 39
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: -VjeXXJ_hgoehDfH580MpOiMb5UKJ7rjcUneNUi8j7_rShsPkDgOZg==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 99 KB
39 KB 110ms
41ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4d068312f585cf6337128ffc11fb152b19c9a372367d97c3293055fecedf1ee3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39298
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 40ms
40ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0d27e0fa1ad9b2e5851d637bd4d5ed6cc31309f8ca146219558897af499b3b64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43935
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H/1.1 200
OK p
pixel1083.everesttech.net/1083/ 128 B
796 B 485ms
36ms Image
image/png 34.200.94.148
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel1083.everesttech.net/1083/p?ev_transid=&ev_=%loanpurpose%&_lead=1
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.94.148 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-94-148.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:06 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

GET
H/1.1

200
OK

iui3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...

43 B
855 B

63ms
63ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Requested by

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Pragma: no-cache
Date: Thu, 02 Feb 2023 12:38:05 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: DTFQ5P5782DYGE1T0ED8
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 02 Feb 2023 12:38:05 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: EEPKY33QT2EXH97K37S2
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/776757481/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=ra7bY6m0NK2boP...
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=2127602569&sscte=1&crd=&is_vtc=1&oc...

42 B
455 B

139ms
48ms

Image
image/gif

2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=2127602569&sscte=1&crd=&is_vtc=1&ocp_id=ra7bY6m0NK2boPMPzLC8iAI&random=4275305614

Requested by

Protocol

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:05 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=2127602569&sscte=1&crd=&is_vtc=1&ocp_id=ra7bY6m0NK2boPMPzLC8iAI&random=4275305614
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 213 KB
75 KB 42ms
42ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-WQ7TGZQSWQ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c3459087f17a0ae2f44527b1469028bce8ca2d282404c9093f080f168a03b5cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76685
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 66ms
42ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-4641735&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

72b6e32589409062f7da67d61243ac889d71f561b0c439075bdd184fcb3067d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44153
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
64 KB 94ms
70ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1da7501a8e8ed5316e6cb4dea5e8a8b7fdc2c36c0a46f0138d199f96b5430e51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65852
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 62ms
53ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9045885&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5160c3f1f966b5f1215cbf7e9e681f4bd9228de7e9f56b93ce1b51c5c7451571

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44153
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 51ms
42ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

121b149eac0ac52ae33e8e7bdc54935992215ac4c602d087bb222de88bbea915

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43928
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:05 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 90ms
25ms Script
text/javascript 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 02 Feb 2023 12:07:54 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 1811
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Thu, 02 Feb 2023 14:07:54 GMT

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 5 KB
3 KB 161ms
160ms XHR
application/json 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

3a1dc61fe6d4623c026e5d4675e2b719907445f110375cefdcf7c4d91c08f838

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type: application/json

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"15af-tqlYdI8DBUNaRksG+motI5/oxMM"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 7932fb5ea9c7d163-BUF
x-xss-protection: 1; mode=block

GET
H2 200 collect Show response
sgtm.lowermybills.com/g/ 65 B
549 B 167ms
83ms XHR
text/plain 2001:4860:4802:34::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.lowermybills.com/g/collect?v=2&tid=G-WQ7TGZQSWQ&gtm=2oe1u0&_p=1822348618&cid=1389651363.1675341486&ul=en-us&sr=1600x1200&_fplc=0&uaW=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=US&_s=1&sid=1675341485&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&dr=https%3A%2F%2Feducatescreen.com%2F&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&richsstsse

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::15 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 google
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true

GET
H2

200

dc_pre=CKWtn7Ht9vwCFZMY5woddSwLcw;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=1476893159.1675341486;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenl...
https://ad.doubleclick.net/activity;dc_pre=CKWtn7Ht9vwCFZMY5woddSwLcw;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=1476893159.1675341486;u3=;u14=%25qls.value%25;~ore...
https://adservice.google.com/ddm/fls/z/dc_pre=CKWtn7Ht9vwCFZMY5woddSwLcw;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Fr...

42 B
107 B

407ms
94ms

Image
image/gif

2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKWtn7Ht9vwCFZMY5woddSwLcw;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851

Requested by

Protocol

Server

2607:f8b0:4006:820::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CKWtn7Ht9vwCFZMY5woddSwLcw;src=4641735;type=conve0;cat=cored0;ord=1;num=6931523704900;gtm=2od1u0;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

dc_pre=COevn7Ht9vwCFcoFrQYdqyEN3A;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quick...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=1476893159.1675341486;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3...
https://ad.doubleclick.net/activity;dc_pre=COevn7Ht9vwCFcoFrQYdqyEN3A;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=1476893159.1675341486;u3=Date.now().toString()...
https://adservice.google.com/ddm/fls/z/dc_pre=COevn7Ht9vwCFcoFrQYdqyEN3A;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=*;u3=Date.now().toString();u14=%25qls.value...

42 B
401 B

404ms
90ms

Image
image/gif

2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COevn7Ht9vwCFcoFrQYdqyEN3A;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851

Requested by

Protocol

Server

2607:f8b0:4006:820::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=COevn7Ht9vwCFcoFrQYdqyEN3A;src=9045885;type=conversi;cat=corethan;ord=1;num=3464753575297;gtm=2od1u0;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/1062919768/ 2 KB
1 KB 51ms
50ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1062919768/?random=1675341486012&cv=11&fst=1675341486012&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.194 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f2.1e100.net

Software

cafe /

Resource Hash

c1cdf12dff1ba6a0adef6c126a8a0075fa2e31c55031dbdfe73dc6821d6a57cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1357
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
214 B 39ms
38ms XHR
text/plain 2607:f8b0:4006:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1822348618&t=pageview&_s=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&dr=https%3A%2F%2Feducatescreen.com%2F&ul=en-us&de=UTF-8&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAQABAAAAACAAs~&jid=1881300144&gjid=1912241747&cid=1389651363.1675341486&uid=&tid=UA-3849768-74&_gid=750161072.1675341486&_r=1&_slc=1&gtm=2ou1u0&z=887711064

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
752 B 101ms
87ms Image
image/png 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
via: 1.1 f141d4a0b9a72779a9dd3a57c2c25f52.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK51-C1
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Mon, 20 Jun 2022 18:44:27 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7932fb600891d14f-BUF
x-amz-cf-id: UOz_gewq_rSI2ybbsC_rnVySo9-GIsltQKktmFJf2ToDq09SqajBHQ==
expires: Thu, 02 Feb 2023 16:38:06 GMT

GET
H2 200 overlay-close.svg
content.refinance.quickenloans.com/msql/EdisonOverlay/ 586 B
515 B 79ms
66ms Image
image/svg+xml 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/EdisonOverlay/overlay-close.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
via: 1.1 81dc2840587b5003ff52334e3af886a4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR52-C2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 20 Jun 2022 18:44:27 GMT
server: cloudflare
etag: W/"58887760fe01f3933d5ae2d7bcc3f373"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 7932fb60088dd14f-BUF
x-amz-cf-id: KrVBvBHGAGDAp6kA3LUaxSjeGs_yx0paS2qEv06x2eytWJtrgNYyeA==
expires: Thu, 02 Feb 2023 16:38:06 GMT

GET
H2 200 qllogo.png
content.refinance.quickenloans.com/msql/ 4 KB
4 KB 58ms
47ms Image
image/png 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/qllogo.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
via: 1.1 329b0fc45cd0599e7f2c2cee0cf4ae8e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR52-C2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 3877
x-xss-protection: 1; mode=block
last-modified: Mon, 20 Jun 2022 18:44:27 GMT
server: cloudflare
etag: "277055237f3837abfae204219c13fa6c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7932fb600890d14f-BUF
x-amz-cf-id: EqT5B5nArbTlQN-DfXasDNcrw9PVxml-ujrtvSHLRXBsHmUVlE4VFQ==
expires: Thu, 02 Feb 2023 16:38:06 GMT

GET
H2 200 redarrow1.png
content.refinance.quickenloans.com/msql/ 7 KB
7 KB 100ms
89ms Image
image/png 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/redarrow1.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
via: 1.1 81834769243dfd27a095a32cf5b86722.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR52-C2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 6656
x-xss-protection: 1; mode=block
last-modified: Wed, 08 Jun 2022 17:46:57 GMT
server: cloudflare
etag: "55eb59d4535de0b41be9b7465ec7d9c3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7932fb60088ed14f-BUF
x-amz-cf-id: 5VqQPxgYMccGMqNdPAmCjf_Ayv18NzX_i8vXv0y83PX35eJPHLit1A==
expires: Thu, 02 Feb 2023 16:38:06 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 157ms
26ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Fri, 27 Jan 2023 10:24:41 GMT
x-content-type-options: nosniff
age: 526405
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Jan 2024 10:24:41 GMT

GET
H2 200 4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2
fonts.gstatic.com/s/shadowsintolighttwo/v13/ 15 KB
16 KB 188ms
58ms Font
font/woff2 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/shadowsintolighttwo/v13/4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Sat, 28 Jan 2023 12:41:52 GMT
x-content-type-options: nosniff
age: 431774
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15832
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:54:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Jan 2024 12:41:52 GMT

POST
H2 200 ip Show response
refinance.quickenloans.com/api/geo/ 163 B
236 B 180ms
177ms XHR
application/json 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/geo/ip

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

ed49359dd841f7601fbe26fa64ecfbe97a4ad9468732cd9a0266527d610a8331

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type: application/json

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"a3-/HmBCh/r+jGay3+JnT613b1OO1Y"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 7932fb612a76d163-BUF
x-xss-protection: 1; mode=block

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
110 B 465ms
464ms XHR
text/plain 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type: application/json

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 7932fb613a79d163-BUF
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK dest5.html Show response
quicken.demdex.net/ Frame 6186 7 KB
3 KB 409ms
77ms Document
text/html 52.25.196.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.25.196.209 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-25-196-209.us-west-2.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-usw2-1-v041-00c17ce9c.edge-usw2.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: gJb0Zp7JS0E=
content-encoding: gzip
date: Thu, 2 Feb 2023 12:38:06 GMT
last-modified: Fri, 28 Oct 2022 11:03:03 GMT
transfer-encoding: chunked
vary: accept-encoding

GET
H2 200 id Show response
somni.quickenloans.com/ 48 B
469 B 350ms
124ms XHR
application/x-javascript 63.140.36.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=08747214497915888910580760187436015271&ts=1675341486284

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.103 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-36-103.data.adobedc.net

Software

jag /

Resource Hash

4fcdc9958c6771be54ce049f1018c88de729635abea1c81275539a23c629fe20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Y9uurgAABJeUPlM5&d_uuid=08959822291591697470595548003812924015
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=08959822291591697470595548003812924015
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y9uurgAABJeUPlM5&d_uuid=08959822291591697470595548003812924015

0
665 B

85ms
84ms

Image
text/plain

52.25.196.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y9uurgAABJeUPlM5&d_uuid=08959822291591697470595548003812924015

Requested by

Protocol

HTTP/1.1

Server

52.25.196.209 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-25-196-209.us-west-2.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

DCS: dcs-prod-usw2-1-v041-00c17ce9c.edge-usw2.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: FakcMBkpQzI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y9uurgAABJeUPlM5&d_uuid=08959822291591697470595548003812924015
Date: Thu, 02 Feb 2023 12:38:06 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 quicken_sprite_4_4_18.png
content.refinance.quickenloans.com/msql/ 75 KB
75 KB 53ms
52ms Image
image/png 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/quicken_sprite_4_4_18.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.b4d3d5254949875ebdfb.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
via: 1.1 f912c5a5865a58aaaad9710240b6d2f2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR52-C2
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 76537
x-xss-protection: 1; mode=block
last-modified: Mon, 20 Jun 2022 18:44:27 GMT
server: cloudflare
etag: "1f80b3d1f05cc5648c262fba9d39b61a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7932fb6178e9d14f-BUF
x-amz-cf-id: hHGjXlhdC4XzdiS0fkUHpKOhCyvbWvzQN33ClN6WChChRxbkFg_bSA==
expires: Thu, 02 Feb 2023 16:38:06 GMT

POST
H2 200 delivery Show response
quickenloans.tt.omtrdc.net/rest/v1/ 355 B
723 B 233ms
121ms XHR
application/json 34.233.25.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://quickenloans.tt.omtrdc.net/rest/v1/delivery?client=quickenloans&sessionId=13abce2940614b67a7965cf58efe4e13&version=2.10.0
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.25.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-25-80.compute-1.amazonaws.com
Software: /
Resource Hash: 554afba94f8f8112f1999aee0c468921aadf420f75ae2109bd15670cd487f80a

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type: text/plain

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: 597b40d936a8d4531cf564fe825987b2

GET
H2

200

/
www.google.com/pagead/1p-conversion/1062919768/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=1592898691&cv=11&fst=1675341486012&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-...
https://www.google.com/pagead/1p-conversion/1062919768/?random=1592898691&cv=11&fst=1675341486012&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadser...

42 B
108 B

287ms
286ms

Image
image/gif

2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1062919768/?random=1592898691&cv=11&fst=1675341486012&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ052dG5nWVFsX19fMHRfdWpaUmJFaVlBYk5ST24xQy03SVZwZlRCbWhkTjB5Y1RnSWkxVXpuOWhDRGJCdTBmdE1DOElXMWQ4ZFEaWkNoRUlnTnZ0bmdZUTdKV0Q5Yl9XaWVDc0FSSXVBSDJTNUtpZjVBX1oxNUo2VW5JWERoeHlORnBvY1RqeGZobGFHRVk3VmtXcTZsdGVsZlZ4MUM5WjlKQ2Rldw&is_vtc=1&ocp_id=rq7bY_2_AtuBoPMPvYSV0As&cid=CAQSKQDUE5ymqsYbd2g1deNVJzQhhQs86U-D0v4sQQ59XKFggk4dYupXlOmx&random=191828440

Requested by

Protocol

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/1062919768/?random=1592898691&cv=11&fst=1675341486012&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ052dG5nWVFsX19fMHRfdWpaUmJFaVlBYk5ST24xQy03SVZwZlRCbWhkTjB5Y1RnSWkxVXpuOWhDRGJCdTBmdE1DOElXMWQ4ZFEaWkNoRUlnTnZ0bmdZUTdKV0Q5Yl9XaWVDc0FSSXVBSDJTNUtpZjVBX1oxNUo2VW5JWERoeHlORnBvY1RqeGZobGFHRVk3VmtXcTZsdGVsZlZ4MUM5WjlKQ2Rldw&is_vtc=1&ocp_id=rq7bY_2_AtuBoPMPvYSV0As&cid=CAQSKQDUE5ymqsYbd2g1deNVJzQhhQs86U-D0v4sQQ59XKFggk4dYupXlOmx&random=191828440
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 s4248193824256 Show response
somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LCXS/ 4 KB
4 KB 109ms
108ms XHR
application/x-javascript 63.140.36.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LCXS/s4248193824256

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.103 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-36-103.data.adobedc.net

Software

jag /

Resource Hash

70850ddb105dde8d9f866423d26eaa84fdcd74a595d5c7537465d5dfeb01f829

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Content-Type: text/plain;charset=UTF-8

Response headers

x-aam-tid: Cl2HTCvxTgw=
date: Thu, 02 Feb 2023 12:38:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 4218
x-xss-protection: 1; mode=block
dcs: dcs-prod-usw2-2-v041-0ee19a6a4.edge-usw2.demdex.com 2 ms
pragma: no-cache
last-modified: Fri, 03 Feb 2023 12:38:06 GMT
server: jag
etag: 3597768446186717184-4619654971169248950
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Wed, 01 Feb 2023 12:38:06 GMT

GET
H/1.1

200
OK

ibs:dpid=21&dpuuid=214900604415006472544
dpm.demdex.net/ Frame 6186
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=08959822291591697470595548003812924015
https://dpm.demdex.net/ibs:dpid=21&dpuuid=214900604415006472544

42 B
942 B

99ms
93ms

Image
image/gif

52.25.196.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=21&dpuuid=214900604415006472544

Protocol

HTTP/1.1

Server

52.25.196.209 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-25-196-209.us-west-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

DCS: dcs-prod-usw2-1-v041-02dcf106d.edge-usw2.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: vMcVaI9MQCY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
via: 1.1 ed016821a44f073856f1ffba399e1728.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: JFK50-P2
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dpm.demdex.net/ibs:dpid=21&dpuuid=214900604415006472544
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
x-amz-cf-id: xPTSKfgw4dhb1Tk3ygIl1Loei1N3IJ9YL2oMW3ZjYCC3N0hoIMMPtg==
expires: 0

GET
H3

200

/
www.google.com/pagead/1p-user-list/5830051840/ Frame 6186
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=3463286174

42 B
64 B

75ms
69ms

Image
image/gif

2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=3463286174

Protocol

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:06 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=3463286174
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEOphAjI1Kc43PGgucnbCZ6g&google_cver=1
dpm.demdex.net/ Frame 6186
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MDg5NTk4MjIyOTE1OTE2OTc0NzA1OTU1NDgwMDM4MTI5MjQwMTU=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEOphAjI1Kc43PGgucnbCZ6g&google_cver=1?gdpr=0&gdpr_consent=

42 B
942 B

98ms
94ms

Image
image/gif

52.25.196.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEOphAjI1Kc43PGgucnbCZ6g&google_cver=1?gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

52.25.196.209 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-25-196-209.us-west-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

DCS: dcs-prod-usw2-2-v041-0849bb3c3.edge-usw2.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: BMKgSNblQgQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEOphAjI1Kc43PGgucnbCZ6g&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 128 KB
50 KB 46ms
45ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8b20b831c4ed85597134eb5948eb20f3ea9dfb8bd108a4b4b3741fb7b220c635

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50700
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ Frame 3FAC 1 KB
1 KB 134ms
27ms Script
application/javascript 2a04:4e42:46::84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:46::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: aacfea800a59766fdd3672fad8e5eba13abae2dab105014fc9214cb0c1409925

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
x-cdn: fastly
etag: "91c4ea42bc7f1df938d8cd8de8d598db"
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
vary: Accept-Encoding, Origin
cache-control: max-age=7200
alt-svc: h3=":443";ma=600,h3-29=":443";ma=600,h3-27=":443";ma=600
fastly-restarts: 1
content-length: 1146

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 45ms
45ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

95624dc103c9feefb4e715967c05d0e140542a3629a3050bddcd5ee15224d75b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44166
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 3FAC 106 KB
28 KB 125ms
29ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 02 Feb 2023 12:38:07 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27843
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: MAIqFybVNmJZM6L2Kp26gTc9EZ4EWY+JeY8iDPlqOKrdcU343QehXDC2r/uiSYjzMeH9I7m1J1/E5egnkGNagw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1512268381
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
ads.revjet.com/ Frame 3FAC 19 KB
8 KB 221ms
42ms Script
application/javascript 135.148.151.99
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 135.148.151.99 Warrenton, United States, ASN16276 (OVH, FR),
Reverse DNS: ext.svh191.incmdb.net
Software: nginx /
Resource Hash: 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2022 13:56:52 GMT
server: nginx
etag: W/"6357eb24-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Thu, 02 Feb 2023 12:48:07 GMT

GET
H2 200 a-06d7.min.js Show response
b-code.liadm.com/ Frame 3FAC 34 KB
12 KB 213ms
37ms Script
application/javascript 2600:9000:23cb:b000:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23cb:b000:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: de9462e351a7c74cd76bf432a62faf0dbf0b068beeb7a16c83eac6728956b7f6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 07:28:42 GMT
content-encoding: gzip
via: 1.1 e2d34a357aab1d6cff5cce981d09ebba.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
age: 18565
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: J-1XSk2INLkWa_IB20rNz02euC8kfXmbaLYGWqIC5Udfp2Lfe0cBRQ==

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 45 KB
16 KB 66ms
66ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f2.1e100.net

Software

cafe /

Resource Hash

68f274e5330a1431b6e07a6a979209097633d713576cf9620bee34a6bd898ad7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16815
x-xss-protection: 0
server: cafe
etag: 17544913231395580258
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 48ms
48ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e5f60e10f83594d44f4ea20444939120294b75c32343b177adf63d868c4866b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66029
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1390358/ Frame 3FAC 58 KB
18 KB 157ms
67ms Script
application/javascript 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0716b77ae94ad392bc3fd022273e0ac439b06162405ca061e08d6da5b3eb1bba

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-amz-version-id: x42v2im8J2_9X5EWgGCynMXE8V56UbOi
content-encoding: gzip
via: 1.1 varnish
date: Thu, 02 Feb 2023 12:38:07 GMT
x-amz-request-id: WV5KJ6BY15612RAX
age: 1803
x-cache: HIT
x-amz-replication-status: PENDING
fastly-restarts: 1
x-amz-id-2: x2mhGoRSTXt7QVBlnVPQ4A2swER4bM1k5HQajZU+5OFBAKR3f9XSa1G8orkd8FlIqXPXOlH18Ww=
x-served-by: cache-ewr18152-EWR
content-length: 17940
last-modified: Thu, 02 Feb 2023 12:07:51 GMT
server: AmazonS3
x-timer: S1675341487.030570,VS0,VE38
etag: "fe540d556cb62799958b9963f0c3439d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 4
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 171

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 57ms
56ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a3e5913a378aeffa23539eeb13420730acd24f3a87616fbcc7738a58a8aabcf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65876
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 58ms
57ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

549961ac6e0161b3683c9202c2aaeb442b3a5176420192e1ca5e9168bea879c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66092
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 deviceAtlasLmb.min.js Show response
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame 3FAC 8 KB
3 KB 232ms
73ms Script
application/javascript 2606:4700:4400::ac40:98bb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:98bb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com
p3p: CP="NON DSP COR LAW CONi TELi OUR SAM IND CNT"
x-xss-protection: 1; mode=block
last-modified: Fri, 21 May 2021 02:42:28 GMT
server: cloudflare
etag: W/"20fc-5c2ce02c32fd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7932fb66782cd157-BUF
expires: Thu, 02 Feb 2023 16:38:07 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 128 KB
50 KB 70ms
69ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-966730890&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

10c8df2193e83ab880db098c38c308d15e11e158f388bed67036470681ba130c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50719
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 185ms
35ms Script
application/javascript 2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:05 GMT
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
content-encoding: gzip
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
x-amz-request-id: HF082R7GH9WSRH21
age: 3
x-amz-server-side-encryption: AES256
x-amz-id-2: UnI2DRcydsz1PX5jxkoZ+hoGErCSiiJaaTOgaK8fzV4t0Zr5P79RugyT8ZB4y6eAJh5cb5VO7bI=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 182ms
32ms Script
application/javascript 2a04:4e42:400::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Mon, 23 Jan 2023 21:56:14 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "03d5db9dfd00a5719bb4c9261e6fa1bb"
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7356

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 183 KB
66 KB 76ms
64ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

52ac5a065fa5bdcb9a814b24a1a5d7b0cabdea81b63d3d39a3d2efa8b0a6c6c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67545
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 116ms
109ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a56e0f5e0488b2cd0ea6d2011a47095ead582e6b36ccc4aaa258b9d56a873b9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66059
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 64ms
58ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

65e4b486c0a703dc173e3f7301d5a2c1f75dc05048459923d1c26bd23f6d1acb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66132
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame 3FAC 30 KB
13 KB 207ms
64ms Script
application/javascript 108.138.113.246
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/k4b8i1b1n8n4p2d4x0d4d8e6v9v2d0b6/d.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.113.246 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-113-246.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: fa42d02480f27fd0a8768e025d5033abf291c0df6391f25074faf80fa58c422c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: gzip
via: 1.1 cf498d1eb1eabcd3ba17659086fa3f86.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: JFK50-P3
x-cache: LambdaGeneratedResponse from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 13270
x-amz-cf-id: jlg0eWedMkCa8c5dQGZGqL_ujjgJejOl1SSxmYkJEsK3zFmOq1jJ1g==

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ Frame 3FAC 1 KB
2 KB 189ms
52ms Script
text/javascript 23.41.168.211
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.211 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-211.deploy.static.akamaitechnologies.com
Software: MT3 421 8749e8d master iad-pixel-x10 config:1.0.0 /
Resource Hash: bffa0d5c8a957ba5bbac1da2ad62606e806dc93db185d74c82547f382428c632

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:07 GMT
Server: MT3 421 8749e8d master iad-pixel-x10 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: text/javascript
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 1439
Expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 quickenloans_lander.js Show response
cdn1.decide.dev/tracking/ Frame 3FAC 737 B
936 B 234ms
133ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.decide.dev/tracking/quickenloans_lander.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: gzip
x-sp-metadata: HS256.CL/57p4GEocBCiQzNWEzMmNhNy1jMTgzLTQ2MzUtODEzMi1lODZjM2ZkZjA3NGYQwLizor+z/AIaBgiv3e6eBiIMOTYuOS4yNDYuMTk3KPiVAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDhlZjU2OTAzLTU1NGYtNDk3MC05NzUzLTFmMmQzY2E3YWVmNhiWAyIaCAISFGNkczIxMy50cjIuaHdjZG4ubmV0GAk=.7EcfkqSPHQuglAUI0k+AeTQrqsfITxO1BuI+xQroQIk=
last-modified: Mon, 29 Mar 2021 18:57:30 GMT
etag: "a28f0deba4086540f82dc5d6b5e47753"
x-hw: 1675341487.cds203.tr2.hn,1675341487.cds213.tr2.sc,1675341487.cds213.tr2.pr
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: https://decide.dev
content-length: 406

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 184 KB
66 KB 136ms
123ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ee1ddfd7f8b87a6c667460e1a09b96f1459c84c069179752ececc28bb43953d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67617
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 src Show response
c.pmsrv.co/v2/conversion/ Frame 3FAC 3 KB
4 KB 309ms
126ms Script
text/javascript 2600:9000:2514:a000:a:8e7d:9900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:a000:a:8e7d:9900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash: 3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
via: 1.1 da882a3066261fe68bc0e26348bba540.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 3435
x-amz-cf-pop: JFK50-P8
x-amzn-requestid: 15403a56-cc8a-4bf0-99be-199d3481f755
x-amzn-remapped-connection: close
x-powered-by: Express
x-cache: Miss from cloudfront
x-amz-apigw-id: ftg7bFAayK4Fa3g=
content-length: 3435
pragma: no-cache
etag: W/"d6b-sia6N7ids5ScRDuTaHkjdTsJcfc"
x-amzn-trace-id: Root=1-63dbaeaf-34ef6d0556dfb81f61d69f9b;Sampled=0
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
x-amzn-remapped-date: Thu, 02 Feb 2023 12:38:07 GMT
x-amz-cf-id: y07f_NnOX3dnDh2s9SAjcmTKHidcoMBtKhw3VGisxcPJS48H6-xj8w==
expires: -1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
64 KB 125ms
120ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

80cf8258e7c2d2cadd3b40ecf2a8d65c3708841ed580bb5ec882668e4e6a92fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65963
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:06 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 58 KB
18 KB 61ms
54ms Script
text/javascript 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6eceb1f0125e55dc7051adfec1166348ae06593aefa875aa9f835c5eabe5fd34

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: e0d9e757-15f9-4790-91cc-5519b8cfac3a
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 quickenloans_lander.js Show response
cdn1.lockerdomecdn.com/tracking/ Frame 3FAC 737 B
1 KB 215ms
132ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.lockerdomecdn.com/tracking/quickenloans_lander.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: gzip
x-amz-version-id: b6Hbc7yn6rhHZ8LkuNIH.XEX.WaaPfs1
x-amz-request-id: SM9CK4007EQB33T6
content-length: 406
x-amz-id-2: f7tGLOCwAAUEekLfx25QOyfTJ0fATZrnw/6denLNXGfMLKD3NxXEBZVLCUzxZ8Pmbdv5Q9t36iU=
x-amzn-internal-status: 304
x-sp-metadata: HS256.CL/57p4GEocBCiQ3YWY4OGI0Ni04ODY2LTQ4Y2EtOGQ3Yy01NDA3NmRhMmUwYzQQkMK1or+z/AIaBgiv3e6eBiIMOTYuOS4yNDYuMTk3KPyVAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDkwY2E4NTdlLWQ2NzAtNDgzNS1hMzhjLTZkNzU3N2M2ZTU1YRiWAyIaCAISFGNkczAwMy50cjIuaHdjZG4ubmV0GAk=.88p0CngW1ZsXlzNnYW42QORlr5/KKavo4EsGcf4JZTs=
last-modified: Mon, 29 Mar 2021 18:57:30 GMT
server: AmazonS3
etag: "a28f0deba4086540f82dc5d6b5e47753"
x-hw: 1675341487.cds221.tr2.hn,1675341487.cds003.tr2.sc,1675341487.cds003.tr2.pr
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: https://lockerdome.com

GET
H/1.1 200
OK iui3
s.amazon-adsystem.com/ Frame 3FAC 43 B
855 B 43ms
43ms Image
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3D6acaf65c-54d3-788f-2e4f-971d4f6b7886%26type%3D4%26m%3D1&ex-fch=416613&ex-src=https://home.rocketmortgage.com&ex-hargs=v%3D1.0%3Bc%3D584239139431578754%3Bp%3D6ACAF65C-54D3-788F-2E4F-971D4F6B7886

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Pragma: no-cache
Date: Thu, 02 Feb 2023 12:38:07 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: Q8TA6R3BP9ABVXN8F4QH
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 hub Show response
api.pushnami.com/scripts/v1/ Frame 01D5 2 KB
1 KB 50ms
34ms Document
text/html 18.164.124.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.124.56 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-124-56.jfk50.r.cloudfront.net

Software

Resource Hash

2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 2701
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Thu, 02 Feb 2023 11:53:06 GMT
vary: accept-encoding
via: 1.1 d0abe8e02f00bbb3378a9a4149801740.cloudfront.net (CloudFront)
x-amz-cf-id: 3Y3daW40Fi0WvQ-fX-_lHrhvB5LwELGl8QPn3TmyPXZVJ20_mghGBg==
x-amz-cf-pop: JFK50-P7
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
178 B 45ms
0ms XHR
text/plain 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type: application/json

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 7932fb65eb78d163-BUF

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 6186
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEIAOonN3uQXttaJrsNjsT1k&google_cver=1
https://pixel.everesttech.net/1x1

128 B
691 B

34ms
34ms

Image
image/png

34.202.55.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.202.55.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-55-214.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:08 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 02 Feb 2023 12:38:07 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 2 KB
1 KB 173ms
170ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1675341487089&cv=11&fst=1675341487089&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=EVlnCPzHxqoBEIrJ_MwD&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&value=1&currency_code=USD&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09b2266a6c3de46173fbcc83a8982bd7a980abf66e38243dc44552fe05d226e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1055
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 2 KB
1013 B 132ms
131ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1675341487140&cv=11&fst=1675341487140&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92775ef23405bbed209db7abcc79262128de3ebfb115e17a37a6f7bdec07ad47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 989
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 128 KB
50 KB 50ms
49ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

898214b89ce7f60eae60b7d81d3317da2af33902024d53219c3015701a9c051f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50715
x-xss-protection: 0
last-modified: Thu, 02 Feb 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Feb 2023 12:38:07 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 6186
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEI...
https://pixel.everesttech.net/1x1

128 B
691 B

36ms
36ms

Image
image/png

34.202.55.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.202.55.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-55-214.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:08 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 02 Feb 2023 12:38:08 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/ 2 KB
1010 B 145ms
144ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/?random=1675341487282&cv=11&fst=1675341487282&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-755089552

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a269899604bd9f213bcbd04f95cf92cbfd96fd5127ba901f10b8bfc435fb68d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 986
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 2 KB
1011 B 139ms
139ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1675341487366&cv=11&fst=1675341487366&bg=ffffff&guid=ON&async=1&gtm=2oa210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-813495030

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03e4b296c1cabd96bf55a93dec36900f4178186e981b56b333a75d286462dce4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 987
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 2 KB
1009 B 212ms
211ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1675341487457&cv=11&fst=1675341487457&bg=ffffff&guid=ON&async=1&gtm=2oa210&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-700319321

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53f667ee02b941b62875290f2490c3a66e4067d6abd02500635bafb672891518

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 2 KB
1009 B 141ms
141ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1675341487495&cv=11&fst=1675341487495&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-857412364

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4934f79a3ca32d311fc7de074bef9a236984478d5fa7823a4ea7b872908fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 2 KB
1014 B 231ms
227ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1675341487530&cv=11&fst=1675341487530&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

357cd7af4c2d588fc7a976cdd9735c94a0aa4ecc65df1d53b9bc426cd9350e4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 990
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 main.f6304d83.js Show response
s.pinimg.com/ct/lib/ Frame 3FAC 55 KB
19 KB 27ms
26ms Script
application/javascript 2a04:4e42:46::84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.f6304d83.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:46::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7baf4ac1cb2adf82ed9e88c9fa1b22f8ea22e14cf2aa24e9936c6578515e70ae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: gzip
x-cdn: fastly
etag: "fe9b810e040cd8cd5323a13c712440ca"
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
vary: Accept-Encoding, Origin
cache-control: max-age=1209600
alt-svc: h3=":443";ma=600,h3-29=":443";ma=600,h3-27=":443";ma=600
fastly-restarts: 1
content-length: 19456

GET
H2 200 1736491679707345 Show response
connect.facebook.net/signals/config/ Frame 3FAC 150 KB
41 KB 30ms
27ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1736491679707345?v=2.9.95&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6c058da3e29e1366f5a0e5a5e6408c4adc51fe4edd5335e0fc39a75df79a10ec

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 02 Feb 2023 12:38:07 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 42316
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: gUvt9b+kQ7zUciCiAzrtChwz0xewX9iDFKI4jzSkBV3K3kc3EWOuPoGqtWPQn4gNEbu2QG4ylEjieNL6UcqAFw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1512268381
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 6186
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
691 B

36ms
35ms

Image
image/png

34.202.55.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.202.55.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-55-214.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:08 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 02 Feb 2023 12:38:08 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 3FAC 0
399 B 106ms
99ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1675341487610&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE&tos=3&ssd=1&scd=0&mrir=u&vi=1675341487601
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 67
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341488.639941,VS0,VE67
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 3FAC 0
181 B 107ms
102ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1675341487613&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE&tos=5&ssd=1&scd=0&mrir=u&vi=1675341487601
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 66
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341488.640676,VS0,VE66
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 3FAC 0
185 B 105ms
101ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1675341487614&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE&tos=7&ssd=1&scd=0&mrir=u&vi=1675341487601
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 66
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341488.640629,VS0,VE66
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
157 B 123ms
43ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1675341487628&id=t2_1fj2owc9&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=a1619bab-40dd-4227-868f-ccf5e6140aed&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_65e23bc4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
via: 1.1 varnish
server: Varnish
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 pd2259 Show response
pix.revjet.com/track/ Frame 3FAC 46 B
222 B 133ms
27ms Script
text/javascript 216.223.26.54
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd2259?__noscript=false&__cbf=revjet.callbacks.cb1675341487631&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&referrer=https%3A%2F%2Feducatescreen.com%2F&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 216.223.26.54 Secaucus, United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS
Software: /
Resource Hash: 54e2591a73db0d4a45be67090da625e78b281139a16039fcab54c726e1ad3577

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 pd3876 Show response
pix.revjet.com/track/ Frame 3FAC 46 B
223 B 129ms
26ms Script
text/javascript 216.223.26.54
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd3876?__noscript=false&__cbf=revjet.callbacks.cb1675341487634&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&referrer=https%3A%2F%2Feducatescreen.com%2F&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 216.223.26.54 Secaucus, United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS
Software: /
Resource Hash: 0e034ed462c5f8d7e9fbe4a568ef419183bc28b35971714dc19a7b0b49fa4458

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:07 GMT
content-length: 46
content-type: text/javascript

GET
H/1.1 200
OK iframe Show response
pixel.mathtag.com/sync/ Frame 77E7 677 B
1 KB 41ms
41ms Document
text/html 23.41.168.211
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=173f63db-aeaf-4100-b41a-3270295efc91&no_iframe=1&mt_adid=245296&source=mathtag
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.211 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-211.deploy.static.akamaitechnologies.com
Software: MT3 421 8749e8d master iad-pixel-x14 config:1.0.0 /
Resource Hash: 3ef64e4a0001cd55211fff6bd306290f29c7482a6006d070ee21e52484b7ef22

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept-language: en-US,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 677
Content-Type: text/html
Date: Thu, 02 Feb 2023 12:38:07 GMT
Expires: Thu, 02 Feb 2023 12:38:06 GMT
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 421 8749e8d master iad-pixel-x14 config:1.0.0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/ 2 KB
1011 B 154ms
150ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/?random=1675341487731&cv=11&fst=1675341487731&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec4f648af853b25836f83a96b4cc87c881d0d12afaf15d7e5ba8954ee6e89a9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 987
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10182570.json Show response
s.yimg.com/wi/config/ 46 B
678 B 91ms
27ms XHR
application/json 2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10182570.json

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Wed, 01 Feb 2023 20:12:47 GMT
x-amz-version-id: LPMEJDD79ONPE78nruFm6Hgf4VOe0yiw
x-content-type-options: nosniff
strict-transport-security: max-age=15552000
x-amz-request-id: WW5NYWS0XMKJCTT8
age: 59121
x-amz-server-side-encryption: AES256
content-length: 46
x-amz-id-2: nenDJEbpjN/4FbNTa5sSZA18bhC2x05zuxiWgXXcsiipEBhrpWik7SqqiXKFhr3o1orNuQKtgYg=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sun, 28 May 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Fri, 22 Apr 2022 01:01:34 GMT
server: ATS
etag: "f31aca15ae5b24f87583e3de167c9828"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/ 2 KB
1010 B 80ms
79ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/?random=1675341487804&cv=11&fst=1675341487804&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fd6c5174f6ec3b3c5a8451e2c2bee51bdf58d60029e11e9c0b33ede75b62078

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 986
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 2 KB
1010 B 150ms
148ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1675341487869&cv=11&fst=1675341487869&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-865435318

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b471623c24887166c45b578a6967c17312758eb6b20a1da1d8d51038db34a9f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 986
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 6186
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

34ms
33ms

Image
image/png

34.202.55.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.202.55.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-55-214.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:08 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 02 Feb 2023 12:38:08 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 3FAC 0
480 B 41ms
41ms Image
image/gif 23.41.168.211
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.211 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-211.deploy.static.akamaitechnologies.com
Software: MT3 421 8749e8d master iad-pixel-x17 config:1.0.0 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:08 GMT
Server: MT3 421 8749e8d master iad-pixel-x17 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Thu, 02 Feb 2023 12:38:07 GMT

GET
H2

200

j Show response
rp4.liadm.com/ Frame 3FAC
Redirect Chain

https://rp.liadm.com/j?dtstmp=1675341488331&aid=a-06d7&se=e30&duid=ddc3c751f117--01gr924qj49k8zc883c8r0s53e&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%...
https://rp4.liadm.com/j?dtstmp=1675341488331&aid=a-06d7&se=e30&duid=ddc3c751f117--01gr924qj49k8zc883c8r0s53e&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488...

13 B
552 B

140ms
41ms

XHR
application/json

54.204.59.49
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1675341488331&aid=a-06d7&se=e30&duid=ddc3c751f117--01gr924qj49k8zc883c8r0s53e&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ext_s_ecid=MCMID%7C08747214497915888910580760187436015271&wpn=lc-bundle&refr=https%3A%2F%2Feducatescreen.com%2F&i6=MjYwMjpmZmM4OjI6MTA0OjoxMA%3D%3D&n3pc=true

Requested by

Protocol

Server

54.204.59.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-59-49.compute-1.amazonaws.com

Software

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:08 GMT
x-pixel-event-id: bd454e89-951e-461b-8b6a-8c550e083ed1
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: DENY
vary: Origin
content-type: application/json
request-time: 0
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: 5e605a7c6085f21f
content-length: 13
x-xss-protection: 1; mode=block

Redirect headers

date: Thu, 02 Feb 2023 12:38:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
vary: Origin
location: https://rp4.liadm.com/j?dtstmp=1675341488331&aid=a-06d7&se=e30&duid=ddc3c751f117--01gr924qj49k8zc883c8r0s53e&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ext_s_ecid=MCMID%7C08747214497915888910580760187436015271&wpn=lc-bundle&refr=https%3A%2F%2Feducatescreen.com%2F&i6=MjYwMjpmZmM4OjI6MTA0OjoxMA%3D%3D&n3pc=true
access-control-allow-origin: https://refinance.quickenloans.com
request-time: 0
access-control-allow-credentials: true
trace-id: 9093e7b4a80e9b26
content-length: 0
x-xss-protection: 1; mode=block

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 47ms
47ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1675341487089&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&label=EVlnCPzHxqoBEIrJ_MwD&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&value=1&currency_code=USD&data=event%3Dconversion&fmt=3&is_vtc=1&random=3034341016&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 47ms
45ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1675341487140&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1382726180&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/ 2 KB
1009 B 173ms
172ms Script
text/javascript 2607:f8b0:4006:823::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/?random=1675341488361&cv=11&fst=1675341488361&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&auid=1476893159.1675341486&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2002 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

792f8a763bd51ffcc6094ddc7bcc1fa7983a652e012e6965a5620e53fee32a76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/813495030/ 42 B
64 B 64ms
63ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/813495030/?random=1675341487366&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4274476433&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 6186
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

128 B
691 B

59ms
38ms

Image
image/png

34.202.55.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.202.55.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-55-214.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:08 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 02 Feb 2023 12:38:08 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
633 B 120ms
33ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2002%20Feb%202023%2012%3A38%3A08%20GMT&n=0&b=QuickenLoans&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&e=https%3A%2F%2Feducatescreen.com%2F&enc=UTF-8&yv=1.13.0&tagmgr=gtm%2Cadobe

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Thu, 02 Feb 2023 12:38:08 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/755089552/ 42 B
64 B 57ms
54ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/755089552/?random=1675341487282&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2463352838&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/857412364/ 42 B
64 B 55ms
53ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/857412364/?random=1675341487495&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2804955988&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/700319321/ 42 B
64 B 56ms
55ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/700319321/?random=1675341487457&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa210&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1235546846&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ Frame 3FAC 540 B
865 B 372ms
36ms XHR
application/json 23.197.32.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2620075802369&pd=%7B%22em%22%3A%22e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%22%7D&cb=1675341488565&dep=2%2CPAGE_LOAD

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.f6304d83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.197.32.188 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-197-32-188.deploy.static.akamaitechnologies.com

Software

Resource Hash

63b2f0b99fea462c96bdb35799e62b4cb534a14b09ee95c6632a7828959e63eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:08 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.0c112817.1675341488.1c873ec8
x-envoy-upstream-service-time: 2
content-length: 377
x-pinterest-rid: 1417893592805663
pin-unauth: dWlkPVlUbGpZbUZqTW1RdFlqRXhOaTAwWldRMkxUbGpOV0l0TW1JeE0yRTJaVEptTW1NeA
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 77E7 0
480 B 44ms
43ms Image
image/gif 23.41.168.211
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=173f63db-aeaf-4100-b41a-3270295efc91&no_iframe=1&mt_adid=245296&source=mathtag
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.211 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-211.deploy.static.akamaitechnologies.com
Software: MT3 421 8749e8d master iad-pixel-x10 config:1.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.mathtag.com/sync/iframe?mt_uuid=173f63db-aeaf-4100-b41a-3270295efc91&no_iframe=1&mt_adid=245296&source=mathtag
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:08 GMT
Server: MT3 421 8749e8d master iad-pixel-x10 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Thu, 02 Feb 2023 12:38:07 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 6186
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WTl1dXJnQUFCSmVVUGxNNQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://pixel.everesttech.net/1x1

128 B
691 B

38ms
34ms

Image
image/png

34.202.55.214
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 34.202.55.214 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-55-214.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Date: Thu, 02 Feb 2023 12:38:08 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 02 Feb 2023 12:38:08 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866179376/ 42 B
64 B 60ms
58ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866179376/?random=1675341487530&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2233520818&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 psp Show response
psp.pushnami.com/api/ 2 B
230 B 86ms
65ms Fetch
text/html 54.209.198.197
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.198.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-198-197.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://refinance.quickenloans.com
date: Thu, 02 Feb 2023 12:38:08 GMT
cache-control: no-cache
access-control-allow-credentials: true
content-encoding: gzip
vary: accept-encoding
content-type: text/html; charset=utf-8

OPTIONS
H2 200 psp
psp.pushnami.com/api/ Frame 0
0 130ms
39ms Preflight
application/json 54.209.198.197
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.198.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-198-197.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

access-control-allow-credentials: true
access-control-allow-headers: key
access-control-allow-methods: POST
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: content-type, content-length, etag
access-control-max-age: 600
cache-control: no-cache
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 02 Feb 2023 12:38:08 GMT
vary: accept-encoding

GET
H3 200 click Show response
www.lmbahsj2.com/sdk/ 85 B
105 B 107ms
106ms Fetch
application/json 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/sdk/click?effp=38bb894b98b13b389fe12f9c55dad54f&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851&oid=9&affid=771&__cc=&async=json
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1fcafbfc097f63c7daaa02244e80c15ae7a209bc978ef4d77524bdb7dcf25e5b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:08 GMT
via: 1.1 google
server: nginx
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
x-eflow-request-id: d2c030a2-09d4-42b3-a2a4-b6cda6bf0b64
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

GET
H2 200 /
ct.pinterest.com/v3/ Frame 3FAC 35 B
333 B 280ms
39ms Image
image/gif 23.197.32.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?tid=2620075802369&pd=%7B%22em%22%3A%22e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851%22%2C%22ref%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851%22%2C%22if%22%3Atrue%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%22f6304d83%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1675341488660

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.197.32.188 Edison, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-197-32-188.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.0c112817.1675341488.1c873ec9
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 3
content-length: 35
x-pinterest-rid: 1529618227897171
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/865435318/ 42 B
64 B 46ms
46ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865435318/?random=1675341487869&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3490357207&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
trc.pushnami.com/api/push/ 2 B
168 B 342ms
336ms Fetch
text/html 52.201.63.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.63.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-63-27.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Thu, 02 Feb 2023 12:38:09 GMT
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
content-length: 2
content-type: text/html; charset=utf-8

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 174ms
52ms Preflight 52.201.63.27
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.63.27 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-63-27.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT

GET
H3 200 inferredevents.js Show response
connect.facebook.net/signals/plugins/ Frame 3FAC 72 KB
22 KB 56ms
55ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/inferredevents.js?v=2.9.95

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5849e07d0d6cbb144829b98da75fda4a8eb3fc2b5749d48cc94bb170db54859a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 02 Feb 2023 12:38:08 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 21972
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 7vOrulogxh6rHPO0KQvn9+RJN+VON7mK/211cY2bp3RSxYbT9PrXUGd9A+7N/8muh1uAXKc67nflW8qxW873Dw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10910338944/ 42 B
64 B 64ms
63ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10910338944/?random=1675341487731&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2362494923&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866176763/ 42 B
64 B 59ms
58ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866176763/?random=1675341487804&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=922838971&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 6186
Redirect Chain

https://cm.everesttech.net/cm/yh
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y9uurgAABJeUPlM5&sigv=1&esig=1~ed2d7eb4efc4882ecb8e91b44297b1b180d2963b

0
47 B

69ms
31ms

Image
text/plain

2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y9uurgAABJeUPlM5&sigv=1&esig=1~ed2d7eb4efc4882ecb8e91b44297b1b180d2963b

Protocol

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 12:38:08 GMT
strict-transport-security: max-age=15552000
cache-control: no-store
x-content-type-options: nosniff
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y9uurgAABJeUPlM5&sigv=1&esig=1~ed2d7eb4efc4882ecb8e91b44297b1b180d2963b
Date: Thu, 02 Feb 2023 12:38:08 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 /
www.google.com/pagead/1p-user-list/848879802/ 42 B
64 B 74ms
51ms Image
image/gif 2607:f8b0:4006:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848879802/?random=1675341488361&cv=11&fst=1675339200000&bg=ffffff&guid=ON&async=1&gtm=2oa1u0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&ref=https%3A%2F%2Feducatescreen.com%2F&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=574809146&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2004 Nutley, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ Frame 3FAC 0
185 B 103ms
23ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&rl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690488%26pkey3%3Dc4b8011d37304ad097f6d21387df8851%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dc4b8011d37304ad097f6d21387df8851&if=true&ts=1675341488809&sw=1600&sh=1200&v=2.9.95&r=stable&ec=0&o=28&fbp=fb.1.1675341488783.1515327342&it=1675341487575&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 02 Feb 2023 12:38:08 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6186
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTl1dXJnQUFCSmVVUGxNNQ==

170 B
188 B

57ms
44ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTl1dXJnQUFCSmVVUGxNNQ==

Protocol

Server

142.250.72.98 Glen Cove, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-ewr18126-EWR
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1675341489.961195,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WTl1dXJnQUFCSmVVUGxNNQ==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 6186
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y9uurgAABJeUPlM5&expires=90

42 B
752 B

193ms
39ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y9uurgAABJeUPlM5&expires=90
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 78008fe701b681dce86a72fc23cacc40
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-ewr18126-EWR
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:08 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1675341489.967524,VS0,VE0
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y9uurgAABJeUPlM5&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6186
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y9uurgAABJeUPlM5
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y9uurgAABJeUPlM5&C=1

43 B
764 B

28ms
27ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y9uurgAABJeUPlM5&C=1
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Pragma: no-cache
Date: Thu, 02 Feb 2023 12:38:09 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 02 Feb 2023 12:38:09 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=88&external_user_id=Y9uurgAABJeUPlM5&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 6186
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=Y9uurgAABJeUPlM5
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY9uurgAABJeUPlM5

43 B
1 KB

30ms
29ms

Image
image/gif

68.67.161.182
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY9uurgAABJeUPlM5

Protocol

HTTP/1.1

Server

68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

Pragma: no-cache
Date: Thu, 02 Feb 2023 12:38:09 GMT
AN-X-Request-Uuid: e8cdd9ea-7438-4507-9f01-260e63431e2e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 96.9.246.197; 96.9.246.197; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 02 Feb 2023 12:38:09 GMT
AN-X-Request-Uuid: 90a07ade-5a4c-4fff-9729-30730a0e5dd8
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY9uurgAABJeUPlM5
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 96.9.246.197; 96.9.246.197; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 6186
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y9uurgAABJeUPlM5
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=Y9uurgAABJeUPlM5

43 B
180 B

64ms
63ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=Y9uurgAABJeUPlM5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

pragma: no-cache
date: Thu, 02 Feb 2023 12:38:09 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=Y9uurgAABJeUPlM5
date: Thu, 02 Feb 2023 12:38:09 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 6186
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y9uurgAABJeUPlM5

1 B
450 B

125ms
34ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y9uurgAABJeUPlM5
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

content-type: text/html; charset=utf-8
date: Thu, 02 Feb 2023 12:38:08 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by: cache-ewr18126-EWR
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:09 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1675341489.387373,VS0,VE0
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y9uurgAABJeUPlM5
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

partner
sync.search.spotxchange.com/ Frame 6186
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y9uurgAABJeUPlM5&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y9uurgAABJeUPlM5&img=1&__user_check__=1&sync_id=7340dca4-a2f6-11ed-9e58-18ede64a0503

43 B
476 B

38ms
38ms

Image
image/gif

192.35.249.137
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y9uurgAABJeUPlM5&img=1&__user_check__=1&sync_id=7340dca4-a2f6-11ed-9e58-18ede64a0503
Protocol: H2
Server: 192.35.249.137 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-spotx-halt-type: Audience DSP sync endpoint was unable to cookie the audience.
date: Thu, 02 Feb 2023 12:38:09 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 378
content-length: 43

Redirect headers

date: Thu, 02 Feb 2023 12:38:09 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
location: /partner?adv_id=6409&uid=Y9uurgAABJeUPlM5&img=1&__user_check__=1&sync_id=7340dca4-a2f6-11ed-9e58-18ede64a0503
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: false
x-fe: 534
content-length: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 3FAC 0
204 B 105ms
105ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=1890&scd=0&ssd=1&est=1675341487606&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1675341489498&mrir=u&vi=1675341487601&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 66
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:09 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341490.515876,VS0,VE66
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 3FAC 0
67 B 159ms
157ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=1891&scd=0&ssd=1&est=1675341487606&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1675341489499&mrir=u&vi=1675341487601&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 131
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:09 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341490.522112,VS0,VE131
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 3FAC 0
61 B 97ms
96ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=1897&scd=0&ssd=1&est=1675341487606&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1675341489505&mrir=u&vi=1675341487601&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 69
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:09 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341490.526541,VS0,VE69
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2

200

b.php
www.facebook.com/fr/ Frame 6186
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y9uurgAABJeUPlM5&t=2592000&o=0

43 B
668 B

71ms
70ms

Image
image/gif

2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y9uurgAABJeUPlM5&t=2592000&o=0

Protocol

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

date: Thu, 02 Feb 2023 04:38:09 PST
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
pragma: public
x-fb-debug: 13utYfK0cKc3+Bxq9/ZE/kazBzc6JJ9cWWH5dh1c/w3HrYZJM0vi5jPdll4TG2WAIekwNdlubVsqJY3nxf/SxQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: image/gif
cache-control: public, max-age=0
priority: u=3,i
expires: Thu, 02 Feb 2023 04:38:09 PST

Redirect headers

x-served-by: cache-ewr18126-EWR
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:09 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1675341490.595252,VS0,VE0
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y9uurgAABJeUPlM5&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 3FAC 0
237 B 101ms
92ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=4902&scd=0&ssd=1&est=1675341487606&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1675341492510&mrir=u&vi=1675341487601&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 66
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:12 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341493.555133,VS0,VE66
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 3FAC 0
57 B 94ms
93ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=4903&scd=0&ssd=1&est=1675341487606&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1675341492511&mrir=u&vi=1675341487601&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 66
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:12 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341493.555302,VS0,VE66
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 3FAC 0
58 B 158ms
157ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=4904&scd=0&ssd=1&est=1675341487606&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1675341492511&mrir=u&vi=1675341487601&ref=https%3A%2F%2Feducatescreen.com%2F&cv=20230202-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Response headers

x-vcl-time-ms: 131
pragma: no-cache
date: Thu, 02 Feb 2023 12:38:12 GMT
via: 1.1 varnish
x-served-by: cache-ewr18152-EWR
server: nginx
x-timer: S1675341493.555275,VS0,VE131
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

64 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 09:23:47	Name: X-AB Value: 0d6e407936704bd380072f5891d28b0e
educatescreen.com/	1970-01-20 10:05:33	Name: uid21719 Value: 1321261393-20230202073804-ff2654c6c6d1144b00ba243fff83b3a9-
www.lmbahsj2.com/	1970-01-20 09:23:47	Name: uniqueClick_FGXLG Value: fa92008d-7693-43da-88e5-f743bf6921af:1675341484
www.lmbahsj2.com/	1970-01-20 11:31:57	Name: transaction_id Value: c4b8011d37304ad097f6d21387df8851
refinance.quickenloans.com/	1970-01-20 18:07:57	Name: visitorId Value: 6114a59f-edef-4fe4-91cf-b82aa55263eb
refinance.quickenloans.com/	1970-01-20 09:32:26	Name: contentTarget Value: %7B%22sourceId%22%3A%22lmb-54867-113582-771%22%7D
.lowermybills.com/	1970-01-20 09:22:23	Name: __cf_bm Value: HCn1flkgOLmlyoZ.AMZ7XSSd3u.N3RsZJ7T0Uspshho-1675341485-0-AdA6ZRjLhmDLfxUoAQ14dY3cln3OCE7ikjDBd0EnaEdeSvK+MOSNSClKSlojh3N1pL9JM7vcM0TUmRh881hhUPA=
.quickenloans.com/	1969-12-31 23:59:59	Name: at_check Value: true
refinance.quickenloans.com/	1970-01-20 09:23:47	Name: DAPROPS Value: "sjs.webGlRenderer:Intel Iris OpenGL Engine\|bjs.accessDom:1\|bcookieSupport:1\|bcss.animations:1\|bcss.columns:1\|bcss.transforms:1\|bcss.transitions:1\|sdevicePixelRatio:1\|idisplayColorDepth:24\|bflashCapable:0\|bhtml.audio:1\|bhtml.canvas:1\|bhtml.inlinesvg:1\|bhtml.svg:1\|bhtml.video:1\|bjs.applicationCache:0\|bjs.deviceMotion:1\|bjs.deviceOrientation:0\|bjs.geoLocation:1\|bjs.indexedDB:1\|bjs.json:1\|bjs.localStorage:1\|bjs.modifyCss:1\|bjs.modifyDom:1\|bjs.querySelector:1\|bjs.sessionStorage:1\|bjs.supportBasicJavaScript:1\|bjs.supportConsoleLog:1\|bjs.supportEventListener:1\|bjs.supportEvents:1\|bjs.touchEvents:0\|bjs.webGl:1\|bjs.webSockets:1\|bjs.webSqlDatabase:0\|bjs.webWorkers:1\|bjs.xhr:1\|buserMedia:1\|bjs.battery:0"
refinance.quickenloans.com/	1970-01-20 09:22:22	Name: _dd_s Value: rum=0&expire=1675342385782
.quickenloans.com/	1970-01-20 18:58:21	Name: _ga_WQ7TGZQSWQ Value: GS1.1.1675341485.1.0.1675341485.0.0.0
.quickenloans.com/	1970-01-20 18:58:21	Name: _ga Value: GA1.1.1389651363.1675341486
.quickenloans.com/	1970-01-20 11:31:57	Name: _gcl_au Value: 1.1.1476893159.1675341486
.demdex.net/	1970-01-20 13:41:33	Name: demdex Value: 08959822291591697470595548003812924015
.amazon-adsystem.com/	1970-01-20 15:09:23	Name: ad-id Value: A44BHyHhEk_woTYUxKQnChY
.amazon-adsystem.com/	1970-01-20 18:58:21	Name: ad-privacy Value: 0
.refinance.quickenloans.com/	1969-12-31 23:59:59	Name: Value: GA1.3.1389651363.1675341486
.refinance.quickenloans.com/	1970-01-20 09:23:47	Name: _gid Value: GA1.3.750161072.1675341486
.refinance.quickenloans.com/	1970-01-20 09:22:21	Name: _gat_gtag_UA_3849768_74 Value: 1
refinance.quickenloans.com/	1970-01-20 09:32:26	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiZGVlYjZiNzctZmI2YS01ZWQ4LTkyMzQtZWRmMjU5YjZiNTE4IiwidmlzaXRvcklkIjoiNjExNGE1OWYtZWRlZi00ZmU0LTkxY2YtYjgyYWE1NTI2M2ViIiwic2Vzc2lvbklkIjoiMzBkNzIwZGQtMTY2MS00MWMxLWE1NDUtMzliM2U2ZGU1ZGEyIiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiI3NzEiLCJwa2V5MiI6IjY5MDQ4OCIsInBrZXkzIjoiYzRiODAxMWQzNzMwNGFkMDk3ZjZkMjEzODdkZjg4NTEiLCJzb3VyY2VJZCI6ImxtYi01NDg2Ny0xMTM1ODItNzcxIiwic2lkIjoiOSIsImNtcGlkIjoiOSIsImNydGlkIjoiIiwib2lkIjoiOSIsImFmZmlkIjoiNzcxIiwiX2VmX3RyYW5zYWN0aW9uX2lkIjoiYzRiODAxMWQzNzMwNGFkMDk3ZjZkMjEzODdkZjg4NTEiLCJhZ2UiOm51bGwsImRldmljZSI6bnVsbCwiZm9yY2VOYW1lcyI6bnVsbCwiZm9yY2VJcCI6bnVsbCwiZm9yY2VUZXN0SWRzIjpudWxsLCJpbnF1aXJ5SWQiOm51bGwsImlucXVpcnlTaWduYXR1cmUiOm51bGwsImlzVGVzdCI6bnVsbCwibGV2ZWxPZkVkdWNhdGlvbiI6bnVsbCwibW9pZCI6bnVsbCwicHJvcGVydHlTdGF0ZUNvZGUiOm51bGwsInJlc29sdXRpb24iOiIiLCJ0dFRyYWNlSWQiOm51bGwsInByb3ZpZGVySWQiOm51bGwsInFscyI6bnVsbCwic3RpZCI6bnVsbCwib3ZrZXkiOm51bGwsIm92cmF3IjpudWxsLCJvdm10YyI6bnVsbCwibW9ydGdhZ2VCYWxhbmNlUmFuZ2UiOm51bGwsImRhdGVOb3ciOjE2NzUzNDE0ODU3NTIsInJhbmRvbU51bWJlciI6NTAyODAsIm1hcmtldGluZ09mZmVySWQiOm51bGwsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDIzLTAyLTAyVDEyOjM4OjA1Ljg1NFoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL3JlZmluYW5jZS5xdWlja2VubG9hbnMuY29tIiwicHJlc2VudGF0aW9uTmFtZSI6IjI4MzI0OTNfTVNRTF9MUkVfTFBfQ09OVFJPTF8wOS0xNC0yMiIsImRlc3RpbmF0aW9uVXJsIjoiaHR0cHM6Ly9yZWZpbmFuY2UucXVpY2tlbmxvYW5zLmNvbS8_cGtleTE9NzcxJnBrZXkyPTY5MDQ4OCZwa2V5Mz1jNGI4MDExZDM3MzA0YWQwOTdmNmQyMTM4N2RmODg1MSZzb3VyY2VpZD1sbWItNTQ4NjctMTEzNTgyLTc3MSZzaWQ9OSZjbXBpZD05JmNydGlkPSZvaWQ9OSZhZmZpZD03NzEmX2VmX3RyYW5zYWN0aW9uX2lkPWM0YjgwMTFkMzczMDRhZDA5N2Y2ZDIxMzg3ZGY4ODUxIiwidmVydGljYWxOYW1lIjoiTVNRTF9MUkVfTEFORElORyIsInJlZmVycmluZ1VyaSI6Imh0dHBzOi8vZWR1Y2F0ZXNjcmVlbi5jb20vIiwiZmxvd0lkIjoiTVNRTF9MUkVfTEFORElOR19WRVJUSUNBTF9GTE9XXzEiLCJ0ZXN0SWQiOjIxMTAxODQsImRhVmFsIjoic2pzLndlYkdsUmVuZGVyZXI6SW50ZWwgSXJpcyBPcGVuR0wgRW5naW5lfGJqcy5hY2Nlc3NEb206MXxiY29va2llU3VwcG9ydDoxfGJjc3MuYW5pbWF0aW9uczoxfGJjc3MuY29sdW1uczoxfGJjc3MudHJhbnNmb3JtczoxfGJjc3MudHJhbnNpdGlvbnM6MXxzZGV2aWNlUGl4ZWxSYXRpbzoxfGlkaXNwbGF5Q29sb3JEZXB0aDoyNHxiZmxhc2hDYXBhYmxlOjB8Ymh0bWwuYXVkaW86MXxiaHRtbC5jYW52YXM6MXxiaHRtbC5pbmxpbmVzdmc6MXxiaHRtbC5zdmc6MXxiaHRtbC52aWRlbzoxfGJqcy5hcHBsaWNhdGlvbkNhY2hlOjB8YmpzLmRldmljZU1vdGlvbjoxfGJqcy5kZXZpY2VPcmllbnRhdGlvbjowfGJqcy5nZW9Mb2NhdGlvbjoxfGJqcy5pbmRleGVkREI6MXxianMuanNvbjoxfGJqcy5sb2NhbFN0b3JhZ2U6MXxianMubW9kaWZ5Q3NzOjF8YmpzLm1vZGlmeURvbToxfGJqcy5xdWVyeVNlbGVjdG9yOjF8YmpzLnNlc3Npb25TdG9yYWdlOjF8YmpzLnN1cHBvcnRCYXNpY0phdmFTY3JpcHQ6MXxianMuc3VwcG9ydENvbnNvbGVMb2c6MXxianMuc3VwcG9ydEV2ZW50TGlzdGVuZXI6MXxianMuc3VwcG9ydEV2ZW50czoxfGJqcy50b3VjaEV2ZW50czowfGJqcy53ZWJHbDoxfGJqcy53ZWJTb2NrZXRzOjF8YmpzLndlYlNxbERhdGFiYXNlOjB8YmpzLndlYldvcmtlcnM6MXxianMueGhyOjF8YnVzZXJNZWRpYToxfGJqcy5iYXR0ZXJ5OjAiLCJkYVZlciI6IjEuNiIsImNsaWVudElwQWRkcmVzcyI6IjI2MDI6ZmZjODoyOjEwNDo6MTAiLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvOTIuMC40NTE1LjEzMSBTYWZhcmkvNTM3LjM2IEVkZy85Mi4wLjkwMi42NyIsImJvdCI6ZmFsc2UsImlhdCI6MTY3NTM0MTQ4NX0.k6A5nWZCDykOLF5e_HVDaAZmxKH9Tvyu-cXypNuE3FPkc7elMZM1TCBPo6ApkbiXLYM2UE0FVTKPSTVXl28epkfGPbOwY-BYXP-vpJiViYOIegTKVe251Za65yhhMixwUdkqrgyD2P6-rPSKKpU7t83wTiZ8PyWZpDfyiIImqk0
.everesttech.net/	1970-01-20 18:07:57	Name: everest_g_v2 Value: g_surferid~Y9uurgAABJeUPlM5
.everesttech.net/	1969-12-31 23:59:59	Name: everest_session_v2 Value: Y9uurgAABJeUPlM5
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
.everesttech.net/	1970-01-20 10:06:59	Name: ev_sync_dd Value: 20230202
.doubleclick.net/	1970-01-20 18:58:21	Name: IDE Value: AHWqTUngon1pl7lR3GjkZuA6996sO2QJlkl_xSoTrY2uIuzpBqf_775zIm-NydAK
.quickenloans.com/	1970-01-20 18:58:21	Name: mbox Value: session#13abce2940614b67a7965cf58efe4e13#1675343347\|PC#13abce2940614b67a7965cf58efe4e13.34_0#1738586287
.quickenloans.com/	1970-01-20 18:58:21	Name: s_ecid Value: MCMID%7C08747214497915888910580760187436015271
.quickenloans.com/	1970-01-20 18:58:21	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19391%7CMCMID%7C08747214497915888910580760187436015271%7CMCAAMLH-1675946286%7C9%7CMCAAMB-1675946286%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1675348686s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0
.quickenloans.com/	1970-01-20 18:58:21	Name: s_v12 Value: 1675341486718
.quickenloans.com/	1970-01-20 09:22:23	Name: s_v12_s Value: First%20Visit
.quickenloans.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.agkn.com/	1970-01-20 18:07:57	Name: ab Value: 0001%3AtBfv%2BQeGpvqmzF9dQRcJidjF60iCureY
.dpm.demdex.net/	1970-01-20 13:41:33	Name: dpm Value: 08959822291591697470595548003812924015
.mathtag.com/	1970-01-20 18:48:16	Name: uuid Value: 173f63db-aeaf-4100-b41a-3270295efc91
.mortgage.quickenloans.com/	1970-01-20 09:22:23	Name: __cf_bm Value: W350yZ9qF.wtV5OPBlXID7Cw.E0cjehkKsWMgWbb1ZE-1675341487-0-AbEyIF0iTj+jpTUcOMI6s8M3D8RePDBSah/JqzDkKFRzfkG8lKPilF1j3rjntnvxil6qaZSbeJuIdqBK1fsOVrQ=
.pmsrv.co/	1970-01-20 11:33:45	Name: _pmedia_opt-out Value: 1
.everesttech.net/	1970-01-20 10:06:59	Name: ev_sync_ax Value: 20230202
.quickenloans.com/	1970-01-20 11:31:57	Name: _rdt_uuid Value: 1675341487627.a1619bab-40dd-4227-868f-ccf5e6140aed
.quickenloans.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .quickenloans.com
.quickenloans.com/	1970-01-20 18:58:21	Name: _lc2_fpi Value: ddc3c751f117--01gr924qj49k8zc883c8r0s53e
.taboola.com/	1970-01-20 18:07:57	Name: t_gid Value: 2783871e-3e46-4d5a-a8ef-2bb00bada79e-tuctad5342f
.revjet.com/	1970-01-20 18:58:21	Name: trx Value: 4781749706992803466
.quickenloans.com/	1969-12-31 23:59:59	Name: _schn Value: _2aitlpi
.quickenloans.com/	1970-01-20 18:52:08	Name: _scid Value: 941527fd-9081-412b-8ebd-57aeb7a1ebd0
.mathtag.com/	1970-01-20 10:05:33	Name: mt_misc Value: mt_bt:1
.liadm.com/	1970-01-20 18:58:21	Name: lidid Value: 15e938f1-4a61-4028-b6fa-70fe311b88d9
.yahoo.com/	1970-01-20 18:08:19	Name: A3 Value: d=AQABBLCu22MCEDgtTQOh7kyYLkYDOKR1ujUFEgEBAQEA3WPlYwAAAAAA_eMAAA&S=AQAAAjnIYFGUJhFcPgRvTwP1N4o
.refinance.quickenloans.com/	1970-01-20 09:22:23	Name: __cf_bm Value: Q50MwnUo9xzZlR2AngHHKzK0M24thz8DPIJfXs2ByDw-1675341488-0-AUd/wpRFjI9DXNWhasRaeodgIRB0y3phmfeS0frMIq0C3nQEgXvaQwSo2vqZSulkg8tdzDwYndFE+9Z6DU2e3Oc=
www.lmbahsj2.com/	1970-01-20 09:23:47	Name: uniqueClick Value: 6d8b26ea-ac79-4bc6-85d7-7bda37c7ffef:1675341488
.quickenloans.com/	1970-01-20 10:05:33	Name: ef_tid_c_o_9 Value: c4b8011d37304ad097f6d21387df8851
.quickenloans.com/	1970-01-20 10:05:33	Name: ef_tid_c_a_1 Value: c4b8011d37304ad097f6d21387df8851
.everesttech.net/	1970-01-20 10:06:59	Name: ev_sync_yh Value: 20230202
.quickenloans.com/	1970-01-20 11:31:57	Name: _fbp Value: fb.1.1675341488783.1515327342
.refinance.quickenloans.com/	1970-01-20 18:07:57	Name: _pin_unauth Value: dWlkPVlUbGpZbUZqTW1RdFlqRXhOaTAwWldRMkxUbGpOV0l0TW1JeE0yRTJaVEptTW1NeA
.rubiconproject.com/	1970-01-20 18:07:57	Name: khaos Value: LDN32EC7-J-HIJB
.rubiconproject.com/	1970-01-20 18:07:57	Name: audit Value: 1\|HfI7xzynVR2+Z8L4by7UV/nUAVUGglj4Ib2DketWrdaFQXC9JARqftIaU1HwhmIIVtMRIvgJ9nyM1KxoLazIt8oW2SgbbjsrEOjxxX8e+bOsl34iR5OUhcHwzfCokMEI4J2JHtowCUl/6K+MJaMXAo76/Gy8ewrDCOeqF/Dn4Co=
.casalemedia.com/	1970-01-20 18:07:57	Name: CMID Value: Y9uusfz3MBAQ7TlLwNnH2gAA
.casalemedia.com/	1970-01-20 11:31:57	Name: CMPS Value: 477
.casalemedia.com/	1970-01-20 11:31:57	Name: CMPRO Value: 477
.adnxs.com/	1970-01-20 11:31:57	Name: uuid2 Value: 3142088925582538197
.adnxs.com/	1970-01-20 11:31:57	Name: anj Value: dTM7k!M4.FErk#WF']wIg2IlekE7/(!]tbPl1MwL(!R7qUY'C]FpcKYYWJ$WG4tpr^KtA[bG7rj<QG=%9sk?bIRwi:w9Ld1ss0gd17Mco/y@Yw#ttOW*zpWw
.pubmatic.com/	1970-01-20 11:31:57	Name: KRTBCOOKIE_218 Value: 4056-Y9uurgAABJeUPlM5&KRTB&22978-Y9uurgAABJeUPlM5&KRTB&23194-Y9uurgAABJeUPlM5&KRTB&23209-Y9uurgAABJeUPlM5
.pubmatic.com/	1970-01-20 10:05:33	Name: PugT Value: 1675341488
.demdex.net/	1970-01-20 13:41:33	Name: dextp Value: 21-1-1675341486749\|771-1-1675341486881\|1083-1-1675341487028\|1085-1-1675341487251\|1086-1-1675341487582\|1087-1-1675341488006\|1088-1-1675341488391\|19913-1-1675341488580\|83349-1-1675341488729\|144230-1-1675341488844\|144231-1-1675341488950\|144232-1-1675341489056\|144233-1-1675341489160\|144234-1-1675341489266\|144235-1-1675341489369\|144236-1-1675341489472\|144237-1-1675341489574

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690488&pkey3=c4b8011d37304ad097f6d21387df8851&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=c4b8011d37304ad097f6d21387df8851 Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
ad.doubleclick.net
ads.revjet.com
ads.yahoo.com
adservice.google.com
alb.reddit.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cdn1.decide.dev
cdn1.lockerdomecdn.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
content.lowermybills.com
content.refinance.quickenloans.com
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
educatescreen.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
klsdkfkw.duckdns.org
pix.revjet.com
pixel.everesttech.net
pixel.mathtag.com
pixel.rubiconproject.com
pixel1083.everesttech.net
psp.pushnami.com
quicken.demdex.net
quickenloans.tt.omtrdc.net
refinance.quickenloans.com
rp.liadm.com
rp4.liadm.com
s.amazon-adsystem.com
s.pinimg.com
s.yimg.com
s3.amazonaws.com
sc-static.net
sgtm.lowermybills.com
somni.quickenloans.com
sp.analytics.yahoo.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
sync-tm.everesttech.net
sync.search.spotxchange.com
trackpixel.refinance.quickenloans.com
trc.pushnami.com
trc.taboola.com
us-u.openx.net
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
www.redditstatic.com
108.138.113.246
108.139.29.103
13.225.224.171
135.148.151.99
142.250.65.166
142.250.65.194
142.250.72.98
151.101.1.44
151.101.130.49
151.101.193.140
151.139.128.10
18.161.34.94
18.164.124.56
192.35.249.137
192.40.39.223
2001:4860:4802:34::15
2001:4998:1c:800::1000
216.223.26.54
23.197.32.188
23.41.168.211
2600:1400:d:586::1e80
2600:1f18:730:b140:7681:9678:781c:27c9
2600:9000:23cb:b000:8:8845:1500:93a1
2600:9000:2514:a000:a:8e7d:9900:93a1
2606:4700:4400::6812:2021
2606:4700:4400::ac40:9792
2606:4700:4400::ac40:98bb
2606:4700:4400::ac40:9bdf
2606:4700::6810:3965
2607:f8b0:4006:807::2004
2607:f8b0:4006:80f::200e
2607:f8b0:4006:81c::200a
2607:f8b0:4006:820::2002
2607:f8b0:4006:820::2003
2607:f8b0:4006:820::2008
2607:f8b0:4006:823::2002
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42:400::396
2a04:4e42:46::84
34.200.94.148
34.202.55.214
34.233.25.80
35.201.76.131
35.244.159.8
41.216.176.9
44.210.217.65
51.15.152.186
52.201.63.27
52.216.60.32
52.25.196.209
52.46.128.147
54.204.59.49
54.209.198.197
63.140.36.103
68.67.161.182
69.173.151.100
76.13.32.146
8.28.7.83
0093220d4c1b5e63d15fb4e0086a3f1a5e352c183335c5ec2b26dc0397804b65
03e4b296c1cabd96bf55a93dec36900f4178186e981b56b333a75d286462dce4
0716b77ae94ad392bc3fd022273e0ac439b06162405ca061e08d6da5b3eb1bba
09b2266a6c3de46173fbcc83a8982bd7a980abf66e38243dc44552fe05d226e5
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d
0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005
0d27e0fa1ad9b2e5851d637bd4d5ed6cc31309f8ca146219558897af499b3b64
0e034ed462c5f8d7e9fbe4a568ef419183bc28b35971714dc19a7b0b49fa4458
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3
10c8df2193e83ab880db098c38c308d15e11e158f388bed67036470681ba130c
121b149eac0ac52ae33e8e7bdc54935992215ac4c602d087bb222de88bbea915
19094c592aeeebae116447ed13c90636e41825350032b21a7c4e8eb202d448bc
1da7501a8e8ed5316e6cb4dea5e8a8b7fdc2c36c0a46f0138d199f96b5430e51
1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532
1fcafbfc097f63c7daaa02244e80c15ae7a209bc978ef4d77524bdb7dcf25e5b
1fd6c5174f6ec3b3c5a8451e2c2bee51bdf58d60029e11e9c0b33ede75b62078
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
357cd7af4c2d588fc7a976cdd9735c94a0aa4ecc65df1d53b9bc426cd9350e4f
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
3a1dc61fe6d4623c026e5d4675e2b719907445f110375cefdcf7c4d91c08f838
3a541998b9c385a9e7c8aa59980b151070459d8fd8f1dc4a5f469cd1d57d43d2
3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae
3ef64e4a0001cd55211fff6bd306290f29c7482a6006d070ee21e52484b7ef22
4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
4b01f9a7a6886d1fa34e50af146b0c0df3e7582547121f00f307afd7766b5d54
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4cd749cb1a66ca42afac2d38a803da602eef0619f6a9efba23a8ab454226575e
4d068312f585cf6337128ffc11fb152b19c9a372367d97c3293055fecedf1ee3
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fcdc9958c6771be54ce049f1018c88de729635abea1c81275539a23c629fe20
5160c3f1f966b5f1215cbf7e9e681f4bd9228de7e9f56b93ce1b51c5c7451571
52ac5a065fa5bdcb9a814b24a1a5d7b0cabdea81b63d3d39a3d2efa8b0a6c6c1
53f667ee02b941b62875290f2490c3a66e4067d6abd02500635bafb672891518
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
549961ac6e0161b3683c9202c2aaeb442b3a5176420192e1ca5e9168bea879c7
54e2591a73db0d4a45be67090da625e78b281139a16039fcab54c726e1ad3577
554afba94f8f8112f1999aee0c468921aadf420f75ae2109bd15670cd487f80a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5849e07d0d6cbb144829b98da75fda4a8eb3fc2b5749d48cc94bb170db54859a
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a269899604bd9f213bcbd04f95cf92cbfd96fd5127ba901f10b8bfc435fb68d
63b2f0b99fea462c96bdb35799e62b4cb534a14b09ee95c6632a7828959e63eb
65e4b486c0a703dc173e3f7301d5a2c1f75dc05048459923d1c26bd23f6d1acb
68f274e5330a1431b6e07a6a979209097633d713576cf9620bee34a6bd898ad7
6c058da3e29e1366f5a0e5a5e6408c4adc51fe4edd5335e0fc39a75df79a10ec
6eceb1f0125e55dc7051adfec1166348ae06593aefa875aa9f835c5eabe5fd34
70850ddb105dde8d9f866423d26eaa84fdcd74a595d5c7537465d5dfeb01f829
72b6e32589409062f7da67d61243ac889d71f561b0c439075bdd184fcb3067d9
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
792f8a763bd51ffcc6094ddc7bcc1fa7983a652e012e6965a5620e53fee32a76
7a3bcc4ea246253c762bbf4df2af7be93a663ec62af9fea8188e9c8a7f8b8c6e
7a6cf3b6daf39a9b2f236a2b3449bc004378762c6ddc1fc09c98673ad247a691
7baf4ac1cb2adf82ed9e88c9fa1b22f8ea22e14cf2aa24e9936c6578515e70ae
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5
80cf8258e7c2d2cadd3b40ecf2a8d65c3708841ed580bb5ec882668e4e6a92fa
83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9
898214b89ce7f60eae60b7d81d3317da2af33902024d53219c3015701a9c051f
8b20b831c4ed85597134eb5948eb20f3ea9dfb8bd108a4b4b3741fb7b220c635
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
8ce9cb041fadcdc6eabbab3358a66971cd36e977014dda4b6559782c00a5c992
92775ef23405bbed209db7abcc79262128de3ebfb115e17a37a6f7bdec07ad47
95624dc103c9feefb4e715967c05d0e140542a3629a3050bddcd5ee15224d75b
9b12db25717b1f4f1c1c4733066ce57b31ee8d6e1d799cfbc38384c3356e86b8
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a3e5913a378aeffa23539eeb13420730acd24f3a87616fbcc7738a58a8aabcf1
a56e0f5e0488b2cd0ea6d2011a47095ead582e6b36ccc4aaa258b9d56a873b9d
aacfea800a59766fdd3672fad8e5eba13abae2dab105014fc9214cb0c1409925
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b471623c24887166c45b578a6967c17312758eb6b20a1da1d8d51038db34a9f0
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
bffa0d5c8a957ba5bbac1da2ad62606e806dc93db185d74c82547f382428c632
c1cdf12dff1ba6a0adef6c126a8a0075fa2e31c55031dbdfe73dc6821d6a57cc
c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c3459087f17a0ae2f44527b1469028bce8ca2d282404c9093f080f168a03b5cd
ca74681b2e650027d2baff22e721ebeb61686988c51db5a86944f36f1b2b6901
cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a
d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321
d60aa838e099599b51126886e7fa0334ad2022c7b4f76977c86f45463b55bfe9
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
dbe0bf1b9db8912770e849b979650a616b44dc78930290df944591d75d292a08
de9462e351a7c74cd76bf432a62faf0dbf0b068beeb7a16c83eac6728956b7f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5f60e10f83594d44f4ea20444939120294b75c32343b177adf63d868c4866b2
e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c
ec4f648af853b25836f83a96b4cc87c881d0d12afaf15d7e5ba8954ee6e89a9d
ed49359dd841f7601fbe26fa64ecfbe97a4ad9468732cd9a0266527d610a8331
ee1ddfd7f8b87a6c667460e1a09b96f1459c84c069179752ececc28bb43953d3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0
f3496bc7c277d917d35553c46ed1597a86065494cac582e42a3a1d55aedef7fb
f3e9287e2c3b20f9f8d9afb0c8117d6a3cec13f3b8587f362dc5476ed1eedaad
f4934f79a3ca32d311fc7de074bef9a236984478d5fa7823a4ea7b872908fa30
fa42d02480f27fd0a8768e025d5033abf291c0df6391f25074faf80fa58c422c

refinance.quickenloans.com Open in urlscan Pro 2606:4700:4400::6812:2021 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

152 Requests

83 %HTTPS

37 %IPv6

45 Domains

65 Subdomains

53 IPs

4 Countries

1886 kBTransfer

5264 kBSize

64 Cookies

18 Outgoing links

Page URL History

Redirected requests

152 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::6812:2021 Public Scan

Screenshot
Live screenshot

Full Image

152
Requests

83 %
HTTPS

37 %
IPv6

45
Domains

65
Subdomains

53
IPs

4
Countries

1886 kB
Transfer

5264 kB
Size

64
Cookies

152 HTTP transactions
0 data transactions