refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::ac40:9bdf Public Scan

Go To Rescan
Add Verdict Report

URL:
https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid...
Submission: On February 10 via api (February 10th 2023, 10:39:06 pm UTC) from IT — Scanned from IT

Summary HTTP 159 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 53 IPs in 8 countries across 43 domains to perform 159 HTTP transactions. The main IP is 2606:4700:4400::ac40:9bdf, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 398120.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 21st 2023. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	2606:4700:440... 2606:4700:4400::ac40:9bdf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2606:4700:440... 2606:4700:4400::6812:2021	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.224.189.93 13.224.189.93	16509 (AMAZON-02) (AMAZON-02)
4	2a02:26f0:f70... 2a02:26f0:f700:495::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:440... 2606:4700:4400::ac40:9792	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	13.227.219.63 13.227.219.63	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3865	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 6	3.248.49.44 3.248.49.44	16509 (AMAZON-02) (AMAZON-02)
1	13.227.210.174 13.227.210.174	16509 (AMAZON-02) (AMAZON-02)
19	2a00:1450:400... 2a00:1450:400d:806::2008	15169 (GOOGLE) (GOOGLE)
1	52.213.165.255 52.213.165.255	16509 (AMAZON-02) (AMAZON-02)
1 3	209.54.182.161 209.54.182.161	16509 (AMAZON-02) (AMAZON-02)
1 3	142.250.201.194 142.250.201.194	15169 (GOOGLE) (GOOGLE)
3 14	2a00:1450:400... 2a00:1450:400d:806::2002	15169 (GOOGLE) (GOOGLE)
3 14	2a00:1450:400... 2a00:1450:400d:808::2004	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:400d:80e::2003	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:38::178	15169 (GOOGLE) (GOOGLE)
1	54.72.143.161 54.72.143.161	16509 (AMAZON-02) (AMAZON-02)
2	13.37.25.97 13.37.25.97	16509 (AMAZON-02) (AMAZON-02)
8 8	54.229.62.148 54.229.62.148	16509 (AMAZON-02) (AMAZON-02)
1	52.209.9.253 52.209.9.253	16509 (AMAZON-02) (AMAZON-02)
4 4	142.250.180.198 142.250.180.198	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80d::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::15	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:80d::2003	15169 (GOOGLE) (GOOGLE)
1 1	52.213.137.74 52.213.137.74	16509 (AMAZON-02) (AMAZON-02)
7 8	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
6 12	54.195.46.193 54.195.46.193	16509 (AMAZON-02) (AMAZON-02)
2	2a02:26f0:dc:... 2a02:26f0:dc:39c::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	144.76.98.92 144.76.98.92	24940 (HETZNER-AS) (HETZNER-AS)
1	2600:9000:20e... 2600:9000:20eb:a400:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
7	151.101.193.44 151.101.193.44	54113 (FASTLY) (FASTLY)
1	2606:4700:440... 2606:4700:4400::6812:2345	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1)
1	2a04:4e42:400... 2a04:4e42:400::396	54113 (FASTLY) (FASTLY)
1	54.192.87.248 54.192.87.248	16509 (AMAZON-02) (AMAZON-02)
4	92.123.37.164 92.123.37.164	16625 (AKAMAI-AS) (AKAMAI-AS)
2	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
1	2600:9000:234... 2600:9000:234e:a600:a:8e7d:9900:93a1	16509 (AMAZON-02) (AMAZON-02)
2	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	3.216.213.114 3.216.213.114	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
2	5.9.124.242 5.9.124.242	24940 (HETZNER-AS) (HETZNER-AS)
1 1	2600:1f18:730... 2600:1f18:730:b150:45ed:3b73:d151:5773	14618 (AMAZON-AES) (AMAZON-AES)
1	54.204.59.49 54.204.59.49	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	151.101.192.84 151.101.192.84	54113 (FASTLY) (FASTLY)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
8 8	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
1 2	185.89.210.46 185.89.210.46	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2	54.204.164.0 54.204.164.0	14618 (AMAZON-AES) (AMAZON-AES)
1 2	185.94.180.126 185.94.180.126	35220 (SPOTX-AMS) (SPOTX-AMS)
159	53

5 2606:4700:4400::ac40:9bdf (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:4400::6812:2021 (United States)

ASN13335 (CLOUDFLARENET, US)

static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.93 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-93.fra2.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:f700:495::1e80 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9792 (United States)

ASN13335 (CLOUDFLARENET, US)

content.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.227.219.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-63.ams54.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.248.49.44 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-49-44.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.210.174 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-227-210-174.ams54.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:400d:806::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.165.255 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com

pixel1083.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 209.54.182.161 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.201.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bud02s35-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:400d:806::2002 (Ireland) 3 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:400d:808::2004 (Ireland) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:400d:80e::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.google.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.72.143.161 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-143-161.eu-west-1.compute.amazonaws.com

quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.37.25.97 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-37-25-97.eu-west-3.compute.amazonaws.com

somni.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.229.62.148 (Dublin, Ireland) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-62-148.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.209.9.253 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-9-253.eu-west-1.compute.amazonaws.com

quickenloans.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.180.198 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: bud02s33-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80d::2002 (Ireland)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::15 (United States)

ASN15169 (GOOGLE, US)

sgtm.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80d::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.137.74 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-137-74.eu-west-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.217.18.98 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 54.195.46.193 (Dublin, Ireland) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-195-46-193.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:dc:39c::1931 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 144.76.98.92 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.92.98.76.144.clients.your-server.de

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:a400:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.193.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2345 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mortgage.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:f03d:1fa::2000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.87.248 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-87-248.ams50.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 92.123.37.164 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-37-164.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

cdn1.decide.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn1.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:234e:a600:a:8e7d:9900:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.pmsrv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.76.131 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.216.213.114 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-216-213-114.compute-1.amazonaws.com

psp.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 5.9.124.242 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.242.124.9.5.clients.your-server.de

pix.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b150:45ed:3b73:d151:5773 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.204.59.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-59-49.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.192.84 (United States)

ASN54113 (FASTLY, US)

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.66.49 (United States) 8 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.80.39.216 (Canada) 1 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.46 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.204.164.0 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-164-0.compute-1.amazonaws.com

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.126 (Amsterdam, Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	everesttech.net 22 redirects pixel1083.everesttech.net — Cisco Umbrella Rank: 695578 cm.everesttech.net — Cisco Umbrella Rank: 1049 pixel.everesttech.net — Cisco Umbrella Rank: 4508 sync-tm.everesttech.net — Cisco Umbrella Rank: 583	11 KB
26	doubleclick.net 14 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 29 ad.doubleclick.net — Cisco Umbrella Rank: 175 cm.g.doubleclick.net — Cisco Umbrella Rank: 211	16 KB
19	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 41	1 MB
17	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 398120 static-msql-prod.refinance.quickenloans.com — Cisco Umbrella Rank: 809890 trackpixel.refinance.quickenloans.com — Cisco Umbrella Rank: 845026 somni.quickenloans.com — Cisco Umbrella Rank: 278197 content.refinance.quickenloans.com — Cisco Umbrella Rank: 571736 cdn.mortgage.quickenloans.com	301 KB
16	google.com 3 redirects www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 72	3 KB
14	google.it www.google.it — Cisco Umbrella Rank: 22591	1 KB
7	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 912 trc.taboola.com — Cisco Umbrella Rank: 668	19 KB
7	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 206 quicken.demdex.net — Cisco Umbrella Rank: 82427	10 KB
6	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 4597 psp.pushnami.com — Cisco Umbrella Rank: 20779 trc.pushnami.com — Cisco Umbrella Rank: 4805	20 KB
4	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 969	4 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 34	3 KB
4	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 483	119 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 2602 rp.liadm.com — Cisco Umbrella Rank: 1516 rp4.liadm.com — Cisco Umbrella Rank: 7028	14 KB
3	revjet.com ads.revjet.com — Cisco Umbrella Rank: 6083 pix.revjet.com — Cisco Umbrella Rank: 6069	9 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 152	92 KB
3	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 167	18 KB
3	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 277	3 KB
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 731	1 KB
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 209	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 532	1 KB
2	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1204 ads.yahoo.com — Cisco Umbrella Rank: 2654	679 B
2	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 814	859 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 110	872 B
2	lmbahsj2.com www.lmbahsj2.com — Cisco Umbrella Rank: 526236	19 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 459	7 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 732	21 KB
2	gstatic.com fonts.gstatic.com	46 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 24	20 KB
2	lowermybills.com content.lowermybills.com — Cisco Umbrella Rank: 744506 sgtm.lowermybills.com — Cisco Umbrella Rank: 734923	4 KB
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 881	453 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 432	273 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 323	239 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1521	157 B
1	lockerdomecdn.com cdn1.lockerdomecdn.com — Cisco Umbrella Rank: 15512	1 KB
1	pmsrv.co c.pmsrv.co — Cisco Umbrella Rank: 47096	4 KB
1	decide.dev cdn1.decide.dev — Cisco Umbrella Rank: 23347	940 B
1	sc-static.net sc-static.net — Cisco Umbrella Rank: 924	13 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1399	8 KB
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 495	476 B
1	omtrdc.net quickenloans.tt.omtrdc.net — Cisco Umbrella Rank: 105585	724 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1803	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 917	6 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 4733	6 KB
159	43

	Domain	Requested by
19	www.googletagmanager.com	refinance.quickenloans.com assets.adobedtm.com www.googletagmanager.com trackpixel.refinance.quickenloans.com
14	www.google.it	refinance.quickenloans.com
14	www.google.com	3 redirects
14	googleads.g.doubleclick.net	3 redirects www.googletagmanager.com
12	pixel.everesttech.net	6 redirects
8	sync-tm.everesttech.net	8 redirects
8	cm.g.doubleclick.net	7 redirects
8	cm.everesttech.net	8 redirects
6	trc.taboola.com	cdn.taboola.com
6	dpm.demdex.net	1 redirects refinance.quickenloans.com www.datadoghq-browser-agent.com
5	content.refinance.quickenloans.com	refinance.quickenloans.com static-msql-prod.refinance.quickenloans.com
5	refinance.quickenloans.com	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
4	pixel.mathtag.com	trackpixel.refinance.quickenloans.com pixel.mathtag.com refinance.quickenloans.com
4	ad.doubleclick.net	4 redirects
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
4	assets.adobedtm.com	refinance.quickenloans.com assets.adobedtm.com
3	connect.facebook.net	refinance.quickenloans.com connect.facebook.net
3	www.googleadservices.com	1 redirects www.googletagmanager.com trackpixel.refinance.quickenloans.com
3	s.amazon-adsystem.com	1 redirects refinance.quickenloans.com
2	sync.search.spotxchange.com	1 redirects
2	trc.pushnami.com	www.datadoghq-browser-agent.com
2	ib.adnxs.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	ct.pinterest.com	s.pinimg.com refinance.quickenloans.com
2	www.facebook.com	refinance.quickenloans.com
2	pix.revjet.com	ads.revjet.com
2	psp.pushnami.com	www.datadoghq-browser-agent.com
2	www.lmbahsj2.com	trackpixel.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	s.yimg.com	refinance.quickenloans.com www.datadoghq-browser-agent.com
2	s.pinimg.com	refinance.quickenloans.com s.pinimg.com
2	fonts.gstatic.com	fonts.googleapis.com
2	adservice.google.com	refinance.quickenloans.com
2	somni.quickenloans.com	www.datadoghq-browser-agent.com
2	www.google-analytics.com	www.googletagmanager.com www.datadoghq-browser-agent.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
1	image2.pubmatic.com
1	us-u.openx.net
1	pixel.rubiconproject.com
1	ads.yahoo.com
1	sp.analytics.yahoo.com
1	rp4.liadm.com	refinance.quickenloans.com
1	rp.liadm.com	1 redirects
1	alb.reddit.com
1	cdn1.lockerdomecdn.com	trackpixel.refinance.quickenloans.com
1	c.pmsrv.co	trackpixel.refinance.quickenloans.com
1	cdn1.decide.dev	trackpixel.refinance.quickenloans.com
1	sc-static.net	refinance.quickenloans.com
1	www.redditstatic.com	refinance.quickenloans.com
1	cdn.mortgage.quickenloans.com	trackpixel.refinance.quickenloans.com
1	cdn.taboola.com	refinance.quickenloans.com
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	refinance.quickenloans.com
1	aa.agkn.com	1 redirects
1	sgtm.lowermybills.com	www.datadoghq-browser-agent.com
1	quickenloans.tt.omtrdc.net	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	pixel1083.everesttech.net	refinance.quickenloans.com
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	content.lowermybills.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
159	63

This site contains links to these domains. Also see Links.

Domain
mortgage.quickenloans.com
privacyportal-cdn.onetrust.com
www.fhfa.gov
capitalmarkets.freddiemac.com
www.nmlsconsumeraccess.org
www.rocketmortgage.com
www.remodelingcalculator.org
www.nytimes.com
www.lendingtree.com
marketing.lowermybills.com

Subject Issuer	Validity	Valid
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2023-01-21` - `2024-01-21`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M02	`2023-02-02` - `2024-03-02`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
lowermybills.com Cloudflare Inc ECC CA-3	`2022-11-10` - `2023-11-10`	a year	crt.sh
*.pushnami.com Amazon	`2022-04-03` - `2023-05-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-11` - `2023-05-10`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-14` - `2024-01-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.tmogul.com Amazon	`2022-06-16` - `2023-07-15`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
somni.quickenloans.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-12` - `2023-04-12`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
sgtm.lowermybills.com GTS CA 1D4	`2023-01-09` - `2023-04-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-08-08`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-11-20` - `2023-02-18`	3 months	crt.sh
*.revjet.com Sectigo RSA Domain Validation Secure Server CA	`2022-03-14` - `2023-04-11`	a year	crt.sh
*.liadm.com Amazon	`2023-01-01` - `2024-01-30`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2022-12-08` - `2023-12-31`	a year	crt.sh
mortgage.quickenloans.com Cloudflare Inc ECC CA-3	`2022-11-10` - `2023-11-10`	a year	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-01-19` - `2023-03-08`	2 months	crt.sh
www.redditstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-16` - `2023-05-15`	6 months	crt.sh
sc-static.net Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
pixel.mathtag.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-05` - `2023-07-05`	a year	crt.sh
cdn1.decide.dev R3	`2023-01-06` - `2023-04-06`	3 months	crt.sh
pmsrv.co Amazon	`2022-10-16` - `2023-11-14`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2022-05-13` - `2023-05-13`	a year	crt.sh
cdn1.lockerdomecdn.com R3	`2023-01-06` - `2023-04-06`	3 months	crt.sh
s.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-21`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-16` - `2023-05-14`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.google.it GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-01-03` - `2023-06-28`	6 months	crt.sh

This page contains 5 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Frame ID: 07EC75FB1AB39AD8B7C8E3F7E7E3243E
Requests: 107 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: D76D2B8D879F3E170727359F54BC16B0
Requests: 19 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: 2FDB83154F4725818831CF2B7DCFE23A
Requests: 28 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: A88FB0FBE971927D96C8282D22DBEC5F
Requests: 1 HTTP requests in this frame

Frame: https://pixel.mathtag.com/sync/iframe?mt_uuid=218b63e6-c786-4700-8e46-0ac6cffd4e6b&no_iframe=1&mt_adid=245296&source=mathtag
Frame ID: 32FE54A986CF29E1744EB02E6A3DAEB2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

QuickenLoans

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

159
Requests

84 %
HTTPS

40 %
IPv6

43
Domains

63
Subdomains

53
IPs

8
Countries

1891 kB
Transfer

5283 kB
Size

60
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://mortgage.quickenloans.com/legal/MSQL_stateprivacy.php
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: http://capitalmarkets.freddiemac.com/debt/pdf/guide_gse_debtsecurities.pdf
Title: http://capitalmarkets.freddiemac.com/debt/pdf/guide_gse_debtsecurities.pdf

Search URL Search Domain Scan URL

URL: https://www.nmlsconsumeraccess.org/
Title: www.NMLSConsumerAccess.org

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/email-policy
Title: E-Mail Policy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/security-privacy
Title: Security and Privacy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/disclosures-licenses
Title: Disclosures and Licenses

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/opt-out?show=email
Title: Communication Opt-Out

Search URL Search Domain Scan URL

URL: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/
Title: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates
Title: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates

Search URL Search Domain Scan URL

URL: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/
Title: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/MSQL_terms.php
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/MSQL_privacy.php
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/licenses.php
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://mortgage.quickenloans.com/legal/ad-targeting.php
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://marketing.lowermybills.com/api/marketing/redirect?uid=214966&prd=MS
Title: Go To LowerMyBills

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1676068740415 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1676068740415

Request Chain 21

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894 HTTP 302
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Request Chain 22

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=hMfmY6GKKcrS1wb-oYz4Ag&random=138168120&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=138168120&sscte=1&crd=&is_vtc=1&ocp_id=hMfmY6GKKcrS1wb-oYz4Ag&random=2618494635 HTTP 302
https://www.google.it/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=138168120&sscte=1&crd=&is_vtc=1&ocp_id=hMfmY6GKKcrS1wb-oYz4Ag&random=2618494635&ipr=y&prhg=0

Request Chain 32

https://cm.everesttech.net/cm/dd?d_uuid=57926570742250399620751931607527708217 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y&d_uuid=57926570742250399620751931607527708217

Request Chain 34

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=275445841.1676068741;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CKCgs8-CjP0CFUoSGAodGCALBQ;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=275445841.1676068741;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CKCgs8-CjP0CFUoSGAodGCALBQ;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df

Request Chain 36

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=275445841.1676068741;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CLCmtc-CjP0CFbkLewod1YgBPA;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=275445841.1676068741;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CLCmtc-CjP0CFbkLewod1YgBPA;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df

Request Chain 48

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=512768738&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=hMfmY4aNN9qfmLAP_IObwAM&sscte=1&crd=&pscrd=EkxDaEFJZ1BPWG53WVE4OXJ4dWJXZ3c4MV9FaVVBTElBekROYlU2TkhaWUJfY0JGU2JiRVRVQlNyVUVwZzFMU0VFaHdzUENlczIyVVBnGldDaEFJZ1BPWG53WVFtS3VyOVl6VzFvcERFaTBBS08tdy1JOFphSHJ3V0V0bHBTRVM3Y0gxNFNyNDJuM1FSWjJta040ckI3T0lOakNtRFhSTDZWSzRwd28 HTTP 302
https://www.google.com/pagead/1p-conversion/1062919768/?random=512768738&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ1BPWG53WVE4OXJ4dWJXZ3c4MV9FaVVBTElBekROYlU2TkhaWUJfY0JGU2JiRVRVQlNyVUVwZzFMU0VFaHdzUENlczIyVVBnGldDaEFJZ1BPWG53WVFtS3VyOVl6VzFvcERFaTBBS08tdy1JOFphSHJ3V0V0bHBTRVM3Y0gxNFNyNDJuM1FSWjJta040ckI3T0lOakNtRFhSTDZWSzRwd28&is_vtc=1&ocp_id=hMfmY4aNN9qfmLAP_IObwAM&cid=CAQSKQDUE5ymguROXbOxiPbtLJK-pZnvJ3OZek0Vy_uPylUSLwT060pfqbQU&random=3507394781 HTTP 302
https://www.google.it/pagead/1p-conversion/1062919768/?random=512768738&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ1BPWG53WVE4OXJ4dWJXZ3c4MV9FaVVBTElBekROYlU2TkhaWUJfY0JGU2JiRVRVQlNyVUVwZzFMU0VFaHdzUENlczIyVVBnGldDaEFJZ1BPWG53WVFtS3VyOVl6VzFvcERFaTBBS08tdy1JOFphSHJ3V0V0bHBTRVM3Y0gxNFNyNDJuM1FSWjJta040ckI3T0lOakNtRFhSTDZWSzRwd28&is_vtc=1&ocp_id=hMfmY4aNN9qfmLAP_IObwAM&cid=CAQSKQDUE5ymguROXbOxiPbtLJK-pZnvJ3OZek0Vy_uPylUSLwT060pfqbQU&random=3507394781&ipr=y&prhg=0

Request Chain 50

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=57926570742250399620751931607527708217 HTTP 302
https://dpm.demdex.net/ibs:dpid=21&dpuuid=220033204423003784043

Request Chain 52

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935 HTTP 302
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=1615840993 HTTP 302
https://www.google.it/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=1615840993&ipr=y

Request Chain 53

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTc5MjY1NzA3NDIyNTAzOTk2MjA3NTE5MzE2MDc1Mjc3MDgyMTc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEIH_Xx0l0_-7rx2uyynMYC4&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 54

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEOLTQyAkDWieybe0w47RNBs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 86

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEOLTQyAkDWieybe0w47RNBs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 91

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESEOLTQyAkDWieybe0w47RNBs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 102

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESEOLTQyAkDWieybe0w47RNBs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 104

https://rp.liadm.com/j?dtstmp=1676068741794&aid=a-06d7&se=e30&duid=ddc3c751f117--01gryqprcnhp92kzqhwmbfq9v4&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&ext_s_ecid=MCMID%7C57778890489945166260730687328887345905&wpn=lc-bundle HTTP 302
https://rp4.liadm.com/j?dtstmp=1676068741794&aid=a-06d7&se=e30&duid=ddc3c751f117--01gryqprcnhp92kzqhwmbfq9v4&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&ext_s_ecid=MCMID%7C57778890489945166260730687328887345905&wpn=lc-bundle&i6=MjAwMTphYzg6MjQ6NDQ6OjEy&n3pc=true

Request Chain 127

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEOLTQyAkDWieybe0w47RNBs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 139

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEOLTQyAkDWieybe0w47RNBs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 143

https://cm.everesttech.net/cm/yh HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y&sigv=1&esig=1~f274c25068799de3e5cf5e117c9b4ce61fafaa03

Request Chain 144

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUBiSGhBQUFCSm45QWdMNQ==

Request Chain 146

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y@bHhAAABJn9AgL5&expires=90

Request Chain 147

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y@bHhAAABJn9AgL5 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y@bHhAAABJn9AgL5&C=1

Request Chain 148

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=Y@bHhAAABJn9AgL5 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY%40bHhAAABJn9AgL5

Request Chain 149

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y@bHhAAABJn9AgL5

Request Chain 150

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y@bHhAAABJn9AgL5

Request Chain 153

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y@bHhAAABJn9AgL5&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y@bHhAAABJn9AgL5&img=1&__user_check__=1&sync_id=b806e641-a993-11ed-88f5-107c10e90506

Request Chain 154

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y@bHhAAABJn9AgL5&t=2592000&o=0

159 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
refinance.quickenloans.com/ 120 KB
23 KB 1396ms
1208ms Document
text/html 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

2aa042d158aa67895b5cf55483f8e0ee855734cb891ff28a4687fd7dbe2f6238

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 7978568a7b4a0f66-MXP
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Fri, 10 Feb 2023 22:38:58 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

GET
H2 200 main.37ec7c7947fed86b0242.css
static-msql-prod.refinance.quickenloans.com/ 66 KB
12 KB 143ms
80ms Stylesheet
text/css 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a6cf3b6daf39a9b2f236a2b3449bc004378762c6ddc1fc09c98673ad247a691

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:38:59 GMT
x-amz-version-id: D8EqdAPMWBYdYivCGSHag4QcKVWTQG4U
content-encoding: gzip
cf-cache-status: MISS
via: 1.1 2a8b2d3e9bd5df82402374dbf8edcd96.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP64-P2
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 10 Feb 2023 12:23:34 GMT
server: cloudflare
etag: W/"bec2a4f40238e442b516b45d05a11752"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 797856927e5a5a3d-MXP
x-amz-cf-id: QsrPiwxV5G_5X1P4ZtZOa3KI_PbIzE6TZQg4l_K6M31VO0Pk7ncCPQ==
expires: Sat, 11 Feb 2023 02:38:59 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 19 KB
6 KB 138ms
33ms Script
application/x-javascript 13.224.189.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.189.93 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-189-93.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f3496bc7c277d917d35553c46ed1597a86065494cac582e42a3a1d55aedef7fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 10 Feb 2023 04:04:59 GMT
via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 66841
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6124
x-xss-protection: 1; mode=block
last-modified: Mon, 30 May 2022 14:38:02 GMT
server: AmazonS3
etag: "5add60196e5f96a414fb4b9586764e5d"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: O0h-GBqzzPl9caeVNUto7_PVOUlYKYZI2HuIif4grydJ2QoWjfTL2A==

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
914 B 757ms
693ms Script
application/javascript 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0093220d4c1b5e63d15fb4e0086a3f1a5e352c183335c5ec2b26dc0397804b65

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-f9ce7dd407c990d717ff.js
date: Fri, 10 Feb 2023 22:38:59 GMT
via: 1.1 f00a1e16a1b69b5fdf01447dd1592790.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 10 Feb 2023 22:36:10 GMT
server: cloudflare
etag: W/"ece8253d43bc7b407b5150bffe3e81a6"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 79785692785359cb-MXP
x-amz-cf-id: eicfvzRyUQSX1z7OsMfIwxihbAUx8fKH8s1XxIfBA4jE8RDKH83Hjg==
expires: Sat, 11 Feb 2023 02:38:59 GMT

GET
H2 200 launch-ENac0456a305144bd1997bb2b709c90a1c.min.js Show response
assets.adobedtm.com/ 304 KB
96 KB 216ms
36ms Script
application/x-javascript 2a02:26f0:f700:495::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:495::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4cd749cb1a66ca42afac2d38a803da602eef0619f6a9efba23a8ab454226575e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:38:59 GMT
content-encoding: gzip
last-modified: Tue, 04 Oct 2022 13:43:04 GMT
server: AkamaiNetStorage
etag: "0fb6aa3c4bf73f5d329f4861a8e0c874:1664890984.616336"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 97479
expires: Fri, 10 Feb 2023 23:38:59 GMT

GET
H2 200 deviceatlas-1.6.min.js Show response
content.lowermybills.com/deviceatlas-1.6/ 7 KB
3 KB 290ms
64ms Script
application/javascript 2606:4700:4400::ac40:9792
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://content.lowermybills.com/deviceatlas-1.6/deviceatlas-1.6.min.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9792 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d60aa838e099599b51126886e7fa0334ad2022c7b4f76977c86f45463b55bfe9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:38:59 GMT
via: 1.1 5071afda1ab6f09c39c5873ced3e225c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 03 Feb 2023 00:33:14 GMT
server: cloudflare
etag: W/"67510dbcee1857a225b8f76bdc940c26"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 797856956ec65a19-MXP
x-amz-cf-id: t0x1nAPGhuFk8XCmeXpzIwqHxtyxBIMlvVelO-sKBKa3AoQBLfyewQ==
expires: Sat, 11 Feb 2023 00:38:59 GMT

GET
H2 200 623bac6703b37600138f67a3 Show response
api.pushnami.com/scripts/v1/push/ 87 KB
18 KB 335ms
228ms Script
application/javascript 13.227.219.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.219.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-219-63.ams54.r.cloudfront.net
Software: /
Resource Hash: ab8140419c7b5be781790bfc0835bebbe09c8ee3edeb6f1bda347bda8a457ecd

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:38:59 GMT
content-encoding: gzip
via: 1.1 2dc050ab05a5052054de7d000d6c5f50.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
vary: accept-encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: xUX_DoMxQKTokKQ5oILMlXf1pLMUeRhDF3Uf6gChW-sM06uC2C-ovg==

GET
H2 200 css2
fonts.googleapis.com/ 822 B
822 B 97ms
34ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4b01f9a7a6886d1fa34e50af146b0c0df3e7582547121f00f307afd7766b5d54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 10 Feb 2023 22:38:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 22:36:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 10 Feb 2023 22:38:59 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
775 B 98ms
37ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7a3bcc4ea246253c762bbf4df2af7be93a663ec62af9fea8188e9c8a7f8b8c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 10 Feb 2023 22:38:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 22:38:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 10 Feb 2023 22:38:59 GMT

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
781 B 111ms
51ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

19094c592aeeebae116447ed13c90636e41825350032b21a7c4e8eb202d448bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 10 Feb 2023 22:38:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 22:38:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 10 Feb 2023 22:38:59 GMT

GET
H2 200 css2
fonts.googleapis.com/ 403 B
367 B 107ms
48ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dbe0bf1b9db8912770e849b979650a616b44dc78930290df944591d75d292a08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 10 Feb 2023 22:38:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 22:38:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 10 Feb 2023 22:38:59 GMT

GET
H2 200 main.37ec7c7947fed86b0242.js Show response
static-msql-prod.refinance.quickenloans.com/ 502 KB
143 KB 87ms
86ms Script
application/javascript 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da5e7d39ee408cac68360efbaed7104b04ad15bebe5256292de93955c6d93ad3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:38:59 GMT
x-amz-version-id: hMPTFNvmIaPp0VDE0F7NH0AnUmTbT0CF
content-encoding: gzip
cf-cache-status: MISS
via: 1.1 2a8b2d3e9bd5df82402374dbf8edcd96.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP64-P2
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 10 Feb 2023 12:23:34 GMT
server: cloudflare
etag: W/"abd20c55876a0daeabfdc6ae3ebe91c2"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 79785694b9dc5a3d-MXP
x-amz-cf-id: u2G3TxXpz-dIjGqcAu-__vCD3TBfQ4SQSmiH7D0vvB83EyeBLrU_zA==
expires: Sat, 11 Feb 2023 02:38:59 GMT

GET
H2 200 vaafb692b2aea4879b33c060e79fe94621666317369993 Show response
static.cloudflareinsights.com/beacon.min.js/ 17 KB
6 KB 191ms
118ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:38:59 GMT
content-encoding: gzip
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
server: cloudflare
etag: W/2022.10.1
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 79785697aac7bb05-MXP

GET
H2 200 pixel-f9ce7dd407c990d717ff.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 175 KB
24 KB 705ms
704ms Script
application/javascript 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a541998b9c385a9e7c8aa59980b151070459d8fd8f1dc4a5f469cd1d57d43d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: gzip
via: 1.1 4f2ea10fb219db4bf9fbf41e299c3cbe.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: RefreshHit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 10 Feb 2023 09:06:19 GMT
server: cloudflare
etag: W/"f17f655e0dd528d1e5dcac0495fd9f58"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 79785696fa3559cb-MXP
x-amz-cf-id: Dqay9qWktvgYhftNL_80-T5G5h8pvYafa8BPUlebcmXT-y1KBAHo9w==
expires: Sat, 11 Feb 2023 02:39:00 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1676068740415
https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1676068740415

4 KB
2 KB

53ms
53ms

XHR
application/json

3.248.49.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1676068740415

Requested by

Protocol

HTTP/1.1

Server

3.248.49.44 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-49-44.eu-west-1.compute.amazonaws.com

Software

Resource Hash

65fecc74ed34fec50568607bbbe0d59b6c058840ffef0efbccbfbd578e56e71b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v046-0b284ccfd.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: BbOp3pahQGI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1253
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v046-01546fed3.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: f26yiBdjS3Q=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1676068740415
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 34 KB
12 KB 37ms
36ms Script
application/x-javascript 2a02:26f0:f700:495::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:495::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "dfdd9e1f988805f0c2fbb10cd6b8f034:1663863409.614694"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12384
expires: Fri, 10 Feb 2023 23:39:00 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 3 KB
2 KB 39ms
39ms Script
application/x-javascript 2a02:26f0:f700:495::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:495::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "b89fcb8870ac40eecb6d3cc844d35389:1663863409.92483"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1598
expires: Fri, 10 Feb 2023 23:39:00 GMT

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 25 KB
9 KB 37ms
36ms Script
application/x-javascript 2a02:26f0:f700:495::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f700:495::1e80 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:50 GMT
server: AkamaiNetStorage
etag: "d220d501715e0484d0dddeac614f902c:1663863410.217006"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8755
expires: Fri, 10 Feb 2023 23:39:00 GMT

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 136ms
38ms Script
application/javascript 13.227.210.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.227.210.174 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-227-210-174.ams54.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:38:06 GMT
content-encoding: br
via: 1.1 46293c8f7848e2378b777a1f48183614.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: AMS54-C1
age: 55
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: x2A0YJI79OffDkqxocn2gFf5Awc7AQkrBZKzGmabFIv8GGnTTgacQA==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 100 KB
39 KB 166ms
66ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

18775709fabc898a85d11947399510b3c99bf0ac32e84d86d9734e763af2607f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39470
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 112ms
75ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9cc22f31667ff38fef666077f1efbad43a99bb823636c845dc9d4ec57c4b65ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44107
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H/1.1 200
OK p
pixel1083.everesttech.net/1083/ 128 B
796 B 216ms
48ms Image
image/png 52.213.165.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel1083.everesttech.net/1083/p?ev_transid=&ev_=%loanpurpose%&_lead=1
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.165.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-165-255.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:00 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

GET
H/1.1

200
OK

iui3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...

43 B
855 B

151ms
151ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Requested by

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 10 Feb 2023 22:39:01 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: K2HNWGSQN2B3MGHZ0DSQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 10 Feb 2023 22:39:00 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: SQ0GMKC86M6CBR8F062E
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/
www.google.it/pagead/1p-conversion/776757481/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=hMfmY6GKKcrS1w...
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=138168120&sscte=1&crd=&is_vtc=1&ocp...
https://www.google.it/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=138168120&sscte=1&crd=&is_vtc=1&ocp_...

42 B
455 B

181ms
68ms

Image
image/gif

2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=138168120&sscte=1&crd=&is_vtc=1&ocp_id=hMfmY6GKKcrS1wb-oYz4Ag&random=2618494635&ipr=y&prhg=0

Requested by

Protocol

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.it/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=138168120&sscte=1&crd=&is_vtc=1&ocp_id=hMfmY6GKKcrS1wb-oYz4Ag&random=2618494635&ipr=y&prhg=0
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 5 KB
3 KB 253ms
253ms XHR
application/json 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

65edf76f3328e9fbd5069a31fc13a5044ba2db312946f54e9e93cab6eabdf6c5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"154b-7DWIZVe0qPxeP/ND17cSEU/QxF8"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 7978569cdd110f66-MXP
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 213 KB
75 KB 88ms
87ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-WQ7TGZQSWQ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a675f842275bafec3f72a34de62667f934f25f9677554c192e964c3fe56ec0e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76869
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 70ms
69ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-4641735&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

25dc2307deb5d7578e8eb21eb305d22ba65fa282633adf6b3b9096709a6811cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44336
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
65 KB 96ms
96ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a64129d7e34453e5979a1f5f5df25209fadf811e7dbad16febed00cab664bdab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66090
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 75ms
74ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9045885&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

caad098aba2a44cd5d9005a87362ec410ccf304ec2e022dde1a7956cb1c42800

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44332
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 110 KB
43 KB 67ms
66ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d2abd734befc8e01e5edfc02ba7ce03a66558c9161db69d5d717b574b566e1b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 44101
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 82ms
11ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 10 Feb 2023 22:09:34 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 1766
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Sat, 11 Feb 2023 00:09:34 GMT

GET
H/1.1 200
OK dest5.html Show response
quicken.demdex.net/ Frame D76D 7 KB
3 KB 282ms
50ms Document
text/html 54.72.143.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.72.143.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-72-143-161.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v046-03a127b6a.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: jhsxfBsJS6c=
content-encoding: gzip
date: Fri, 10 Feb 2023 22:39:01 GMT
last-modified: Wed, 8 Feb 2023 11:53:44 GMT
transfer-encoding: chunked
vary: accept-encoding

GET
H2 200 id Show response
somni.quickenloans.com/ 48 B
470 B 183ms
36ms XHR
application/x-javascript 13.37.25.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=57778890489945166260730687328887345905&ts=1676068740795

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.37.25.97 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-37-25-97.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

b7f9aaa7738bb6bf650218988704b4b8e553357835a1ab4d88005c9629a22266

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Y&d_uuid=57926570742250399620751931607527708217
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=57926570742250399620751931607527708217
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y&d_uuid=57926570742250399620751931607527708217

0
0

65ms
49ms

Image
application/json

3.248.49.44
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y&d_uuid=57926570742250399620751931607527708217
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: HTTP/1.1
Server: 3.248.49.44 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-49-44.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Y&d_uuid=57926570742250399620751931607527708217
Date: Fri, 10 Feb 2023 22:39:00 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
quickenloans.tt.omtrdc.net/rest/v1/ 355 B
724 B 219ms
72ms XHR
application/json 52.209.9.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quickenloans.tt.omtrdc.net/rest/v1/delivery?client=quickenloans&sessionId=9e6483178c9c4825a8c7beecb2969605&version=2.10.0
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.9.253 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-9-253.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 9c52d4f0c511ad46314d6bbda1055195eac4101b56de0102dc5cd3be3310ad58

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: d06391f2535aeaea71eb98b49398cbb1

GET
H2

200

dc_pre=CKCgs8-CjP0CFUoSGAodGCALBQ;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=275445841.1676068741;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quicken...
https://ad.doubleclick.net/activity;dc_pre=CKCgs8-CjP0CFUoSGAodGCALBQ;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=275445841.1676068741;u3=;u14=%25qls.value%25;~or...
https://adservice.google.com/ddm/fls/z/dc_pre=CKCgs8-CjP0CFUoSGAodGCALBQ;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2...

42 B
401 B

185ms
74ms

Image
image/gif

2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKCgs8-CjP0CFUoSGAodGCALBQ;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df

Requested by

Protocol

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CKCgs8-CjP0CFUoSGAodGCALBQ;src=4641735;type=conve0;cat=cored0;ord=1;num=8657857346208;gtm=45fe3280;auiddc=*;u3=;u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
213 B 32ms
32ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=952803356&t=pageview&_s=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&ul=en-us&de=UTF-8&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAQABAAAAACAAs~&jid=998179007&gjid=557941574&cid=1624755911.1676068741&uid=&tid=UA-3849768-74&_gid=1448349879.1676068741&_r=1&gtm=457e3280&z=1784512709

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:00 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

dc_pre=CLCmtc-CjP0CFbkLewod1YgBPA;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.qui...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=275445841.1676068741;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%...
https://ad.doubleclick.net/activity;dc_pre=CLCmtc-CjP0CFbkLewod1YgBPA;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=275445841.1676068741;u3=Date.now().toString(...
https://adservice.google.com/ddm/fls/z/dc_pre=CLCmtc-CjP0CFbkLewod1YgBPA;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=*;u3=Date.now().toString();u14=%25qls.val...

42 B
107 B

152ms
75ms

Image
image/gif

2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLCmtc-CjP0CFbkLewod1YgBPA;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df

Requested by

Protocol

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CLCmtc-CjP0CFbkLewod1YgBPA;src=9045885;type=conversi;cat=corethan;ord=1;num=7832445421469;gtm=45fe3280;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/1062919768/ 2 KB
1 KB 65ms
64ms Script
text/javascript 142.250.201.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1062919768/?random=1676068740869&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.201.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s35-in-f2.1e100.net

Software

cafe /

Resource Hash

d371367b0a40a2e26ed2cb9842bccdffe8d25cf282d4100f31275c8947d30118

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:00 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1333
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect Show response
sgtm.lowermybills.com/g/ 65 B
538 B 549ms
484ms XHR
text/plain 2001:4860:4802:32::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.lowermybills.com/g/collect?v=2&tid=G-WQ7TGZQSWQ&gtm=45je3280&_p=952803356&cid=1624755911.1676068741&ul=en-us&sr=1600x1200&_fplc=0&uaW=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=IT&_s=1&sid=1676068740&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_ss=1&richsstsse

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::15 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 google
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
757 B 89ms
73ms Image
image/png 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
via: 1.1 c2375420915a59a31c2575fcfd6cae7a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Fri, 03 Feb 2023 00:33:27 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7978569ed93a59cb-MXP
x-amz-cf-id: 1lk_IXXjtUFB_sOKN99Yl90jsvFj-BaqbbvwMpZvJ9a2U6XtdAX-QA==
expires: Sat, 11 Feb 2023 02:39:00 GMT

GET
H2 200 overlay-close.svg
content.refinance.quickenloans.com/msql/EdisonOverlay/ 586 B
556 B 83ms
67ms Image
image/svg+xml 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/EdisonOverlay/overlay-close.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
via: 1.1 04605b2a5011c712f60b8111aec3723a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 03 Feb 2023 00:33:27 GMT
server: cloudflare
etag: W/"58887760fe01f3933d5ae2d7bcc3f373"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 7978569ed93959cb-MXP
x-amz-cf-id: t-tN9NVNAE6DxQgmFgN1cAVFE7BJCy1UBZsAO24j9PP-f7LISOpZXQ==
expires: Sat, 11 Feb 2023 02:39:00 GMT

GET
H2 200 qllogo.png
content.refinance.quickenloans.com/msql/ 4 KB
4 KB 98ms
85ms Image
image/png 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/qllogo.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
via: 1.1 90b1dc17dc69490d49275971c6988188.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP63-P1
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 3877
x-xss-protection: 1; mode=block
last-modified: Fri, 03 Feb 2023 00:33:27 GMT
server: cloudflare
etag: "277055237f3837abfae204219c13fa6c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7978569ed94059cb-MXP
x-amz-cf-id: j7wTpaCuB49r95ESEUCdeocjyw_jWwP9Xzes1ZLJreBxMUyeUy1mSg==
expires: Sat, 11 Feb 2023 02:39:00 GMT

GET
H2 200 redarrow1.png
content.refinance.quickenloans.com/msql/ 7 KB
7 KB 91ms
78ms Image
image/png 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/redarrow1.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:00 GMT
via: 1.1 90b1dc17dc69490d49275971c6988188.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 6656
x-xss-protection: 1; mode=block
last-modified: Wed, 08 Feb 2023 23:23:58 GMT
server: cloudflare
etag: "55eb59d4535de0b41be9b7465ec7d9c3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7978569ed93c59cb-MXP
x-amz-cf-id: TCrBuL45-tO9RQlunEioVc9DkDW56OT-RiF-hi3OWvE8bfYwqAQ19Q==
expires: Sat, 11 Feb 2023 02:39:00 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 134ms
38ms Font
font/woff2 2a00:1450:400d:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 17:31:44 GMT
x-content-type-options: nosniff
age: 18437
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Feb 2024 17:31:44 GMT

GET
H2 200 4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2
fonts.gstatic.com/s/shadowsintolighttwo/v13/ 15 KB
16 KB 176ms
80ms Font
font/woff2 2a00:1450:400d:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/shadowsintolighttwo/v13/4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 02:08:15 GMT
x-content-type-options: nosniff
age: 73846
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15832
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:54:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Feb 2024 02:08:15 GMT

POST
H2 200 ip Show response
refinance.quickenloans.com/api/geo/ 147 B
245 B 274ms
274ms XHR
application/json 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/geo/ip

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

84acb826b2a41b4ea8070965f3b258d4d58c56ea7c2103c8ab17ed08d53ea543

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"93-0efgd06yN2yDHrP0DKRMYdF/mbg"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 7978569f0ff10f66-MXP
x-xss-protection: 1; mode=block

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
111 B 969ms
968ms XHR
text/plain 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 7978569f0ff30f66-MXP
content-length: 2
x-xss-protection: 1; mode=block

GET
H2 200 quicken_sprite_4_4_18.png
content.refinance.quickenloans.com/msql/ 75 KB
75 KB 105ms
105ms Image
image/png 2606:4700:4400::6812:2021
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/quicken_sprite_4_4_18.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.37ec7c7947fed86b0242.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2021 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
via: 1.1 b72d6213ee66805c468f4517e6e44e9c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: MXP63-P1
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 76537
x-xss-protection: 1; mode=block
last-modified: Fri, 03 Feb 2023 00:33:27 GMT
server: cloudflare
etag: "1f80b3d1f05cc5648c262fba9d39b61a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7978569f099659cb-MXP
x-amz-cf-id: 6hW2gAJBqRX5CGaBhIwTRixSf3TJNC0GDVppeFl-DwV3Vj5Xk_NJMA==
expires: Sat, 11 Feb 2023 02:39:01 GMT

GET
H2

200

/
www.google.it/pagead/1p-conversion/1062919768/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=512768738&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr...
https://www.google.com/pagead/1p-conversion/1062919768/?random=512768738&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadse...
https://www.google.it/pagead/1p-conversion/1062919768/?random=512768738&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadser...

42 B
108 B

76ms
68ms

Image
image/gif

2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-conversion/1062919768/?random=512768738&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ1BPWG53WVE4OXJ4dWJXZ3c4MV9FaVVBTElBekROYlU2TkhaWUJfY0JGU2JiRVRVQlNyVUVwZzFMU0VFaHdzUENlczIyVVBnGldDaEFJZ1BPWG53WVFtS3VyOVl6VzFvcERFaTBBS08tdy1JOFphSHJ3V0V0bHBTRVM3Y0gxNFNyNDJuM1FSWjJta040ckI3T0lOakNtRFhSTDZWSzRwd28&is_vtc=1&ocp_id=hMfmY4aNN9qfmLAP_IObwAM&cid=CAQSKQDUE5ymguROXbOxiPbtLJK-pZnvJ3OZek0Vy_uPylUSLwT060pfqbQU&random=3507394781&ipr=y&prhg=0

Requested by

Protocol

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.it/pagead/1p-conversion/1062919768/?random=512768738&cv=11&fst=1676068740869&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ1BPWG53WVE4OXJ4dWJXZ3c4MV9FaVVBTElBekROYlU2TkhaWUJfY0JGU2JiRVRVQlNyVUVwZzFMU0VFaHdzUENlczIyVVBnGldDaEFJZ1BPWG53WVFtS3VyOVl6VzFvcERFaTBBS08tdy1JOFphSHJ3V0V0bHBTRVM3Y0gxNFNyNDJuM1FSWjJta040ckI3T0lOakNtRFhSTDZWSzRwd28&is_vtc=1&ocp_id=hMfmY4aNN9qfmLAP_IObwAM&cid=CAQSKQDUE5ymguROXbOxiPbtLJK-pZnvJ3OZek0Vy_uPylUSLwT060pfqbQU&random=3507394781&ipr=y&prhg=0
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 4 KB
2 KB 51ms
51ms XHR
application/json 3.248.49.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&d_mid=57778890489945166260730687328887345905&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=MCID%0157778890489945166260730687328887345905&ts=1676068740983

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.49.44 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-49-44.eu-west-1.compute.amazonaws.com

Software

Resource Hash

d97bd5f5523baf3ed16cd84a6c83d56d7d9520cd7fb0aa56c23d679e94393f72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v046-0d6696b06.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: 75u06R5gTm0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1252
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1

200
OK

ibs:dpid=21&dpuuid=220033204423003784043
dpm.demdex.net/ Frame D76D
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=57926570742250399620751931607527708217
https://dpm.demdex.net/ibs:dpid=21&dpuuid=220033204423003784043

42 B
942 B

106ms
53ms

Image
image/gif

3.248.49.44
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=21&dpuuid=220033204423003784043

Protocol

HTTP/1.1

Server

3.248.49.44 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-49-44.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v046-08026f3a6.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: ilEGbNqJRuM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dpm.demdex.net/ibs:dpid=21&dpuuid=220033204423003784043
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
expires: 0

POST
H2 200 s16898100749622 Show response
somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LCXS/ 4 KB
4 KB 57ms
57ms XHR
application/x-javascript 13.37.25.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LCXS/s16898100749622

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.37.25.97 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-37-25-97.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

e5c16b8083ee57b5979d4bac97588eb585ed6508b7171122069ddeb710fac31b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-aam-tid: Cjs0MBd2RBY=
date: Fri, 10 Feb 2023 22:39:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 4218
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-1-v046-0d7e6a16f.edge-irl1.demdex.com 3 ms
pragma: no-cache
last-modified: Sat, 11 Feb 2023 22:39:01 GMT
server: jag
etag: 3599330216034500608-4619655331908496067
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Thu, 09 Feb 2023 22:39:01 GMT

GET
H2

200

/
www.google.it/pagead/1p-user-list/5830051840/ Frame D76D
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=1615840993
https://www.google.it/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=1615840993&ipr=y

42 B
108 B

64ms
63ms

Image
image/gif

2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=1615840993&ipr=y

Protocol

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.it/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=1615840993&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEIH_Xx0l0_-7rx2uyynMYC4&google_cver=1
dpm.demdex.net/ Frame D76D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NTc5MjY1NzA3NDIyNTAzOTk2MjA3NTE5MzE2MDc1Mjc3MDgyMTc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEIH_Xx0l0_-7rx2uyynMYC4&google_cver=1?gdpr=0&gdpr_consent=

42 B
942 B

53ms
52ms

Image
image/gif

3.248.49.44
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEIH_Xx0l0_-7rx2uyynMYC4&google_cver=1?gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

3.248.49.44 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-49-44.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v046-097336e4c.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: QQzX3MRvTWI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEIH_Xx0l0_-7rx2uyynMYC4&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame D76D
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEOLTQyAkDWieybe0w47RNBs&google_cver=1
https://pixel.everesttech.net/1x1

128 B
691 B

49ms
48ms

Image
image/png

54.195.46.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.195.46.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-195-46-193.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:01 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b51f-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 10 Feb 2023 22:39:01 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 129 KB
50 KB 64ms
64ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6cedaab2e441f3b99e251bb8d3a203554b2e134eaf8e0d91e17c04030e2ae162

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50768
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ Frame 2FDB 1 KB
1 KB 437ms
147ms Script
application/javascript 2a02:26f0:dc:39c::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:dc:39c::1931 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6b6f8057e240a65dc3ed044f6249e4a12d5e9d2c4f8e18e0f44f9603ee5a03ff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

akamai-x-true-ttl: 7200
x-cdn: akamai
etag: "20dcf873ff1608d745dceb84d6857da6"
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
content-length: 1146

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 111 KB
43 KB 67ms
67ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dd12f52957b7cedfd396eb5860e1001b4c4fc2b03b6875d3023c7cf14b3ae339

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44307
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 2FDB 106 KB
28 KB 93ms
25ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 10 Feb 2023 22:39:01 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27843
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: AbyhdSeoHTLM5mQd7ClchoCsnPMZ0Kdk1CF5Y62iy+yu7cyjIz1D5twmTsZA8GhVxYIbzgmdMysqswPIWmPMxg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
ads.revjet.com/ Frame 2FDB 19 KB
8 KB 128ms
33ms Script
application/javascript 144.76.98.92
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 144.76.98.92 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.92.98.76.144.clients.your-server.de
Software: nginx /
Resource Hash: 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2022 13:58:12 GMT
server: nginx
etag: W/"6357eb74-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Fri, 10 Feb 2023 22:49:01 GMT

GET
H2 200 a-06d7.min.js Show response
b-code.liadm.com/ Frame 2FDB 34 KB
12 KB 178ms
56ms Script
application/javascript 2600:9000:20eb:a400:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:a400:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: de9462e351a7c74cd76bf432a62faf0dbf0b068beeb7a16c83eac6728956b7f6

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 20:08:01 GMT
content-encoding: gzip
via: 1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 9060
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: PXjzIKNmTqKsrxR2Ym-ZdoxIAiPwVzSIMYH-O8QTf_TFxYNqCPWZTg==

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 45 KB
16 KB 64ms
63ms Script
text/javascript 142.250.201.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.201.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s35-in-f2.1e100.net

Software

cafe /

Resource Hash

5aa93e7401f9a3344d1f891eacfb0cf698bf56cc5d7cb2586bfe0d82d1c8c4b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16813
x-xss-protection: 0
server: cafe
etag: 6388606791587927312
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 91ms
91ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b82048fc0187b62e0f9187e682fc063abf4cb884aa7d3ecc533b81683f1c6c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66216
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1390358/ Frame 2FDB 58 KB
18 KB 267ms
216ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9fead708a7e919c843fc8d0334247d8ec7ddaa1577c3d37e9af8757729fcc680

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-amz-version-id: NTkceVhzHOhY9fjUzgGWKCJb145ta8.z
content-encoding: gzip
via: 1.1 varnish
date: Fri, 10 Feb 2023 22:39:01 GMT
x-amz-request-id: H8F320FRB6QR7C6T
age: 155
x-cache: HIT
x-amz-replication-status: COMPLETED
fastly-restarts: 1
x-amz-id-2: tBiO/6pJXOcYXi3QpI/ts7sIkbkVcQX/1qCxqIPqa0Vszrr67nsxRdYmasahGjsbp2oy0zeby94=
x-served-by: cache-mxp6966-MXP
content-length: 17976
last-modified: Thu, 09 Feb 2023 14:08:00 GMT
server: AmazonS3
x-timer: S1676068741.389329,VS0,VE201
etag: "c98f4a695d01eca6bb38dc1f9ee122ef"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 15
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 1625

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 131ms
131ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6138463bbdff1883c8b9d1b6efdc1c781c88c96e374453479e57fef68f0babe7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66098
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 103ms
103ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

aa2eb397807ac837d0676b46f5f40278100b8a2c81c71617117c189c839545e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66235
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H2 200 deviceAtlasLmb.min.js Show response
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame 2FDB 8 KB
3 KB 1013ms
859ms Script
application/javascript 2606:4700:4400::6812:2345
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2345 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:02 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com
p3p: CP="NON DSP COR LAW CONi TELi OUR SAM IND CNT"
x-xss-protection: 1; mode=block
last-modified: Fri, 21 May 2021 02:42:28 GMT
server: cloudflare
etag: W/"20fc-5c2ce02c32fd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 797856a25b8a0e1e-MXP
expires: Sat, 11 Feb 2023 02:39:02 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 129 KB
50 KB 113ms
113ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-966730890&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e1e147155c651b39126a949102e507c579a12c4971ccd451f002324a67561ed3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 50800
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 224ms
39ms Script
application/javascript 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 21:41:08 GMT
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
content-encoding: gzip
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
x-amz-request-id: KR0T2NFAZMMRV9B5
age: 3474
x-amz-server-side-encryption: AES256
x-amz-id-2: Tpiv16R0cZrg/Ehf8zLh+5qyw9KmUA9vDLu22NID64LxB6pdvXc9KL5AcTkW5oKd4sX6F/y2lU4=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 95ms
15ms Script
application/javascript 2a04:4e42:400::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Mon, 23 Jan 2023 21:56:14 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "03d5db9dfd00a5719bb4c9261e6fa1bb"
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7356

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 184 KB
66 KB 130ms
130ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

57afd9f73da755021d6057d3fcf16e265c156a03fdddef63fd043a1ebc416ea8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67748
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 132ms
132ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

97c8c40d489e15b86abc0872127a253b3bc36d452a6a880796efc33c5183fa88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 66343
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
65 KB 141ms
141ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

97015be89307cc8be17ebb6ae585c785dd849c17ffee312c0c15458a0a3dcccd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66359
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame 2FDB 30 KB
13 KB 137ms
55ms Script
application/javascript 54.192.87.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.87.248 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-87-248.ams50.r.cloudfront.net
Software: CloudFront /
Resource Hash: e2adb933987ecc1b413c1ad0d5024757f89f224afccc19d42f8c4c322aef7ea3

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: gzip
via: 1.1 0b3cd120321973f1462a42e82c43c1cc.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: AMS50-C1
x-cache: GeneratedResponse from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 13327
x-amz-cf-id: Ux2SgX1fAC3lxPXGWJt9lvwESp0CCStIWhFskWR2Xqju6osSDmCBlQ==

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ Frame 2FDB 1 KB
2 KB 396ms
64ms Script
text/javascript 92.123.37.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.123.37.164 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-37-164.deploy.static.akamaitechnologies.com
Software: MT3 457 2362390 master zrh-pixel-x27 config:1.0.0 /
Resource Hash: b38bb197f7d66aafc73e629759209db7f2dbfd573b0359830de4b83c6f0342ad

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:01 GMT
Server: MT3 457 2362390 master zrh-pixel-x27 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: text/javascript
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 1439
Expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H2 200 quickenloans_lander.js Show response
cdn1.decide.dev/tracking/ Frame 2FDB 737 B
940 B 593ms
481ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.decide.dev/tracking/quickenloans_lander.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:02 GMT
content-encoding: gzip
x-sp-metadata: HS256.CJarm58GEooBCiQyMDc0YzVjYi04NDg5LTRhNmMtYmJlYi03NDU0ZTg3OGQ3MWUQwLizor+z/AIaBgiFj5ufBiIPMTkyLjE0NS4xMjcuMjExKIqQAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJGNlZWQzYjBkLTQ3ZGItNDcyZC1hZTU5LTFkNmQwNGY1M2IxMBiWAyIaCAISFGNkczAyNi5tbDEuaHdjZG4ubmV0GAk=.6MKmNXSK+SyLIfCKLytNJE+9wlZcekbeRJQ2hXqjxYI=
last-modified: Mon, 29 Mar 2021 18:57:30 GMT
etag: "a28f0deba4086540f82dc5d6b5e47753"
x-hw: 1676068741.cds223.ml1.hn,1676068741.cds026.ml1.sc,1676068742.cds026.ml1.pr
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: https://decide.dev
content-length: 406

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 184 KB
66 KB 151ms
151ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a2a919451d0720be4243f3ceff9504a3b98d276f080ed4c85a381b9f4bb531e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67777
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H2 200 src Show response
c.pmsrv.co/v2/conversion/ Frame 2FDB 3 KB
4 KB 1310ms
888ms Script
text/javascript 2600:9000:234e:a600:a:8e7d:9900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:234e:a600:a:8e7d:9900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash: 3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:02 GMT
via: 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 3435
x-amz-cf-pop: OSL50-P1
x-amzn-requestid: 4bd62fc5-b315-4249-bb39-65398c7656aa
x-amzn-remapped-connection: close
x-powered-by: Express
x-cache: Miss from cloudfront
x-amz-apigw-id: AJQdFH_ryK4FVHg=
content-length: 3435
pragma: no-cache
etag: W/"d6b-sia6N7ids5ScRDuTaHkjdTsJcfc"
x-amzn-trace-id: Root=1-63e6c786-18e7888f4f86e95927344797;Sampled=0
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
x-amzn-remapped-date: Fri, 10 Feb 2023 22:39:02 GMT
x-amz-cf-id: 92MQlTgPFFTyf6hSW8vbSUlBOidVqhRpWZGZIEOfyVUX2xZZQUhHkw==
expires: -1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 177 KB
65 KB 161ms
160ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5de79c919845c3e1f00df99503ab9ceb38d76b70fb2a238306934ad879e1c24a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66142
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 21:04:51 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 58 KB
18 KB 488ms
147ms Script
text/javascript 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 72d540379bd4d0940250612c1f5ceecc3cc08afceb8b6b636fe3a9b585415ae0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: d1ef88ad-3539-4ed0-9958-ce07980575f7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 quickenloans_lander.js Show response
cdn1.lockerdomecdn.com/tracking/ Frame 2FDB 737 B
1 KB 753ms
452ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.lockerdomecdn.com/tracking/quickenloans_lander.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-f9ce7dd407c990d717ff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:02 GMT
content-encoding: gzip
x-amz-version-id: b6Hbc7yn6rhHZ8LkuNIH.XEX.WaaPfs1
last-modified: Mon, 29 Mar 2021 18:57:30 GMT
server: AmazonS3
x-sp-metadata: HS256.CJarm58GEooBCiRiYjM1Nzk5ZC0zYTM4LTRhMWMtYTFmMS1kYzQ1ZWRhZjQ5ZDYQkMK1or+z/AIaBgiFj5ufBiIPMTkyLjE0NS4xMjcuMjExKK6QAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDliMmRmMmExLTMzYTEtNDQ3OS04Y2Q2LTRkMzkzMzEzYWFiORiWAyIaCAISFGNkczAyMi5tbDEuaHdjZG4ubmV0GAk=.9gGpxPDJUhYBZQBTlFRvxAOozNP5eMWmedNx6W0vdGo=
x-amz-request-id: PKKEJJ2QAC320F0B
etag: "a28f0deba4086540f82dc5d6b5e47753"
x-hw: 1676068741.cds219.ml1.hn,1676068741.cds022.ml1.sc,1676068742.cds022.ml1.pr
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: https://lockerdome.com
content-length: 406
x-amz-id-2: t7TzMtFDrnad2vcsmn85jkuYYKFWpA/XO/5WS8GCNACMo5gFlVFsV/rZUrXFm+ZhKPxbaqRSxAw=

GET
H/1.1 200
OK iui3
s.amazon-adsystem.com/ Frame 2FDB 43 B
855 B 127ms
127ms Image
image/gif 209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3D6acaf65c-54d3-788f-2e4f-971d4f6b7886%26type%3D4%26m%3D1&ex-fch=416613&ex-src=https://home.rocketmortgage.com&ex-hargs=v%3D1.0%3Bc%3D584239139431578754%3Bp%3D6ACAF65C-54D3-788F-2E4F-971D4F6B7886

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 10 Feb 2023 22:39:01 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: WH8AEG2BJ7DTHBVJVS4D
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 hub Show response
api.pushnami.com/scripts/v1/ Frame A88F 2 KB
1 KB 31ms
31ms Document
text/html 13.227.219.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.219.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-63.ams54.r.cloudfront.net

Software

Resource Hash

2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 2185
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Fri, 10 Feb 2023 22:02:36 GMT
vary: accept-encoding
via: 1.1 2dc050ab05a5052054de7d000d6c5f50.cloudfront.net (CloudFront)
x-amz-cf-id: 9qICmp8xiB3lE5MxBrP1CApcu-4xu_6vgH3nen0K7vjPINl8RHUX_g==
x-amz-cf-pop: AMS54-C1
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
155 B 47ms
46ms XHR
text/plain 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
accept-language: it-IT,it;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
content-type: application/json

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 797856a19b6e0f66-MXP

POST
H2 200 psp Show response
psp.pushnami.com/api/ 2 B
230 B 145ms
144ms Fetch
text/html 3.216.213.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.213.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-213-114.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: it-IT,it;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://refinance.quickenloans.com
date: Fri, 10 Feb 2023 22:39:01 GMT
cache-control: no-cache
access-control-allow-credentials: true
content-encoding: gzip
vary: accept-encoding
content-type: text/html; charset=utf-8

OPTIONS
H2 200 psp
psp.pushnami.com/api/ Frame 0
0 393ms
118ms Preflight
application/json 3.216.213.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.213.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-213-114.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: key
access-control-allow-methods: POST
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: content-type, content-length, etag
access-control-max-age: 600
cache-control: no-cache
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Fri, 10 Feb 2023 22:39:01 GMT
vary: accept-encoding

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame D76D
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEO...
https://pixel.everesttech.net/1x1

128 B
691 B

46ms
46ms

Image
image/png

54.195.46.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.195.46.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-195-46-193.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:01 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 10 Feb 2023 22:39:01 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 1736491679707345 Show response
connect.facebook.net/signals/config/ Frame 2FDB 150 KB
42 KB 78ms
76ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1736491679707345?v=2.9.95&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1b0d7b4d07edcf9646c37389987b88701d3c117ce6694a9ade4387eefe1c8241

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 10 Feb 2023 22:39:01 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: T94VYx9J8ploAVNS02TaYpmOx1vdFU7q3QFl1q7s6Q6e4FKCFRxUPD7cZNBN8qfTBslHripVIXvAdp38rksbMA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
157 B 169ms
121ms Image
image/gif 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1676068741450&id=t2_1fj2owc9&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=8abe7e6e-f073-4ab2-af96-7560f2fee7cc&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_65e23bc4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
via: 1.1 varnish
server: Varnish
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 pd2259 Show response
pix.revjet.com/track/ Frame 2FDB 46 B
223 B 123ms
29ms Script
text/javascript 5.9.124.242
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd2259?__noscript=false&__cbf=revjet.callbacks.cb1676068741463&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.9.124.242 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.242.124.9.5.clients.your-server.de
Software: /
Resource Hash: 69afd3299d09702d89cb0246d290e0e0e3a6be8181af3f31fa1e81f8df8f2e01

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 pd3876 Show response
pix.revjet.com/track/ Frame 2FDB 46 B
222 B 95ms
32ms Script
text/javascript 5.9.124.242
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd3876?__noscript=false&__cbf=revjet.callbacks.cb1676068741464&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.9.124.242 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.242.124.9.5.clients.your-server.de
Software: /
Resource Hash: 5d05e30df8e75fd1e283107e1bbc7aef496ce49da3d82a7ab9f128b2bb68beae

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-length: 46
content-type: text/javascript

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame D76D
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
691 B

51ms
50ms

Image
image/png

54.195.46.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.195.46.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-195-46-193.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:01 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 10 Feb 2023 22:39:01 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 inferredevents.js Show response
connect.facebook.net/signals/plugins/ Frame 2FDB 72 KB
22 KB 25ms
25ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/inferredevents.js?v=2.9.95

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5849e07d0d6cbb144829b98da75fda4a8eb3fc2b5749d48cc94bb170db54859a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Fri, 10 Feb 2023 22:39:01 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 21972
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 6X4C1tH+bIccqHyDXXPuC8hSfq+Mo+YmXdbLr4tab3iVjmclWDZXIcRuWy8rXHXWjeSg+FnBXhvBCZf+VjtlIA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 2 KB
1 KB 101ms
101ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1676068741595&cv=11&fst=1676068741595&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=EVlnCPzHxqoBEIrJ_MwD&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&value=1&currency_code=USD&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38485d78ca251b2506cd533def2ea0a87ed1dd9cae5be2b826a112155ffcad34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1054
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 2 KB
1009 B 99ms
99ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1676068741607&cv=11&fst=1676068741607&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ce5ee0de21c180e9d0e6598d0b61c4cd35a1a4c471d65ee1d158245179de55d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 129 KB
50 KB 65ms
64ms Script
application/javascript 2a00:1450:400d:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

40b4896dbb049a25165dd2966a14caa87b96bf87f8a0384a5200b50ce5320bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 50843
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 10 Feb 2023 22:39:01 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 2 KB
1009 B 68ms
68ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1676068741633&cv=11&fst=1676068741633&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-700319321

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32c0499ec15eacddd1f4f338497081a62ac957ccd9467356d7db7010c2044b3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 2 KB
1011 B 68ms
68ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1676068741659&cv=11&fst=1676068741659&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-813495030

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a71b7de2154e5cbb740cd0e6b9c5e072091bf9c59996cb22e12221dba408f790

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 987
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/ 2 KB
1011 B 99ms
99ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/?random=1676068741688&cv=11&fst=1676068741688&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb99e907557fb0825f8e9dc903de4fab4e47052712f7808c3284ea77611bce90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 987
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/ 2 KB
1008 B 98ms
98ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/?random=1676068741713&cv=11&fst=1676068741713&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-755089552

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21bbf9b7087d31830814515667f8525013f0a1f5af429f05bf1f1f249932fd23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 984
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 2 KB
1010 B 129ms
129ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1676068741735&cv=11&fst=1676068741735&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6875a0375c7dd31922104a3c1a8eaf626e0aabdc0a62cf581e2c6a76a3cb6627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 986
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 2 KB
1008 B 98ms
98ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1676068741760&cv=11&fst=1676068741760&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-865435318

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08a22b8504ffe12073a04088acad2817650df38a0dfa7aa77ec818c17a21a164

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 984
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame D76D
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

47ms
47ms

Image
image/png

54.195.46.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.195.46.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-195-46-193.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:01 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 10 Feb 2023 22:39:01 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 2 KB
1008 B 102ms
102ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1676068741783&cv=11&fst=1676068741783&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-857412364

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9e5ad49628338eb99371dd56f4b864859f24fce37030d983f0ad70eeffe489e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 984
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

j Show response
rp4.liadm.com/ Frame 2FDB
Redirect Chain

https://rp.liadm.com/j?dtstmp=1676068741794&aid=a-06d7&se=e30&duid=ddc3c751f117--01gryqprcnhp92kzqhwmbfq9v4&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%...
https://rp4.liadm.com/j?dtstmp=1676068741794&aid=a-06d7&se=e30&duid=ddc3c751f117--01gryqprcnhp92kzqhwmbfq9v4&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320...

13 B
552 B

414ms
112ms

XHR
application/json

54.204.59.49
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1676068741794&aid=a-06d7&se=e30&duid=ddc3c751f117--01gryqprcnhp92kzqhwmbfq9v4&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&ext_s_ecid=MCMID%7C57778890489945166260730687328887345905&wpn=lc-bundle&i6=MjAwMTphYzg6MjQ6NDQ6OjEy&n3pc=true

Requested by

Protocol

Server

54.204.59.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-59-49.compute-1.amazonaws.com

Software

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:02 GMT
x-pixel-event-id: 17673fe6-63cb-49c5-9240-87f2d92ad57f
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: DENY
vary: Origin
content-type: application/json
request-time: 0
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: d5e30cff326f5378
content-length: 13
x-xss-protection: 1; mode=block

Redirect headers

date: Fri, 10 Feb 2023 22:39:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
vary: Origin
location: https://rp4.liadm.com/j?dtstmp=1676068741794&aid=a-06d7&se=e30&duid=ddc3c751f117--01gryqprcnhp92kzqhwmbfq9v4&tna=v2.6.0&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&ext_s_ecid=MCMID%7C57778890489945166260730687328887345905&wpn=lc-bundle&i6=MjAwMTphYzg6MjQ6NDQ6OjEy&n3pc=true
access-control-allow-origin: https://refinance.quickenloans.com
request-time: 0
access-control-allow-credentials: true
trace-id: 7ae7bfcab48522cc
content-length: 0
x-xss-protection: 1; mode=block

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/ 2 KB
1011 B 129ms
129ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/?random=1676068741805&cv=11&fst=1676068741805&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

562c5f835123b6d33470793c34ab66067a79bf218555963f7824a6fe3886faa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 987
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10182570.json Show response
s.yimg.com/wi/config/ 46 B
688 B 223ms
146ms XHR
application/json 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10182570.json

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:02 GMT
x-amz-version-id: LPMEJDD79ONPE78nruFm6Hgf4VOe0yiw
x-content-type-options: nosniff
strict-transport-security: max-age=15552000
x-amz-request-id: A93E7Y0PQ6WQCMRT
age: 2
x-amz-server-side-encryption: AES256
content-length: 46
x-amz-id-2: s1L8+i8WC6jkC8TVc+mk/wIa9J82Y+EXrMfyM+jrLAHBU4YknboG6KXA40oARKXqlVjzaAt1dFVlEPZ8iQpX9A==
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sun, 28 May 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Fri, 22 Apr 2022 01:01:34 GMT
server: ATS
etag: "f31aca15ae5b24f87583e3de167c9828"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 2FDB 0
60 B 62ms
47ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1676068741830&ref=null&cv=20230208-6-RELEASE&tos=2&ssd=1&scd=0&mrir=u&vi=1676068741826
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-vcl-time-ms: 29
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
via: 1.1 varnish
x-served-by: cache-mxp6966-MXP
server: nginx
x-timer: S1676068742.855290,VS0,VE29
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 2FDB 0
276 B 51ms
46ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1676068741841&ref=null&cv=20230208-6-RELEASE&tos=12&ssd=1&scd=0&mrir=u&vi=1676068741826
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-vcl-time-ms: 26
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
via: 1.1 varnish
x-served-by: cache-mxp6966-MXP
server: nginx
x-timer: S1676068742.855289,VS0,VE26
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 2FDB 0
57 B 47ms
47ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1676068741845&ref=null&cv=20230208-6-RELEASE&tos=17&ssd=1&scd=0&mrir=u&vi=1676068741826
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-vcl-time-ms: 26
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
via: 1.1 varnish
x-served-by: cache-mxp6966-MXP
server: nginx
x-timer: S1676068742.855290,VS0,VE26
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 /
www.facebook.com/tr/ Frame 2FDB 0
185 B 190ms
29ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&rl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&if=true&ts=1676068741856&sw=1600&sh=1200&v=2.9.95&r=stable&ec=0&o=28&cs_est=true&fbp=fb.1.1676068741855.743830802&it=1676068741445&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 10 Feb 2023 22:39:02 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 68ms
67ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1676068741595&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=EVlnCPzHxqoBEIrJ_MwD&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&value=1&currency_code=USD&data=event%3Dconversion&fmt=3&is_vtc=1&random=2741321360&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/966730890/ 42 B
64 B 66ms
65ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/966730890/?random=1676068741595&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&label=EVlnCPzHxqoBEIrJ_MwD&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&value=1&currency_code=USD&data=event%3Dconversion&fmt=3&is_vtc=1&random=2741321360&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/700319321/ 42 B
64 B 68ms
67ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/700319321/?random=1676068741633&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2192939968&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/700319321/ 42 B
64 B 69ms
68ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/700319321/?random=1676068741633&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2192939968&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 68ms
67ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1676068741607&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=550210690&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/966730890/ 42 B
64 B 66ms
65ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/966730890/?random=1676068741607&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=550210690&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/813495030/ 42 B
64 B 68ms
68ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/813495030/?random=1676068741659&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2402840744&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/813495030/ 42 B
64 B 66ms
66ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/813495030/?random=1676068741659&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2402840744&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK iframe Show response
pixel.mathtag.com/sync/ Frame 32FE 677 B
1 KB 60ms
60ms Document
text/html 92.123.37.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=218b63e6-c786-4700-8e46-0ac6cffd4e6b&no_iframe=1&mt_adid=245296&source=mathtag
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.123.37.164 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-37-164.deploy.static.akamaitechnologies.com
Software: MT3 457 2362390 master zrh-pixel-x27 config:1.0.0 /
Resource Hash: 3ef64e4a0001cd55211fff6bd306290f29c7482a6006d070ee21e52484b7ef22

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: it-IT,it;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 677
Content-Type: text/html
Date: Fri, 10 Feb 2023 22:39:01 GMT
Expires: Fri, 10 Feb 2023 22:39:00 GMT
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 457 2362390 master zrh-pixel-x27 config:1.0.0

GET
H2 200 main.57992c41.js Show response
s.pinimg.com/ct/lib/ Frame 2FDB 56 KB
20 KB 146ms
146ms Script
application/javascript 2a02:26f0:dc:39c::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.57992c41.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:dc:39c::1931 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fdb328bff496e603b8fbd56d9b59114b5e4aeb7c5cf7a550563e5dc95cc25f33

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

akamai-x-true-ttl: 1209600
content-encoding: gzip
x-cdn: akamai
etag: "a2989b2a8a5c2cde42b6a5ab4aadbe8c"
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 19688

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/ 2 KB
1009 B 99ms
98ms Script
text/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/?random=1676068741873&cv=11&fst=1676068741873&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&auid=275445841.1676068741&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c5ed4f2b570bbd968510dd64341bcae99cf4e4801e1b65471911613d994bcf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/755089552/ 42 B
64 B 64ms
64ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/755089552/?random=1676068741713&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=656493312&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/755089552/ 42 B
64 B 66ms
65ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/755089552/?random=1676068741713&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=656493312&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 2FDB 0
480 B 103ms
59ms Image
image/gif 92.123.37.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.123.37.164 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-37-164.deploy.static.akamaitechnologies.com
Software: MT3 457 2362390 master zrh-pixel-x14 config:1.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:01 GMT
Server: MT3 457 2362390 master zrh-pixel-x14 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866176763/ 42 B
64 B 67ms
66ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866176763/?random=1676068741688&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3991073178&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/10866176763/ 42 B
64 B 66ms
65ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/10866176763/?random=1676068741688&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3991073178&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame D76D
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

128 B
691 B

48ms
48ms

Image
image/png

54.195.46.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.195.46.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-195-46-193.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:02 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 10 Feb 2023 22:39:02 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 /
www.google.com/pagead/1p-user-list/865435318/ 42 B
64 B 65ms
65ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865435318/?random=1676068741760&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1052700311&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/865435318/ 42 B
64 B 67ms
67ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/865435318/?random=1676068741760&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1052700311&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866179376/ 42 B
64 B 65ms
65ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866179376/?random=1676068741735&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3260224354&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/10866179376/ 42 B
64 B 64ms
64ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/10866179376/?random=1676068741735&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3260224354&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/857412364/ 42 B
64 B 67ms
67ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/857412364/?random=1676068741783&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=857102490&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/857412364/ 42 B
64 B 64ms
64ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/857412364/?random=1676068741783&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=857102490&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 32FE 0
480 B 82ms
59ms Image
image/gif 92.123.37.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=218b63e6-c786-4700-8e46-0ac6cffd4e6b&no_iframe=1&mt_adid=245296&source=mathtag
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.123.37.164 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-37-164.deploy.static.akamaitechnologies.com
Software: MT3 457 2362390 master zrh-pixel-x26 config:1.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://pixel.mathtag.com/sync/iframe?mt_uuid=218b63e6-c786-4700-8e46-0ac6cffd4e6b&no_iframe=1&mt_adid=245296&source=mathtag
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:02 GMT
Server: MT3 457 2362390 master zrh-pixel-x26 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Fri, 10 Feb 2023 22:39:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10910338944/ 42 B
64 B 66ms
65ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10910338944/?random=1676068741805&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1496698143&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/10910338944/ 42 B
64 B 67ms
66ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/10910338944/?random=1676068741805&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1496698143&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:01 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/848879802/ 42 B
64 B 65ms
64ms Image
image/gif 2a00:1450:400d:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848879802/?random=1676068741873&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2965052601&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:808::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.it/pagead/1p-user-list/848879802/ 42 B
64 B 65ms
65ms Image
image/gif 2a00:1450:400d:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.it/pagead/1p-user-list/848879802/?random=1676068741873&cv=11&fst=1676066400000&bg=ffffff&guid=ON&async=1&gtm=45be3280&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&tiba=QuickenLoans&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2965052601&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame D76D
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WUBiSGhBQUFCSm45QWdMNQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://pixel.everesttech.net/1x1

128 B
691 B

48ms
47ms

Image
image/png

54.195.46.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.195.46.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-195-46-193.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:02 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Fri, 10 Feb 2023 22:39:02 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 / Show response
ct.pinterest.com/user/ Frame 2FDB 539 B
763 B 216ms
60ms XHR
application/json 151.101.192.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/user/?tid=2620075802369&pd=%7B%22em%22%3A%22e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%22%7D&cb=1676068742031&dep=2%2CPAGE_LOAD
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.57992c41.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.192.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 730de59300e6103732a2168bdc9742af79a9abfe5995c6d3f3f3e96fd7c99d97

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pin-unauth: dWlkPU5qRmlOR0l5TlRNdFlUTm1ZaTAwT1RjNExUZzFOVEl0Wm1NeE5HSTVNR1V6TXpKag
pragma: no-cache
content-encoding: gzip
referrer-policy: origin
date: Fri, 10 Feb 2023 22:39:02 GMT
x-cdn: fastly
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
x-pinterest-rid: 1234084079249115
content-length: 375
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
ct.pinterest.com/v3/ Frame 2FDB 35 B
96 B 221ms
66ms Image
image/gif 151.101.192.84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ct.pinterest.com/v3/?tid=2620075802369&pd=%7B%22em%22%3A%22e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df%22%2C%22ref%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df%22%2C%22if%22%3Atrue%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%2257992c41%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1676068742032
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.192.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
referrer-policy: origin
x-cdn: fastly
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 3
x-pinterest-rid: 6381094190229297
content-length: 35
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
632 B 229ms
55ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2010%20Feb%202023%2022%3A39%3A02%20GMT&n=0&b=QuickenLoans&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D771%26pkey2%3D690320%26pkey3%3Dec83edb2c8974ed385ceedce875732df%26sourceid%3Dlmb-54867-113582-771%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D771%26_ef_transaction_id%3Dec83edb2c8974ed385ceedce875732df&enc=UTF-8&yv=1.13.0&tagmgr=gtm%2Cadobe

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Fri, 10 Feb 2023 22:39:02 GMT

GET
H2

204

v1
ads.yahoo.com/cms/ Frame D76D
Redirect Chain

https://cm.everesttech.net/cm/yh
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y&sigv=1&esig=1~f274c25068799de3e5cf5e117c9b4ce61fafaa03

0
47 B

227ms
36ms

Image
text/plain

2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y&sigv=1&esig=1~f274c25068799de3e5cf5e117c9b4ce61fafaa03

Protocol

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:02 GMT
strict-transport-security: max-age=15552000
cache-control: no-store
x-content-type-options: nosniff
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=Y&sigv=1&esig=1~f274c25068799de3e5cf5e117c9b4ce61fafaa03
Date: Fri, 10 Feb 2023 22:39:02 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D76D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUBiSGhBQUFCSm45QWdMNQ==

170 B
188 B

46ms
45ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUBiSGhBQUFCSm45QWdMNQ==

Protocol

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-mxp6963-MXP
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1676068742.416772,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUBiSGhBQUFCSm45QWdMNQ==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 click Show response
www.lmbahsj2.com/sdk/ 85 B
440 B 176ms
175ms Fetch
application/json 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/sdk/click?effp=8d28fbb2d1bdc7831dcb1e65b09ba63e&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df&oid=9&affid=771&__cc=&async=json
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9080f68b5d9a7780cb302adbd72adda14bed2dfc043a8ffd62a0b5a506fe48c8

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 22:39:02 GMT
via: 1.1 google
server: nginx
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
x-eflow-request-id: ea57d562-c4fb-4a40-93de-92a254db9592
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame D76D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y@bHhAAABJn9AgL5&expires=90

0
239 B

118ms
25ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y@bHhAAABJn9AgL5&expires=90
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 28e1e7d28d06b07ec669bc9e43057b8e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-mxp6963-MXP
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1676068742.416734,VS0,VE0
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=Y@bHhAAABJn9AgL5&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D76D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y@bHhAAABJn9AgL5
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y@bHhAAABJn9AgL5&C=1

43 B
766 B

25ms
25ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y@bHhAAABJn9AgL5&C=1
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 10 Feb 2023 22:39:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 10 Feb 2023 22:39:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=88&external_user_id=Y@bHhAAABJn9AgL5&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame D76D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=Y@bHhAAABJn9AgL5
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY%40bHhAAABJn9AgL5

43 B
1 KB

53ms
52ms

Image
image/gif

185.89.210.46
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY%40bHhAAABJn9AgL5

Protocol

HTTP/1.1

Server

185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 10 Feb 2023 22:39:02 GMT
AN-X-Request-Uuid: 3b49abbb-e6fb-4133-9ab9-1e9cdbbe35e5
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 192.145.127.211; 192.145.127.211; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 10 Feb 2023 22:39:02 GMT
AN-X-Request-Uuid: de6d8e3f-9c03-4261-8a09-215351f3779c
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DY%40bHhAAABJn9AgL5
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 192.145.127.211; 192.145.127.211; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame D76D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y@bHhAAABJn9AgL5

43 B
273 B

115ms
36ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y@bHhAAABJn9AgL5
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by: cache-mxp6963-MXP
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1676068743.670990,VS0,VE0
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=Y@bHhAAABJn9AgL5
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame D76D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y@bHhAAABJn9AgL5

1 B
453 B

211ms
39ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y@bHhAAABJn9AgL5
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Fri, 10 Feb 2023 22:39:02 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by: cache-mxp6963-MXP
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1676068743.775007,VS0,VE0
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Y@bHhAAABJn9AgL5
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

POST
H2 200 track Show response
trc.pushnami.com/api/push/ 2 B
168 B 172ms
171ms Fetch
text/html 54.204.164.0
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.204.164.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-204-164-0.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: it-IT,it;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Fri, 10 Feb 2023 22:39:03 GMT
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
content-length: 2
content-type: text/html; charset=utf-8

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 377ms
113ms Preflight 54.204.164.0
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.204.164.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-204-164-0.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Fri, 10 Feb 2023 22:39:03 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame D76D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y@bHhAAABJn9AgL5&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y@bHhAAABJn9AgL5&img=1&__user_check__=1&sync_id=b806e641-a993-11ed-88f5-107c10e90506

43 B
548 B

47ms
46ms

Image
image/gif

185.94.180.126
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Y@bHhAAABJn9AgL5&img=1&__user_check__=1&sync_id=b806e641-a993-11ed-88f5-107c10e90506
Protocol: HTTP/1.1
Server: 185.94.180.126 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Fri, 10 Feb 2023 22:39:03 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 39
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 10 Feb 2023 22:39:03 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=6409&uid=Y@bHhAAABJn9AgL5&img=1&__user_check__=1&sync_id=b806e641-a993-11ed-88f5-107c10e90506
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 85
Connection: keep-alive
Content-Length: 0

GET
H2

200

b.php
www.facebook.com/fr/ Frame D76D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y@bHhAAABJn9AgL5&t=2592000&o=0

43 B
687 B

62ms
61ms

Image
image/gif

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y@bHhAAABJn9AgL5&t=2592000&o=0

Protocol

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 14:39:03 PST
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
pragma: public
x-fb-debug: bmwO3E543XeJ4DHOvoctHZ2jH1TcvdbjLL2Mp/fWEyMDY8VsJRnXvFq7laLmaJauXNG1vR9qNn8UpiVtgHhr9Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: image/gif
origin-agent-cluster: ?0
cache-control: public, max-age=0
priority: u=3,i
expires: Fri, 10 Feb 2023 14:39:03 PST

Redirect headers

x-served-by: cache-mxp6963-MXP
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1676068743.977779,VS0,VE0
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=Y@bHhAAABJn9AgL5&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 2FDB 0
84 B 44ms
43ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=1568&scd=0&ssd=1&est=1676068741828&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1676068743397&mrir=u&vi=1676068741826&ref=null&cv=20230208-6-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-vcl-time-ms: 27
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:03 GMT
via: 1.1 varnish
x-served-by: cache-mxp6966-MXP
server: nginx
x-timer: S1676068743.408924,VS0,VE27
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 2FDB 0
57 B 44ms
43ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=1570&scd=0&ssd=1&est=1676068741828&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1676068743398&mrir=u&vi=1676068741826&ref=null&cv=20230208-6-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-vcl-time-ms: 27
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:03 GMT
via: 1.1 varnish
x-served-by: cache-mxp6966-MXP
server: nginx
x-timer: S1676068743.411110,VS0,VE27
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 2FDB 0
56 B 45ms
44ms XHR
image/gif 151.101.193.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=1572&scd=0&ssd=1&est=1676068741828&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1676068743400&mrir=u&vi=1676068741826&ref=null&cv=20230208-6-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: it-IT,it;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

x-vcl-time-ms: 27
pragma: no-cache
date: Fri, 10 Feb 2023 22:39:03 GMT
via: 1.1 varnish
x-served-by: cache-mxp6966-MXP
server: nginx
x-timer: S1676068743.412064,VS0,VE27
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: https://refinance.quickenloans.com
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

Verdicts & Comments Add Verdict or Comment

117 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

60 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 09:35:55	Name: X-AB Value: 0d6e407936704bd380072f5891d28b0e
refinance.quickenloans.com/	1970-01-20 18:20:04	Name: visitorId Value: 7255952e-3d83-4b39-a09b-1cdb8f1ec89b
refinance.quickenloans.com/	1970-01-20 09:44:33	Name: contentTarget Value: %7B%22sourceId%22%3A%22lmb-54867-113582-771%22%7D
.lowermybills.com/	1970-01-20 09:34:30	Name: __cf_bm Value: v7.0fxjmTdGGA5e7C90YRYaFjRDcoqkOkT4RpMtt0Hc-1676068739-0-AX6VGyveY/QoGVwOK5mYztsAR26Pnh8FEIBNhW/vXSQF5XeDFEU59iCAvS5PkiKk5j1TLrRR8oXjCiNMHTURJYk=
.quickenloans.com/	1969-12-31 23:59:59	Name: at_check Value: true
refinance.quickenloans.com/	1970-01-20 09:35:55	Name: DAPROPS Value: "sjs.webGlRenderer:Intel Iris OpenGL Engine\|bjs.accessDom:1\|bcookieSupport:1\|bcss.animations:1\|bcss.columns:1\|bcss.transforms:1\|bcss.transitions:1\|sdevicePixelRatio:1\|idisplayColorDepth:24\|bflashCapable:0\|bhtml.audio:1\|bhtml.canvas:1\|bhtml.inlinesvg:1\|bhtml.svg:1\|bhtml.video:1\|bjs.applicationCache:0\|bjs.deviceMotion:1\|bjs.deviceOrientation:0\|bjs.geoLocation:1\|bjs.indexedDB:1\|bjs.json:1\|bjs.localStorage:1\|bjs.modifyCss:1\|bjs.modifyDom:1\|bjs.querySelector:1\|bjs.sessionStorage:1\|bjs.supportBasicJavaScript:1\|bjs.supportConsoleLog:1\|bjs.supportEventListener:1\|bjs.supportEvents:1\|bjs.touchEvents:0\|bjs.webGl:1\|bjs.webSockets:1\|bjs.webSqlDatabase:0\|bjs.webWorkers:1\|bjs.xhr:1\|buserMedia:1\|bjs.battery:0"
refinance.quickenloans.com/	1970-01-20 09:34:29	Name: _dd_s Value: rum=0&expire=1676069640611
.demdex.net/	1970-01-20 13:53:40	Name: demdex Value: 57926570742250399620751931607527708217
.everesttech.net/	1970-01-20 18:20:04	Name: everest_g_v2 Value: g_surferid~Y@bHhAAABJn9AgL5
.everesttech.net/	1969-12-31 23:59:59	Name: everest_session_v2 Value: Y@bHhAAABJn9AgL5
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
.quickenloans.com/	1970-01-20 11:44:04	Name: _gcl_au Value: 1.1.275445841.1676068741
.refinance.quickenloans.com/	1969-12-31 23:59:59	Name: Value: GA1.3.1624755911.1676068741
.refinance.quickenloans.com/	1970-01-20 09:35:55	Name: _gid Value: GA1.3.1448349879.1676068741
.refinance.quickenloans.com/	1970-01-20 09:34:28	Name: _gat_gtag_UA_3849768_74 Value: 1
.quickenloans.com/	1970-01-20 19:10:28	Name: _ga_WQ7TGZQSWQ Value: GS1.1.1676068740.1.0.1676068740.0.0.0
.quickenloans.com/	1970-01-20 19:10:28	Name: _ga Value: GA1.1.1624755911.1676068741
refinance.quickenloans.com/	1970-01-20 09:44:33	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNmJiODIwNDItOWJmZC01MWEwLWE2OWItMzJlZGYyZDY2ZThiIiwidmlzaXRvcklkIjoiNzI1NTk1MmUtM2Q4My00YjM5LWEwOWItMWNkYjhmMWVjODliIiwic2Vzc2lvbklkIjoiOTFiYzZjNGQtM2VhNC00ODUxLWE4ODAtOTgyNDA1ZjlhZGE0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiI3NzEiLCJwa2V5MiI6IjY5MDMyMCIsInBrZXkzIjoiZWM4M2VkYjJjODk3NGVkMzg1Y2VlZGNlODc1NzMyZGYiLCJzb3VyY2VJZCI6ImxtYi01NDg2Ny0xMTM1ODItNzcxIiwic2lkIjoiOSIsImNtcGlkIjoiOSIsImNydGlkIjoiIiwib2lkIjoiOSIsImFmZmlkIjoiNzcxIiwiX2VmX3RyYW5zYWN0aW9uX2lkIjoiZWM4M2VkYjJjODk3NGVkMzg1Y2VlZGNlODc1NzMyZGYiLCJhZ2UiOm51bGwsImRldmljZSI6bnVsbCwiZm9yY2VOYW1lcyI6bnVsbCwiZm9yY2VJcCI6bnVsbCwiZm9yY2VUZXN0SWRzIjpudWxsLCJpbnF1aXJ5SWQiOm51bGwsImlucXVpcnlTaWduYXR1cmUiOm51bGwsImlzVGVzdCI6bnVsbCwibGV2ZWxPZkVkdWNhdGlvbiI6bnVsbCwibW9pZCI6bnVsbCwicHJvcGVydHlTdGF0ZUNvZGUiOm51bGwsInJlc29sdXRpb24iOiIiLCJ0dFRyYWNlSWQiOm51bGwsInByb3ZpZGVySWQiOm51bGwsInFscyI6bnVsbCwic3RpZCI6bnVsbCwib3ZrZXkiOm51bGwsIm92cmF3IjpudWxsLCJvdm10YyI6bnVsbCwibW9ydGdhZ2VCYWxhbmNlUmFuZ2UiOm51bGwsImRhdGVOb3ciOjE2NzYwNjg3NDA1MDQsInJhbmRvbU51bWJlciI6MTA0NzQsIm1hcmtldGluZ09mZmVySWQiOm51bGwsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDIzLTAyLTEwVDIyOjM5OjAwLjYwNVoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL3JlZmluYW5jZS5xdWlja2VubG9hbnMuY29tIiwicHJlc2VudGF0aW9uTmFtZSI6IjI4MzI0OTNfTVNRTF9MUkVfTFBfQ09OVFJPTF8wOS0xNC0yMiIsImRlc3RpbmF0aW9uVXJsIjoiaHR0cHM6Ly9yZWZpbmFuY2UucXVpY2tlbmxvYW5zLmNvbS8_cGtleTE9NzcxJnBrZXkyPTY5MDMyMCZwa2V5Mz1lYzgzZWRiMmM4OTc0ZWQzODVjZWVkY2U4NzU3MzJkZiZzb3VyY2VpZD1sbWItNTQ4NjctMTEzNTgyLTc3MSZzaWQ9OSZjbXBpZD05JmNydGlkPSZvaWQ9OSZhZmZpZD03NzEmX2VmX3RyYW5zYWN0aW9uX2lkPWVjODNlZGIyYzg5NzRlZDM4NWNlZWRjZTg3NTczMmRmIiwidmVydGljYWxOYW1lIjoiTVNRTF9MUkVfTEFORElORyIsInJlZmVycmluZ1VyaSI6IiIsImZsb3dJZCI6Ik1TUUxfTFJFX0xBTkRJTkdfVkVSVElDQUxfRkxPV18xIiwidGVzdElkIjoyMTEwMTg0LCJkYVZhbCI6InNqcy53ZWJHbFJlbmRlcmVyOkludGVsIElyaXMgT3BlbkdMIEVuZ2luZXxianMuYWNjZXNzRG9tOjF8YmNvb2tpZVN1cHBvcnQ6MXxiY3NzLmFuaW1hdGlvbnM6MXxiY3NzLmNvbHVtbnM6MXxiY3NzLnRyYW5zZm9ybXM6MXxiY3NzLnRyYW5zaXRpb25zOjF8c2RldmljZVBpeGVsUmF0aW86MXxpZGlzcGxheUNvbG9yRGVwdGg6MjR8YmZsYXNoQ2FwYWJsZTowfGJodG1sLmF1ZGlvOjF8Ymh0bWwuY2FudmFzOjF8Ymh0bWwuaW5saW5lc3ZnOjF8Ymh0bWwuc3ZnOjF8Ymh0bWwudmlkZW86MXxianMuYXBwbGljYXRpb25DYWNoZTowfGJqcy5kZXZpY2VNb3Rpb246MXxianMuZGV2aWNlT3JpZW50YXRpb246MHxianMuZ2VvTG9jYXRpb246MXxianMuaW5kZXhlZERCOjF8YmpzLmpzb246MXxianMubG9jYWxTdG9yYWdlOjF8YmpzLm1vZGlmeUNzczoxfGJqcy5tb2RpZnlEb206MXxianMucXVlcnlTZWxlY3RvcjoxfGJqcy5zZXNzaW9uU3RvcmFnZToxfGJqcy5zdXBwb3J0QmFzaWNKYXZhU2NyaXB0OjF8YmpzLnN1cHBvcnRDb25zb2xlTG9nOjF8YmpzLnN1cHBvcnRFdmVudExpc3RlbmVyOjF8YmpzLnN1cHBvcnRFdmVudHM6MXxianMudG91Y2hFdmVudHM6MHxianMud2ViR2w6MXxianMud2ViU29ja2V0czoxfGJqcy53ZWJTcWxEYXRhYmFzZTowfGJqcy53ZWJXb3JrZXJzOjF8YmpzLnhocjoxfGJ1c2VyTWVkaWE6MXxianMuYmF0dGVyeTowIiwiZGFWZXIiOiIxLjYiLCJjbGllbnRJcEFkZHJlc3MiOiIyMDAxOmFjODoyNDo0NDo6MTIiLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTEwLjAuNTQ4MS43NyBTYWZhcmkvNTM3LjM2IiwiYm90IjpmYWxzZSwiaWF0IjoxNjc2MDY4NzQwfQ.RfOkR1ZqWhvqCNYNFbnqOQQlH8Qu3UMvH3MaldmXbklb8IG41_tFpViBNxKOG3MvvwfoFfw4NkcXLDFj8iyzc230OMkna7b2-LwlIuNNUnPuoTF-u0EcTMP6gQp3ewxIw6gi8h16FhpiFBSb-aNB7FN0yIys0CRy5Wd-ycT3Bdg
.quickenloans.com/	1970-01-20 19:10:28	Name: s_ecid Value: MCMID%7C57778890489945166260730687328887345905
.everesttech.net/	1970-01-20 10:19:07	Name: ev_sync_dd Value: 20230210
.quickenloans.com/	1970-01-20 19:10:28	Name: mbox Value: session#9e6483178c9c4825a8c7beecb2969605#1676070602\|PC#9e6483178c9c4825a8c7beecb2969605.37_0#1739313542
.quickenloans.com/	1970-01-20 19:10:28	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19399%7CMCMID%7C57778890489945166260730687328887345905%7CMCAAMLH-1676673541%7C6%7CMCAAMB-1676673541%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1676075941s%7CNONE%7CMCAID%7CNONE%7CMCCIDH%7C-1516672819%7CvVersion%7C5.4.0
.quickenloans.com/	1970-01-20 19:10:28	Name: s_v12 Value: 1676068741142
.quickenloans.com/	1970-01-20 09:34:30	Name: s_v12_s Value: First%20Visit
.quickenloans.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.doubleclick.net/	1970-01-20 18:56:04	Name: IDE Value: AHWqTUmsGd9zZrm2Qme6AsvT0eorvxH3DX8rC3NW2EYZkPq2RZ3oNqSvSTWTyLQeXZE
.amazon-adsystem.com/	1970-01-20 15:09:59	Name: ad-id Value: A47hgvmERkQ9qp3tNVbxxOg
.amazon-adsystem.com/	1970-01-20 19:10:28	Name: ad-privacy Value: 0
.agkn.com/	1970-01-20 18:20:04	Name: ab Value: 0001%3A1X9YdtCxmIwf1zsOTxYkmhQ2vUb7nOVU
.dpm.demdex.net/	1970-01-20 13:53:40	Name: dpm Value: 57926570742250399620751931607527708217
.quickenloans.com/	1970-01-20 11:44:04	Name: _rdt_uuid Value: 1676068741449.8abe7e6e-f073-4ab2-af96-7560f2fee7cc
.quickenloans.com/	1969-12-31 23:59:59	Name: _schn Value: _k95691
.quickenloans.com/	1970-01-20 19:04:15	Name: _scid Value: de5effb9-6866-406c-ab88-81b75528af84
.quickenloans.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .quickenloans.com
.quickenloans.com/	1970-01-20 19:10:28	Name: _lc2_fpi Value: ddc3c751f117--01gryqprcnhp92kzqhwmbfq9v4
.everesttech.net/	1970-01-20 10:19:07	Name: ev_sync_ax Value: 20230210
.revjet.com/	1970-01-20 19:10:28	Name: trx Value: 4763524202978042452
.mathtag.com/	1970-01-20 19:00:23	Name: uuid Value: 218b63e6-c786-4700-8e46-0ac6cffd4e6b
.quickenloans.com/	1970-01-20 11:44:04	Name: _fbp Value: fb.1.1676068741855.743830802
.mathtag.com/	1970-01-20 10:17:40	Name: mt_misc Value: mt_bt:1
.everesttech.net/	1970-01-20 10:19:07	Name: ev_sync_yh Value: 20230210
.liadm.com/	1970-01-20 19:10:28	Name: lidid Value: 95a4f646-3291-4d9d-be10-aed437f19f1b
.refinance.quickenloans.com/	1970-01-20 18:20:04	Name: _pin_unauth Value: dWlkPU5qRmlOR0l5TlRNdFlUTm1ZaTAwT1RjNExUZzFOVEl0Wm1NeE5HSTVNR1V6TXpKag
.yahoo.com/	1970-01-20 18:20:26	Name: A3 Value: d=AQABBIbH5mMCEK2eB0op-f9ksaEIElxXFhMFEgEBAQEZ6GPwYwAAAAAA_eMAAA&S=AQAAAgj27xtnDd5PJdgy8wIKJic
.mortgage.quickenloans.com/	1970-01-20 09:34:30	Name: __cf_bm Value: 3MByyi4wYL.MuRwOK9B.eIuNXIrL6a33oOIkGNeUk4I-1676068742-0-ATNSICI+xKh4fiuJYOAh51YsZJ2Oju4EWae0cuaPuXCuKRcc6e/WSNEDJORRpEid16gHwjoOHjKVZ7GlEmJMDos=
www.lmbahsj2.com/	1970-01-20 09:35:55	Name: uniqueClick Value: 3177995d-8baf-4cde-b51f-f32793cf9ced:1676068742
www.lmbahsj2.com/	1970-01-20 11:44:04	Name: transaction_id Value: ec83edb2c8974ed385ceedce875732df
.quickenloans.com/	1970-01-20 10:17:40	Name: ef_tid_c_o_9 Value: ec83edb2c8974ed385ceedce875732df
.quickenloans.com/	1970-01-20 10:17:40	Name: ef_tid_c_a_1 Value: ec83edb2c8974ed385ceedce875732df
.casalemedia.com/	1970-01-20 18:20:04	Name: CMID Value: Y.bHhlxHjgrpm.i6fc.r0AAA
.casalemedia.com/	1970-01-20 11:44:04	Name: CMPS Value: 3388
.casalemedia.com/	1970-01-20 11:44:04	Name: CMPRO Value: 3388
.pmsrv.co/	1970-01-20 11:45:52	Name: _pmedia_opt-out Value: 1
.adnxs.com/	1970-01-20 11:44:04	Name: uuid2 Value: 8006300581870982572
.adnxs.com/	1970-01-20 11:44:04	Name: anj Value: dTM7k!M4.FErk#WF']wIg2H`eHviKx!@wnfH)iR8PMp-v=0H^.f[scRiJ%(ihiJUf(Nd9N.j:N%(2K:$doRL2xc>Hx7R)0p8HmA0/rwze8php!!(=b1aI-
.demdex.net/	1970-01-20 13:53:40	Name: dextp Value: 21-1-1676068741111\|771-1-1676068741212\|1083-1-1676068741313\|1085-1-1676068741414\|1086-1-1676068741542\|1087-1-1676068741772\|1088-1-1676068741894\|19913-1-1676068741995\|83349-1-1676068742096\|144230-1-1676068742255\|144231-1-1676068742360\|144232-1-1676068742460\|144233-1-1676068742561\|144234-1-1676068742662\|144235-1-1676068742764\|144236-1-1676068742865\|144237-1-1676068742967
.pubmatic.com/	1970-01-20 11:44:04	Name: KRTBCOOKIE_218 Value: 4056-Y@bHhAAABJn9AgL5&KRTB&22978-Y@bHhAAABJn9AgL5&KRTB&23194-Y@bHhAAABJn9AgL5&KRTB&23209-Y@bHhAAABJn9AgL5
.pubmatic.com/	1970-01-20 10:17:40	Name: PugT Value: 1676068742
.spotxchange.com/	1970-01-20 10:14:47	Name: audience Value: b806e5d3-a993-11ed-88f5-107c10e90506
.refinance.quickenloans.com/	1970-01-20 09:34:30	Name: __cf_bm Value: ujEZEvukNdGLbwflFfwdCAcX5My9hcBtHbmgGUvh4gI-1676068743-0-AV0VrOcmyNfmIGAoqeXfppKwWHIDsInxAFIdYZD/76nuMNZUxYSwPQRLaskjbpx4a7KOlXg3/Tr31N+qbJ3QUq8=

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df Message: [.WebGL-0x36f80296a300]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels
other	error	URL: https://refinance.quickenloans.com/?pkey1=771&pkey2=690320&pkey3=ec83edb2c8974ed385ceedce875732df&sourceid=lmb-54867-113582-771&sid=9&cmpid=9&crtid=&oid=9&affid=771&_ef_transaction_id=ec83edb2c8974ed385ceedce875732df Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
ad.doubleclick.net
ads.revjet.com
ads.yahoo.com
adservice.google.com
alb.reddit.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cdn1.decide.dev
cdn1.lockerdomecdn.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
content.lowermybills.com
content.refinance.quickenloans.com
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
pix.revjet.com
pixel.everesttech.net
pixel.mathtag.com
pixel.rubiconproject.com
pixel1083.everesttech.net
psp.pushnami.com
quicken.demdex.net
quickenloans.tt.omtrdc.net
refinance.quickenloans.com
rp.liadm.com
rp4.liadm.com
s.amazon-adsystem.com
s.pinimg.com
s.yimg.com
sc-static.net
sgtm.lowermybills.com
somni.quickenloans.com
sp.analytics.yahoo.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
sync-tm.everesttech.net
sync.search.spotxchange.com
trackpixel.refinance.quickenloans.com
trc.pushnami.com
trc.taboola.com
us-u.openx.net
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.it
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
www.redditstatic.com
13.224.189.93
13.227.210.174
13.227.219.63
13.37.25.97
142.250.180.198
142.250.201.194
144.76.98.92
151.101.192.84
151.101.193.140
151.101.193.44
151.101.66.49
151.139.128.10
172.217.18.98
185.64.190.80
185.80.39.216
185.89.210.46
185.94.180.126
2001:4860:4802:32::15
2001:4860:4802:38::178
209.54.182.161
212.82.100.181
2600:1f18:730:b150:45ed:3b73:d151:5773
2600:9000:20eb:a400:8:8845:1500:93a1
2600:9000:234e:a600:a:8e7d:9900:93a1
2606:4700:4400::6812:2021
2606:4700:4400::6812:2345
2606:4700:4400::ac40:9792
2606:4700:4400::ac40:9bdf
2606:4700::6810:3865
2a00:1288:f03d:1fa::2000
2a00:1450:4001:803::200a
2a00:1450:400d:806::2002
2a00:1450:400d:806::2008
2a00:1450:400d:808::2004
2a00:1450:400d:80d::2002
2a00:1450:400d:80d::2003
2a00:1450:400d:80e::2003
2a02:26f0:dc:39c::1931
2a02:26f0:f700:495::1e80
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:400::396
3.216.213.114
3.248.49.44
34.98.64.218
35.201.76.131
5.9.124.242
52.209.9.253
52.213.137.74
52.213.165.255
54.192.87.248
54.195.46.193
54.204.164.0
54.204.59.49
54.229.62.148
54.72.143.161
69.173.144.139
92.123.37.164
0093220d4c1b5e63d15fb4e0086a3f1a5e352c183335c5ec2b26dc0397804b65
08a22b8504ffe12073a04088acad2817650df38a0dfa7aa77ec818c17a21a164
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d
0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3
18775709fabc898a85d11947399510b3c99bf0ac32e84d86d9734e763af2607f
19094c592aeeebae116447ed13c90636e41825350032b21a7c4e8eb202d448bc
1b0d7b4d07edcf9646c37389987b88701d3c117ce6694a9ade4387eefe1c8241
1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532
21bbf9b7087d31830814515667f8525013f0a1f5af429f05bf1f1f249932fd23
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
25dc2307deb5d7578e8eb21eb305d22ba65fa282633adf6b3b9096709a6811cd
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
2aa042d158aa67895b5cf55483f8e0ee855734cb891ff28a4687fd7dbe2f6238
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
32c0499ec15eacddd1f4f338497081a62ac957ccd9467356d7db7010c2044b3f
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
38485d78ca251b2506cd533def2ea0a87ed1dd9cae5be2b826a112155ffcad34
3a541998b9c385a9e7c8aa59980b151070459d8fd8f1dc4a5f469cd1d57d43d2
3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae
3ef64e4a0001cd55211fff6bd306290f29c7482a6006d070ee21e52484b7ef22
40b4896dbb049a25165dd2966a14caa87b96bf87f8a0384a5200b50ce5320bba
4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
4b01f9a7a6886d1fa34e50af146b0c0df3e7582547121f00f307afd7766b5d54
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b82048fc0187b62e0f9187e682fc063abf4cb884aa7d3ecc533b81683f1c6c1
4cd749cb1a66ca42afac2d38a803da602eef0619f6a9efba23a8ab454226575e
4ce5ee0de21c180e9d0e6598d0b61c4cd35a1a4c471d65ee1d158245179de55d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
562c5f835123b6d33470793c34ab66067a79bf218555963f7824a6fe3886faa9
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57afd9f73da755021d6057d3fcf16e265c156a03fdddef63fd043a1ebc416ea8
5849e07d0d6cbb144829b98da75fda4a8eb3fc2b5749d48cc94bb170db54859a
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5aa93e7401f9a3344d1f891eacfb0cf698bf56cc5d7cb2586bfe0d82d1c8c4b0
5d05e30df8e75fd1e283107e1bbc7aef496ce49da3d82a7ab9f128b2bb68beae
5de79c919845c3e1f00df99503ab9ceb38d76b70fb2a238306934ad879e1c24a
6138463bbdff1883c8b9d1b6efdc1c781c88c96e374453479e57fef68f0babe7
65edf76f3328e9fbd5069a31fc13a5044ba2db312946f54e9e93cab6eabdf6c5
65fecc74ed34fec50568607bbbe0d59b6c058840ffef0efbccbfbd578e56e71b
6875a0375c7dd31922104a3c1a8eaf626e0aabdc0a62cf581e2c6a76a3cb6627
69afd3299d09702d89cb0246d290e0e0e3a6be8181af3f31fa1e81f8df8f2e01
6b6f8057e240a65dc3ed044f6249e4a12d5e9d2c4f8e18e0f44f9603ee5a03ff
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c5ed4f2b570bbd968510dd64341bcae99cf4e4801e1b65471911613d994bcf7
6cedaab2e441f3b99e251bb8d3a203554b2e134eaf8e0d91e17c04030e2ae162
72d540379bd4d0940250612c1f5ceecc3cc08afceb8b6b636fe3a9b585415ae0
730de59300e6103732a2168bdc9742af79a9abfe5995c6d3f3f3e96fd7c99d97
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
7a3bcc4ea246253c762bbf4df2af7be93a663ec62af9fea8188e9c8a7f8b8c6e
7a6cf3b6daf39a9b2f236a2b3449bc004378762c6ddc1fc09c98673ad247a691
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5
83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9
84acb826b2a41b4ea8070965f3b258d4d58c56ea7c2103c8ab17ed08d53ea543
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
9080f68b5d9a7780cb302adbd72adda14bed2dfc043a8ffd62a0b5a506fe48c8
97015be89307cc8be17ebb6ae585c785dd849c17ffee312c0c15458a0a3dcccd
97c8c40d489e15b86abc0872127a253b3bc36d452a6a880796efc33c5183fa88
9c52d4f0c511ad46314d6bbda1055195eac4101b56de0102dc5cd3be3310ad58
9cc22f31667ff38fef666077f1efbad43a99bb823636c845dc9d4ec57c4b65ed
9e5ad49628338eb99371dd56f4b864859f24fce37030d983f0ad70eeffe489e2
9fead708a7e919c843fc8d0334247d8ec7ddaa1577c3d37e9af8757729fcc680
a2a919451d0720be4243f3ceff9504a3b98d276f080ed4c85a381b9f4bb531e4
a64129d7e34453e5979a1f5f5df25209fadf811e7dbad16febed00cab664bdab
a675f842275bafec3f72a34de62667f934f25f9677554c192e964c3fe56ec0e8
a71b7de2154e5cbb740cd0e6b9c5e072091bf9c59996cb22e12221dba408f790
aa2eb397807ac837d0676b46f5f40278100b8a2c81c71617117c189c839545e1
ab8140419c7b5be781790bfc0835bebbe09c8ee3edeb6f1bda347bda8a457ecd
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b38bb197f7d66aafc73e629759209db7f2dbfd573b0359830de4b83c6f0342ad
b7f9aaa7738bb6bf650218988704b4b8e553357835a1ab4d88005c9629a22266
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c1e56ad863615fc191d80d7807852db95e57579f6535186d83d04ecdebef5236
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
caad098aba2a44cd5d9005a87362ec410ccf304ec2e022dde1a7956cb1c42800
cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a
d2abd734befc8e01e5edfc02ba7ce03a66558c9161db69d5d717b574b566e1b8
d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321
d371367b0a40a2e26ed2cb9842bccdffe8d25cf282d4100f31275c8947d30118
d60aa838e099599b51126886e7fa0334ad2022c7b4f76977c86f45463b55bfe9
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
d97bd5f5523baf3ed16cd84a6c83d56d7d9520cd7fb0aa56c23d679e94393f72
da5e7d39ee408cac68360efbaed7104b04ad15bebe5256292de93955c6d93ad3
dbe0bf1b9db8912770e849b979650a616b44dc78930290df944591d75d292a08
dd12f52957b7cedfd396eb5860e1001b4c4fc2b03b6875d3023c7cf14b3ae339
de9462e351a7c74cd76bf432a62faf0dbf0b068beeb7a16c83eac6728956b7f6
e1e147155c651b39126a949102e507c579a12c4971ccd451f002324a67561ed3
e2adb933987ecc1b413c1ad0d5024757f89f224afccc19d42f8c4c322aef7ea3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5c16b8083ee57b5979d4bac97588eb585ed6508b7171122069ddeb710fac31b
e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c
eb99e907557fb0825f8e9dc903de4fab4e47052712f7808c3284ea77611bce90
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0
f3496bc7c277d917d35553c46ed1597a86065494cac582e42a3a1d55aedef7fb
fdb328bff496e603b8fbd56d9b59114b5e4aeb7c5cf7a550563e5dc95cc25f33

refinance.quickenloans.com Open in urlscan Pro 2606:4700:4400::ac40:9bdf Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

159 Requests

84 %HTTPS

40 %IPv6

43 Domains

63 Subdomains

53 IPs

8 Countries

1891 kBTransfer

5283 kBSize

60 Cookies

18 Outgoing links

Redirected requests

159 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::ac40:9bdf Public Scan

Screenshot
Live screenshot

Full Image

159
Requests

84 %
HTTPS

40 %
IPv6

43
Domains

63
Subdomains

53
IPs

8
Countries

1891 kB
Transfer

5283 kB
Size

60
Cookies

159 HTTP transactions
0 data transactions