refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:c2b Public Scan

Go To Rescan
Add Verdict Report

URL:
https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_1...
Submission: On December 19 via manual (December 19th 2023, 8:09:20 pm UTC) from US — Scanned from DE

Summary HTTP 154 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 49 IPs in 5 countries across 41 domains to perform 154 HTTP transactions. The main IP is 2606:4700::6812:c2b, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 588586.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 20th 2023. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
14	2606:4700::68... 2606:4700::6812:c2b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.154.63.95 18.154.63.95	16509 (AMAZON-02) (AMAZON-02)
1	52.58.191.183 52.58.191.183	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:350... 2a02:26f0:3500:580::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	18.154.63.17 18.154.63.17	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:e4:... 2606:4700:e4::ac40:a21d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3965	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 6	54.74.162.209 54.74.162.209	16509 (AMAZON-02) (AMAZON-02)
1	18.173.225.115 18.173.225.115	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
1	63.140.62.22 63.140.62.22	16509 (AMAZON-02) (AMAZON-02)
8 8	34.255.242.39 34.255.242.39	16509 (AMAZON-02) (AMAZON-02)
1 1	18.195.197.47 18.195.197.47	16509 (AMAZON-02) (AMAZON-02)
3	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
8 9	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
2	54.84.223.12 54.84.223.12	14618 (AMAZON-AES) (AMAZON-AES)
6	2600:1f18:24e... 2600:1f18:24e6:b901:e3cd:139:2c08:808	14618 (AMAZON-AES) (AMAZON-AES)
2	2a02:26f0:350... 2a02:26f0:3500:88a::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	65.109.98.105 65.109.98.105	24940 (HETZNER-AS) (HETZNER-AS)
1	2600:9000:243... 2600:9000:243d:5600:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	216.58.206.34 216.58.206.34	15169 (GOOGLE) (GOOGLE)
7	151.101.1.44 151.101.1.44	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:94b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	108.157.5.251 108.157.5.251	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1288:80:... 2a00:1288:80:807::2	203220 (YAHOO-DEB) (YAHOO-DEB)
1	2600:9000:231... 2600:9000:2315:9c00:a:8e7d:9900:93a1	16509 (AMAZON-02) (AMAZON-02)
2	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	63.140.62.108 63.140.62.108	16509 (AMAZON-02) (AMAZON-02)
6 12	52.214.98.45 52.214.98.45	16509 (AMAZON-02) (AMAZON-02)
2	18.130.48.239 18.130.48.239	16509 (AMAZON-02) (AMAZON-02)
3	151.101.0.84 151.101.0.84	54113 (FASTLY) (FASTLY)
2	65.21.233.18 65.21.233.18	24940 (HETZNER-AS) (HETZNER-AS)
5	35.190.43.134 35.190.43.134	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:1ba3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f17... 2a03:2880:f176:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	18.173.233.7 18.173.233.7	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:1f18:730... 2600:1f18:730:b120:12e:9f8f:e13b:3343	14618 (AMAZON-AES) (AMAZON-AES)
1	34.225.218.210 34.225.218.210	14618 (AMAZON-AES) (AMAZON-AES)
12	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
7 7	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	37.252.173.215 37.252.173.215	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	3.225.52.6 3.225.52.6	14618 (AMAZON-AES) (AMAZON-AES)
1	185.64.191.210 185.64.191.210	62713 (AS-PUBMATIC) (AS-PUBMATIC)
154	49

14 2606:4700::6812:c2b (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.154.63.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-154-63-95.dus51.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.58.191.183 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-191-183.eu-central-1.compute.amazonaws.com

cs-cdn.deviceatlas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:580::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.154.63.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-154-63-17.dus51.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e4::ac40:a21d (United States)

ASN13335 (CLOUDFLARENET, US)

fonts.cdnfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3965 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.74.162.209 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-74-162-209.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.225.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-225-115.dus51.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-22.data.adobedc.net

somni.rocketmortgage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.255.242.39 (Dublin, Ireland) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-242-39.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.197.47 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-197-47.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 172.217.23.98 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f98.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.84.223.12 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-223-12.compute-1.amazonaws.com

psp.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:1f18:24e6:b901:e3cd:139:2c08:808 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

rum-http-intake.logs.datadoghq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:88a::1931 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.109.98.105 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.105.98.109.65.clients.your-server.de

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:243d:5600:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.34 (United States)

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.1.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:94b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mortgage.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.5.251 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-5-251.dus51.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:80:807::2 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2315:9c00:a:8e7d:9900:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.pmsrv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.76.131 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.108 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-108.data.adobedc.net

adobedc.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 52.214.98.45 (Dublin, Ireland) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-98-45.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.130.48.239 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-130-48-239.eu-west-2.compute.amazonaws.com

script.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.0.84 (United States)

ASN54113 (FASTLY, US)

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.21.233.18 (Helsinki, Finland)

ASN24940 (HETZNER-AS, DE)
PTR: static.18.233.21.65.clients.your-server.de

pix.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.190.43.134 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 134.43.190.35.bc.googleusercontent.com

tr.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tr6.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1ba3 (United States)

ASN13335 (CLOUDFLARENET, US)

somni.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.233.7 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-233-7.dus51.r.cloudfront.net

ads.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b120:12e:9f8f:e13b:3343 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.225.218.210 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-225-218-210.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.66.49 (United States) 7 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.64.151.101 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.173.215 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.225.52.6 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-52-6.compute-1.amazonaws.com

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.191.210 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	everesttech.net 21 redirects cm.everesttech.net — Cisco Umbrella Rank: 1110 pixel.everesttech.net — Cisco Umbrella Rank: 5178 sync-tm.everesttech.net — Cisco Umbrella Rank: 685	10 KB
21	doubleclick.net 8 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 219 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	19 KB
16	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 588586 static-msql-prod.refinance.quickenloans.com trackpixel.refinance.quickenloans.com content.refinance.quickenloans.com cdn.mortgage.quickenloans.com somni.quickenloans.com — Cisco Umbrella Rank: 493969	377 KB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	1 MB
12	google.de www.google.de — Cisco Umbrella Rank: 6765	2 KB
12	google.com www.google.com — Cisco Umbrella Rank: 2	2 KB
7	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 1020 trc.taboola.com — Cisco Umbrella Rank: 648	20 KB
7	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 208 quicken.demdex.net — Cisco Umbrella Rank: 89733 adobedc.demdex.net — Cisco Umbrella Rank: 7481	9 KB
6	datadoghq.com rum-http-intake.logs.datadoghq.com — Cisco Umbrella Rank: 6595
6	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 5583 psp.pushnami.com — Cisco Umbrella Rank: 19310 trc.pushnami.com — Cisco Umbrella Rank: 5922	20 KB
5	snapchat.com tr.snapchat.com — Cisco Umbrella Rank: 758 tr6.snapchat.com — Cisco Umbrella Rank: 88800	799 B
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	3 KB
3	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1308 ads.yahoo.com — Cisco Umbrella Rank: 7501	925 B
3	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 715	1 KB
3	anura.io script.anura.io — Cisco Umbrella Rank: 55672 ads.anura.io — Cisco Umbrella Rank: 70839	21 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 2977 rp.liadm.com — Cisco Umbrella Rank: 1632 rp4.liadm.com — Cisco Umbrella Rank: 6685	16 KB
3	revjet.com ads.revjet.com — Cisco Umbrella Rank: 6785 pix.revjet.com — Cisco Umbrella Rank: 5801	9 KB
3	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2189	369 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 229	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 578	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	1 KB
2	gstatic.com fonts.gstatic.com	48 KB
2	lmbahsj2.com www.lmbahsj2.com	19 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 630	7 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	85 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 745	21 KB
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 859	225 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 491	264 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 339	239 B
1	pmsrv.co c.pmsrv.co — Cisco Umbrella Rank: 77685	4 KB
1	sc-static.net sc-static.net — Cisco Umbrella Rank: 945	18 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138	19 KB
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 499	482 B
1	rocketmortgage.com somni.rocketmortgage.com — Cisco Umbrella Rank: 103069	470 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1445	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 864	7 KB
1	cdnfonts.com fonts.cdnfonts.com — Cisco Umbrella Rank: 9100	705 B
1	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 431	81 KB
1	deviceatlas.com cs-cdn.deviceatlas.com — Cisco Umbrella Rank: 193848	22 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 4867	7 KB
0	spotxchange.com Failed sync.search.spotxchange.com Failed
154	41

	Domain	Requested by
15	www.googletagmanager.com	refinance.quickenloans.com www.googletagmanager.com trackpixel.refinance.quickenloans.com
12	www.google.de
12	www.google.com
12	googleads.g.doubleclick.net	www.googletagmanager.com
12	pixel.everesttech.net	6 redirects
9	cm.g.doubleclick.net	8 redirects
8	cm.everesttech.net	8 redirects
7	sync-tm.everesttech.net	7 redirects
6	trc.taboola.com	cdn.taboola.com
6	rum-http-intake.logs.datadoghq.com	www.datadoghq-browser-agent.com
5	content.refinance.quickenloans.com	static-msql-prod.refinance.quickenloans.com
5	dpm.demdex.net	1 redirects refinance.quickenloans.com
5	refinance.quickenloans.com	www.datadoghq-browser-agent.com
4	tr.snapchat.com	sc-static.net
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
3	ct.pinterest.com	s.pinimg.com
3	region1.google-analytics.com	www.googletagmanager.com
2	trc.pushnami.com	www.datadoghq-browser-agent.com
2	ib.adnxs.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	sp.analytics.yahoo.com
2	www.facebook.com
2	pix.revjet.com	ads.revjet.com
2	script.anura.io	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.lmbahsj2.com	trackpixel.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	s.yimg.com	refinance.quickenloans.com s.yimg.com
2	connect.facebook.net	refinance.quickenloans.com connect.facebook.net
2	s.pinimg.com	refinance.quickenloans.com s.pinimg.com
2	psp.pushnami.com	www.datadoghq-browser-agent.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
1	image2.pubmatic.com
1	us-u.openx.net
1	pixel.rubiconproject.com
1	ads.yahoo.com
1	tr6.snapchat.com	sc-static.net
1	rp4.liadm.com
1	rp.liadm.com	1 redirects
1	ads.anura.io	www.datadoghq-browser-agent.com
1	somni.quickenloans.com	assets.adobedtm.com
1	adobedc.demdex.net	assets.adobedtm.com
1	c.pmsrv.co	trackpixel.refinance.quickenloans.com
1	sc-static.net	refinance.quickenloans.com
1	cdn.mortgage.quickenloans.com	trackpixel.refinance.quickenloans.com
1	cdn.taboola.com	refinance.quickenloans.com
1	www.googleadservices.com	trackpixel.refinance.quickenloans.com
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	refinance.quickenloans.com
1	aa.agkn.com	1 redirects
1	somni.rocketmortgage.com	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	fonts.cdnfonts.com	static-msql-prod.refinance.quickenloans.com
1	assets.adobedtm.com	refinance.quickenloans.com
1	cs-cdn.deviceatlas.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
0	sync.search.spotxchange.com Failed
154	60

This site contains links to these domains. Also see Links.

Domain
www.lowermybills.com
privacyportal-cdn.onetrust.com
www.quickencompare.com
www.rockethomes.com
privacyportal.onetrust.com
www.amerisave.com
www.fhfa.gov
capitalmarkets.fanniemae.com
www.quickenloans.com
www.starleafsquare.com
marketing.lowermybills.com

Subject Issuer	Validity	Valid
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2023-11-20` - `2024-11-19`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M02	`2023-02-02` - `2024-03-02`	a year	crt.sh
*.deviceatlas.com Go Daddy Secure Certificate Authority - G2	`2023-03-04` - `2024-04-04`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
*.pushnami.com Amazon RSA 2048 M01	`2023-03-04` - `2024-04-02`	a year	crt.sh
cdnfonts.com GTS CA 1P5	`2023-11-30` - `2024-02-28`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-12` - `2024-12-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
somni.rocketmortgage.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-17` - `2024-02-17`	a year	crt.sh
*.logs.datadoghq.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-22` - `2024-03-22`	a year	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-07` - `2024-08-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-28` - `2023-12-27`	3 months	crt.sh
*.revjet.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-04-11`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M03	`2023-12-02` - `2024-12-29`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-23` - `2024-11-22`	a year	crt.sh
mortgage.quickenloans.com Cloudflare Inc ECC CA-3	`2023-10-11` - `2024-10-10`	a year	crt.sh
sc-static.net Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-12-12` - `2024-01-31`	2 months	crt.sh
pmsrv.co Amazon RSA 2048 M02	`2023-09-16` - `2024-10-14`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2023-04-28` - `2024-05-13`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
adobedc.demdex.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-22` - `2024-11-21`	a year	crt.sh
script.anura.io Amazon RSA 2048 M02	`2023-10-16` - `2024-11-13`	a year	crt.sh
*.snap.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-13` - `2024-04-12`	a year	crt.sh
*.quickenloans.com GeoTrust TLS RSA CA G1	`2023-10-04` - `2024-10-03`	a year	crt.sh
ads.anura.io Amazon RSA 2048 M01	`2023-05-30` - `2024-06-27`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-10-24` - `2024-04-17`	6 months	crt.sh

This page contains 6 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Frame ID: 2C465FFD3371B161285A29CDC97BD379
Requests: 101 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: 7CE35CD503DA182CB91584EF48A491D5
Requests: 18 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: B4A6EFC27CDB559C4F8A52D0D6DC3460
Requests: 1 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: C025F93A61B649CA8DFB5774902181D4
Requests: 30 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=409e6a74-8d7f-465e-87b0-cc6eb99f3a76&u_scsid=9a7d0eac-61df-4593-9e3c-3a03cb77d1ae&u_sclid=df61a722-de55-46ae-af60-cedb2b025159
Frame ID: B84E6CD4683922F3AF072070A01AA2FC
Requests: 1 HTTP requests in this frame

Frame: https://ct.pinterest.com/ct.html
Frame ID: FC25B830C528D6B421A8C6A49ED25E62
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Calculate New Payment - Start Here | Quicken Loans

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

154
Requests

86 %
HTTPS

40 %
IPv6

41
Domains

60
Subdomains

49
IPs

5
Countries

2014 kB
Transfer

6067 kB
Size

50
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.lowermybills.com/legal/stateprivacy/
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/mortgage/mortgage-calculator/
Title: Mortgage Payment Calculator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/personal-loan-calculator/
Title: Personal Loan Payment Calculator

Search URL Search Domain Scan URL

URL: https://www.rockethomes.com/how-much-is-my-house-worth
Title: Home Value Estimator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/home-equity-loans/home-equity-loan-amount-calculator/
Title: Estimated Home Equity Calculator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/state-privacy/
Title: Information That We Collect and Share About You

Search URL Search Domain Scan URL

URL: https://privacyportal.onetrust.com/webform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e
Title: Do Not Sell My Personal Information

Search URL Search Domain Scan URL

URL: https://www.amerisave.com/rates/
Title: Rates

Search URL Search Domain Scan URL

URL: https://www.amerisave.com/loan-programs/cash-out-refinance/
Title: here

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/home-equity-rate-table/
Title: here

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: https://capitalmarkets.fanniemae.com/media/20371/display
Title: https://capitalmarkets.fanniemae.com/media/20371/display

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/privacy-policy/
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/state-privacy/
Title: State Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/disclosures-licenses/
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/ad-targeting/
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://www.starleafsquare.com/o-nrpx-d41-18fc5e526fb936daac7301f127413de5
Title: Unsubscribe

Search URL Search Domain Scan URL

URL: https://marketing.lowermybills.com/api/marketing/redirect?uid=214966&prd=MS
Title: Go To LowerMyBills

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1703016555133 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1703016555133

Request Chain 20

https://cm.everesttech.net/cm/dd?d_uuid=41169317444863454642814777004463006696 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZYH4awAAAGQSDgNn

Request Chain 23

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=41169317444863454642814777004463006696 HTTP 302
https://dpm.demdex.net/ibs:dpid=21&dpuuid=216693104735004535838

Request Chain 28

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NDExNjkzMTc0NDQ4NjM0NTQ2NDI4MTQ3NzcwMDQ0NjMwMDY2OTY= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NDExNjkzMTc0NDQ4NjM0NTQ2NDI4MTQ3NzcwMDQ0NjMwMDY2OTY=&google_tc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEMU1zOkbtH7GBfHbK3pTOv0&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 65

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEHTCJ7CRZTIj1F1TAudfqZA&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 76

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEHTCJ7CRZTIj1F1TAudfqZA&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 81

https://rp.liadm.com/j?dtstmp=1703016555877&aid=a-06d7&se=e30&duid=ddc3c751f117--01hj1v4s6yber6gc7mcp2vpmpd&tna=v2.11.2&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&wpn=lc-bundle HTTP 302
https://rp4.liadm.com/j?se=e30&duid=ddc3c751f117--01hj1v4s6yber6gc7mcp2vpmpd&aid=a-06d7&tna=v2.11.2&dtstmp=1703016555877&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&i6=MmEwMzoxYjIwOjY6ZjAxMTo6MWU%3D

Request Chain 82

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESEHTCJ7CRZTIj1F1TAudfqZA&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 97

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESEHTCJ7CRZTIj1F1TAudfqZA&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 129

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEHTCJ7CRZTIj1F1TAudfqZA&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 133

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEHTCJ7CRZTIj1F1TAudfqZA&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 138

https://cm.everesttech.net/cm/yh HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZYH4awAAAGQSDgNn&sigv=1&esig=1~3faa35d8729200eda73f4f0c55ace50786c2cf72

Request Chain 139

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WllINGF3QUFBR1FTRGdObg==

Request Chain 140

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZYH4awAAAGQSDgNn&expires=90

Request Chain 141

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZYH4awAAAGQSDgNn HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZYH4awAAAGQSDgNn&C=1

Request Chain 142

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=ZYH4awAAAGQSDgNn HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZYH4awAAAGQSDgNn

Request Chain 143

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZYH4awAAAGQSDgNn

Request Chain 146

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZYH4awAAAGQSDgNn

Request Chain 147

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZYH4awAAAGQSDgNn&img=1

Request Chain 148

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZYH4awAAAGQSDgNn&t=2592000&o=0

154 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
refinance.quickenloans.com/ 125 KB
26 KB 1039ms
972ms Document
text/html 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

dcaf7fe14f777b4d06a3c9c2544e764fe4b8a85c0f4572161e5ffa42aecb37ca

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 838248328c211942-FRA
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Tue, 19 Dec 2023 20:09:14 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

GET
H2 200 main.db98779aa11320dc7c9a.css
static-msql-prod.refinance.quickenloans.com/ 213 KB
28 KB 96ms
55ms Stylesheet
text/css 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5affff87cbf96f15e9d5b4e2576c20dff194831516d5d3357d11e07425d3bcb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:14 GMT
x-amz-version-id: WWSyeVUOKC5Ax2FeRe3uWKoDoktW6aG2
content-encoding: gzip
cf-cache-status: REVALIDATED
via: 1.1 63f629236e2f93bf1af732a50e42e586.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P3
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 13 Dec 2023 06:45:10 GMT
server: cloudflare
etag: W/"3126a9f123e7c9d9dbc84b780eca786f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 83824838edea1942-FRA
x-amz-cf-id: dw4gBuhZJMh2z8xyJXVngZH6BtvSrz8BNLRelnD1TKbS6hpvIEkhww==
expires: Wed, 20 Dec 2023 00:09:14 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 21 KB
7 KB 42ms
11ms Script
application/x-javascript 18.154.63.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.154.63.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-154-63-95.dus51.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 19 Dec 2023 03:02:05 GMT
via: 1.1 0f614fbd956590bdb4b3def9e1395ca6.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 61629
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6759
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Oct 2023 12:27:20 GMT
server: AmazonS3
etag: "15864ce88fa79a3e954417d0c3396798"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: RPKzTBFU8Fa2mhdEWunoKN-Od6iBEjPkbXgX4h7FT5oCJ9gzXr-PFA==

GET
H2 200 dacs.js Show response
cs-cdn.deviceatlas.com/ 21 KB
22 KB 341ms
15ms Script
application/javascript 52.58.191.183
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cs-cdn.deviceatlas.com/dacs.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

52.58.191.183 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-58-191-183.eu-central-1.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

fe49fc14b70cfc4f3edbc08e58087ca0f6e948a953c3eaeabdc7e78f512e5a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:14 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 09 Nov 2023 13:50:26 GMT
server: nginx/1.17.9
accept-ch: DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data
etag: "610a4ab640dd5cfa6750aa2623357f51"
x-cache: HIT
content-type: application/javascript
cache-control: no-cache
accept-ranges: bytes
content-length: 21909
expires: Tue, 19 Dec 2023 20:09:13 GMT

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
634 B 685ms
670ms Script
application/javascript 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12ee117325990965090cc5c5dfa8117e8866e93c4fdf72fd1f08f24f0b621925

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-cdf265906f6dec5679b5.js
date: Tue, 19 Dec 2023 20:09:15 GMT
via: 1.1 22993faf725ff29c940e58cb14ddf668.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P2
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 19 Dec 2023 20:05:57 GMT
server: cloudflare
etag: W/"af91ea0e5eaa7e7dab261c3a5108fd9b"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 83824838bda31942-FRA
x-amz-cf-id: vWlp2_PDBV7Q2OfBoaXSZX9X73pDleCO_Ime07v6zARXBAgYcxSc7A==
expires: Wed, 20 Dec 2023 00:09:15 GMT

GET
H2 200 launch-099982a746cc.min.js Show response
assets.adobedtm.com/b14636b10888/a3ec7ef1f366/ 257 KB
81 KB 42ms
24ms Script
application/x-javascript 2a02:26f0:3500:580::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:580::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:14 GMT
content-encoding: gzip
last-modified: Mon, 02 Oct 2023 19:55:09 GMT
server: AkamaiNetStorage
etag: "b31a1f9e9f88d2133e2b3a9abeeddcd7:1696276509.604687"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 82392
expires: Tue, 19 Dec 2023 21:09:14 GMT

GET
H2 200 623bac6703b37600138f67a3 Show response
api.pushnami.com/scripts/v1/push/ 87 KB
18 KB 60ms
21ms Script
application/javascript 18.154.63.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-17.dus51.r.cloudfront.net
Software: /
Resource Hash: 6596ea36bf758c2f1d6dd8d40249ab6dae02d46a4aa02c393d65acb0fab0866f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:03:05 GMT
content-encoding: gzip
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 369
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: 69Z9CGtIC5riRmr4-hrmU3Ha9V0Bb5ltWC7G5oZ55Zc9tD_rx5Im5w==

GET
H2 200 stack-ssi
fonts.cdnfonts.com/css/ 1 KB
705 B 103ms
54ms Stylesheet
text/css 2606:4700:e4::ac40:a21d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/stack-ssi
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a21d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6659e8919d1cde02448dce70dfd9ef0d9b3ba4d416fd904ab564baff472c1ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:14 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 19 Dec 2023 20:09:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t8FYGqcY6dkwpzijq6SqMWbZw5RlQQihfV2kzt53EZQ9K%2B7ch8CJAo42acl6dJ1e74ek%2Fb00JhEoWf0hEK6yqCY6DHccnTCERhSS%2BZ0EJ6FCpbfI%2BuYNGZAiSMWtDpROY5YkuSU8LDbnhOTKWu71rjQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 838248398b962ba6-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 css2
fonts.googleapis.com/ 875 B
476 B 141ms
63ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0dd1971699f19f33219608023cd1f3294e8c0bed22cd575610c85644e5942271

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 19 Dec 2023 20:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 20:09:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Dec 2023 20:09:14 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
801 B 125ms
47ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ead030154a651dbf216d5c043e974bb3f78b640078472f63d4277db7deb1faae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 19 Dec 2023 20:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 19:36:44 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Dec 2023 20:09:14 GMT

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
812 B 137ms
59ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0a62530dd1701bdc8d1b3ece6ee812c57c812833d0eecc9163987c8a211b52f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 19 Dec 2023 20:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 20:09:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Dec 2023 20:09:14 GMT

GET
H2 200 css2
fonts.googleapis.com/ 427 B
735 B 124ms
46ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 19 Dec 2023 20:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 20:09:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Dec 2023 20:09:14 GMT

GET
H2 200 main.db98779aa11320dc7c9a.js Show response
static-msql-prod.refinance.quickenloans.com/ 859 KB
208 KB 69ms
69ms Script
application/javascript 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dcf6c8f4f1e21735328826e20d2cf2cf3a47bae76be1a0e4eda254346f233e55

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
x-amz-version-id: 2lZ9rK44GZRy9cCKki_kMpKBZVMFWZdv
content-encoding: gzip
cf-cache-status: REVALIDATED
via: 1.1 54fc556adf6e8c787574c6f132d70178.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P3
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 13 Dec 2023 06:45:10 GMT
server: cloudflare
etag: W/"f3a63fc9e16e235b670c55159450092f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8382483cdca91942-FRA
x-amz-cf-id: EWJAr7dW-O5YNbGrv8Fhb1m9JGfQGxztaZT2yBpPWRttWYG8i6dEHg==
expires: Wed, 20 Dec 2023 00:09:15 GMT

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 62ms
46ms Script
text/javascript 2606:4700::6810:3965
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8382483d09e15c1a-FRA

GET
H2 200 pixel-cdf265906f6dec5679b5.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 162 KB
21 KB 91ms
90ms Script
application/javascript 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75a0eb62f648249c345fb2cc0f68ede6d83a790887abdee112cd6d1bb38cb042

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: gzip
via: 1.1 196da8dbede310a18cd917665afeaa22.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: AMS50-C1
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 18 Dec 2023 17:20:55 GMT
server: cloudflare
etag: W/"c1e4951f05206316ac84d6a8d513d17f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8382483cfcc11942-FRA
x-amz-cf-id: 8Bs2XBpHXwXM-floNpNund0GG4j1bE8VzeZXBeX4Rod1VnyfYCCUZQ==
expires: Wed, 20 Dec 2023 00:09:15 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1703016555133
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1703016555133

4 KB
2 KB

33ms
33ms

XHR
application/json

54.74.162.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1703016555133

Requested by

Protocol

Server

54.74.162.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-74-162-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

f841a3dc1291a53e65c17931f3569cb5c2a956f1a1222b93b46c7881b6fce7fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-0994aa89c.edge-irl1.demdex.com 3 ms
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: 57sHacOBRIo=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 1250
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-2-v054-0a46f06a9.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: n7qRsyJQQqc=
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1703016555133
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 49ms
15ms Script
application/javascript 18.173.225.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.225.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-225-115.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
via: 1.1 984c44215b4097c6a641c48a45b28302.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P3
age: 26
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: 6alvGbeI48RCDkfV-ZLZ2MzP_lnseHMIBORGgrt__fmxY3ZZcppw6A==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 233 KB
82 KB 132ms
54ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9280647a0566dd533eee81096561ecd5712a52e0b9bf323da2b303ad184d28c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 83261
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
BLOB 200
OK 7dc3f72b-2869-4417-8910-8c9bc35596a0
https://refinance.quickenloans.com/ 26 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://refinance.quickenloans.com/7dc3f72b-2869-4417-8910-8c9bc35596a0
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Length: 26149
Content-Type

GET
H2 200 dest5.html Show response
quicken.demdex.net/ Frame 7CE3 7 KB
3 KB 38ms
30ms Document
text/html 54.74.162.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.74.162.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-74-162-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 19 Dec 2023 20:09:15 GMT
dcs: dcs-prod-irl1-2-v054-07bf84699.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 8 Nov 2023 17:04:14 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: V/0WDpERQYo=

GET
H2 200 id Show response
somni.rocketmortgage.com/ 48 B
470 B 146ms
21ms XHR
application/x-javascript 63.140.62.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.rocketmortgage.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=41384716531750047202836301657494710048&ts=1703016555260

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.22 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-22.data.adobedc.net

Software

jag /

Resource Hash

1a8e8324e07c5c4216ad113239cfbba5cf7aad11fe45fc21ad17e5c8bf8d9795

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H2

200

ibs:dpid=411&dpuuid=ZYH4awAAAGQSDgNn
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=41169317444863454642814777004463006696
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZYH4awAAAGQSDgNn

42 B
717 B

33ms
32ms

Image
image/gif

54.74.162.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZYH4awAAAGQSDgNn

Requested by

Protocol

Server

54.74.162.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-74-162-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-0000ed5b8.edge-irl1.demdex.com 3 ms
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: JulhX838TjE=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZYH4awAAAGQSDgNn
Date: Tue, 19 Dec 2023 20:09:15 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 5 KB
3 KB 330ms
330ms XHR
application/json 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e50f4117972838fbf7a7460d9e4d103842d1df99d2a2bab935b3bd8cf677dd54

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
accept-language: de-DE,de;q=0.9
Authorization: Bearer null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"1394-HTGIliEmvsTWWxahhDKY7i0PONs"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 8382483e8ee51942-FRA
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 271 KB
91 KB 52ms
51ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b4759a91e08e1ca5f28ebc48ce581513ea09c7f4b5b453cf725512244aa02a85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92590
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2

200

ibs:dpid=21&dpuuid=216693104735004535838
dpm.demdex.net/ Frame 7CE3
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=41169317444863454642814777004463006696
https://dpm.demdex.net/ibs:dpid=21&dpuuid=216693104735004535838

42 B
717 B

31ms
31ms

Image
image/gif

54.74.162.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=21&dpuuid=216693104735004535838

Requested by

Protocol

Server

54.74.162.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-74-162-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-0a80e641c.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: MDDnaqLQTlM=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dpm.demdex.net/ibs:dpid=21&dpuuid=216693104735004535838
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
expires: 0

POST
H2 204 collect
region1.google-analytics.com/g/ 0
261 B 50ms
19ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je3bt0v9169491831z89137104487&_p=1703016555145&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=334719080.1703016555&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1703016555&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2182
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 38ms
20ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je3bt0v9169491831z89137104487&_p=1703016555145&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=334719080.1703016555&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sid=1703016555&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&_s=2&tfd=2195
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hub Show response
api.pushnami.com/scripts/v1/ Frame B4A6 2 KB
1 KB 13ms
13ms Document
text/html 18.154.63.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.154.63.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-154-63-17.dus51.r.cloudfront.net

Software

Resource Hash

2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 2876
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Tue, 19 Dec 2023 19:21:19 GMT
vary: accept-encoding
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-id: jWs5OrVGeaxDvD_9xLsHTP-yH0S9DbYMcznPsYT0h0z8UAE5IC-RLw==
x-amz-cf-pop: DUS51-P4
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
155 B 11ms
11ms XHR
text/plain 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
content-type: application/json

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8382483ff9081942-FRA

GET
H2

200

ibs:dpid=771&dpuuid=CAESEMU1zOkbtH7GBfHbK3pTOv0&google_cver=1
dpm.demdex.net/ Frame 7CE3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NDExNjkzMTc0NDQ4NjM0NTQ2NDI4MTQ3NzcwMDQ0NjMwMDY2OTY=
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NDExNjkzMTc0NDQ4NjM0NTQ2NDI4MTQ3NzcwMDQ0NjMwMDY2OTY=&google_tc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEMU1zOkbtH7GBfHbK3pTOv0&google_cver=1?gdpr=0&gdpr_consent=

42 B
718 B

32ms
32ms

Image
image/gif

54.74.162.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEMU1zOkbtH7GBfHbK3pTOv0&google_cver=1?gdpr=0&gdpr_consent=

Protocol

Server

54.74.162.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-74-162-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-026f8435a.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 50QVVIRCS+U=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEMU1zOkbtH7GBfHbK3pTOv0&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 psp Show response
psp.pushnami.com/api/ 2 B
152 B 119ms
118ms Fetch
text/html 54.84.223.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.84.223.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-223-12.compute-1.amazonaws.com
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Tue, 19 Dec 2023 20:09:15 GMT
x-powered-by: Express
content-length: 2
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type: text/html; charset=utf-8

OPTIONS
H2 204 psp
psp.pushnami.com/api/ Frame 0
0 321ms
102ms Preflight 54.84.223.12
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.84.223.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-84-223-12.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-headers: key
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
date: Tue, 19 Dec 2023 20:09:15 GMT
vary: Access-Control-Request-Headers
x-powered-by: Express

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 458ms
233ms Ping
application/json 2600:1f18:24e6:b901:e3cd:139:2c08:808
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-QZ1O4OYJ2&batch_time=1703016555526
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:e3cd:139:2c08:808 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
852 B 70ms
49ms Image
image/png 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
via: 1.1 6278ee254a7d35c23aae5e936b5a56ee.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P6
age: 993
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Fri, 17 Nov 2023 05:34:25 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 83824840ba4c1942-FRA
x-amz-cf-id: JIyotPTiROuK8PgM-nPDto0ZvC1Pwl2goxraZtfN9Sc8v565KCbpkg==
expires: Wed, 20 Dec 2023 00:09:15 GMT

GET
H2 200 overlay-close.svg
content.refinance.quickenloans.com/msql/EdisonOverlay/ 586 B
731 B 45ms
24ms Image
image/svg+xml 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/EdisonOverlay/overlay-close.svg

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
via: 1.1 fb5610ec56d3f427bcbcfdd851770614.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P6
age: 993
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 06 Dec 2023 14:06:37 GMT
server: cloudflare
etag: W/"58887760fe01f3933d5ae2d7bcc3f373"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 83824840ba4e1942-FRA
x-amz-cf-id: iJHwxD6_VmCkdhvF9AwzbgngkJun-lzVr9s43P5f8jF68mS9lUAiJA==
expires: Wed, 20 Dec 2023 00:09:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 194 KB
71 KB 52ms
52ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6d0e42e206210734979280d54ae436cb3d3858e91f53f29ebfaf04f40e1649c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72438
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ Frame C025 4 KB
2 KB 28ms
7ms Script
application/javascript 2a02:26f0:3500:88a::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:88a::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: ef45c21f7e054481c81992c1a46293a28c9bb8b3722bc566479326187f473c8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

akamai-x-true-ttl: 7200
content-encoding: br
x-cdn: akamai
etag: "8d7d8ce32aa2a45d64e9f04a9a5cb1c4"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 1793

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 81ms
81ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8f39a2061c1020d178e81f82e72d9b52fb89610d33478a67942af079707f3bc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67412
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame C025 202 KB
54 KB 23ms
8ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 19 Dec 2023 20:09:15 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: kssiL2otjJRxM2Cd9vso97t2S9iQpxFLRxb0FeNT240pmhDVD7MPQ+mTz4rFSl35jHbB+CuBzeLGIL5ODU9OnQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
ads.revjet.com/ Frame C025 19 KB
8 KB 118ms
33ms Script
application/javascript 65.109.98.105
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 65.109.98.105 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.105.98.109.65.clients.your-server.de
Software: nginx /
Resource Hash: 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: gzip
last-modified: Thu, 20 Jul 2023 17:04:47 GMT
server: nginx
etag: W/"64b9692f-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Tue, 19 Dec 2023 20:19:15 GMT

GET
H2 200 a-06d7.min.js Show response
b-code.liadm.com/ Frame C025 47 KB
15 KB 71ms
31ms Script
application/javascript 2600:9000:243d:5600:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:243d:5600:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 62ae8df7adbef15f0d7cc4faea7eb3f0b48f4e2f9b978a75559396ba95f6a934

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 19:28:00 GMT
content-encoding: gzip
via: 1.1 3e1c75dd4bc1e056caa1604e0e55ea30.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 2475
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: OyKwfnhQzgQPqhb0olzVkaBUHXzSS6bBrc66BqsQBFDcrfCxoNSaVQ==

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 50 KB
19 KB 175ms
95ms Script
text/javascript 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f2.1e100.net

Software

cafe /

Resource Hash

756cca29e306e66f94e7b705c45bb0bc0315d7e745c159971cbecc65e62e7d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18841
x-xss-protection: 0
server: cafe
etag: 14511532860437540159
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
73 KB 107ms
107ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9581e5219b3920c05f832b3941538ea09ca50692a14ea441bd65abdde5807b3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74490
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1390358/ Frame C025 64 KB
20 KB 228ms
208ms Script
application/javascript 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5e2edf1df13f2a3f81cf4d8be5d56a7d595b63198b409f788cc23b79b7d73b75

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: mGt6jNGAKO3W.HdIFz195jRUtZmGVtmu
content-encoding: gzip
via: 1.1 varnish
date: Tue, 19 Dec 2023 20:09:15 GMT
x-amz-request-id: 1VW9RQK2AM7WQ2J8
age: 35
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
fastly-restarts: 1
x-amz-id-2: Y2O2IaTyDH+RjSoLjTa8bd4xs6J1cEKrJlbk/pFZK/TLk/a4NBoSMuGYS6bG+mVXLAjU3gLx5wk=
x-served-by: cache-fra-eddf8230023-FRA
content-length: 19524
last-modified: Tue, 19 Dec 2023 10:06:34 GMT
server: AmazonS3
x-timer: S1703016556.645417,VS0,VE200
etag: "a247c4ee9cf1a4d3764cbb572dcfcb6f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 62
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 898

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 202 KB
73 KB 53ms
52ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

57cebbf56010ec892e48d050a6e9b7880a0f6c33c3c346198856e3d6fb89f9c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74456
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
73 KB 90ms
90ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c73d2ce037c50af9885ecc400ab8ec4546686a5bb8fab56013eb4b7ad3a5fe8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74576
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 231 KB
80 KB 111ms
111ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11388547050

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0d7ec14ee54363a39cd2e2d9d4b4831c5a81ee4b4abff76bef6fec3846651711

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81929
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2 200 deviceAtlasLmb.min.js Show response
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame C025 0
0 1532ms
1482ms Script
text/html 2606:4700::6812:94b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:94b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 206 KB
74 KB 115ms
115ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c6a68140af49d3d52d2bb57e765c1824bf8077ab8960008071e9b8609728c6dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75508
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
73 KB 118ms
118ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

904014be32019db1c8a8639f388a6c213d7110b86e706f808514a50f81042e7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74561
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 207 KB
74 KB 124ms
124ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d4c5dfa4eaa8d6f0771a291c32a2512a2a5bbf44a3d0be9c890161c83cc4eb35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75509
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 232 KB
80 KB 137ms
137ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11380533681

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

411d8911431f717d31441fa671afbb75c6d7ec3699b4b5beed03a898696dca45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81971
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame C025 41 KB
18 KB 67ms
30ms Script
application/javascript 108.157.5.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.5.251 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-5-251.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: ab12e815caea6aba8fe2da60e7d298cccb649166f81926ff64e5dc56ea526522

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: gzip
via: 1.1 ddd7d19501f4b19d560bfedbdd9b13ce.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 17610
x-amz-cf-id: Groz3ZggV8Z39TJjREU9QQXJp-BTLHR4KfYUbDvegvw-I_5vWmd6og==

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ Frame C025 18 KB
7 KB 86ms
25ms Script
application/javascript 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

ats-carp-promotion: 1, 1
date: Tue, 19 Dec 2023 19:34:36 GMT
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: MN07E2CX1G6DCQRJ
age: 2081
x-amz-server-side-encryption: AES256
content-length: 6262
x-amz-id-2: 5hOSLyK+XYkSW8sjxf7VypLpHbDFiq6eU/xDqJDO0ahIZFlPCqCE4WiOSd0NaSC0w/ij5n+g6/WfuH8VYbX2Dw==
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
server: ATS
etag: "5c6ed25dce803fd84288922b8928409e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 232 KB
80 KB 151ms
151ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f6202bcabf6c0e10a91e5786d6b188cda939b2d643bf8378b031345d4218d95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 82053
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2 200 src Show response
c.pmsrv.co/v2/conversion/ Frame C025 3 KB
4 KB 551ms
492ms Script
text/javascript 2600:9000:2315:9c00:a:8e7d:9900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:9c00:a:8e7d:9900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash: 3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:16 GMT
via: 1.1 fa544a973edca8926f95609301f23b66.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 3435
x-amz-cf-pop: DUS51-P2
x-amzn-requestid: 8c8a4059-3fd5-483d-9312-5fded3fff201
x-amzn-remapped-connection: close
x-powered-by: Express
x-cache: Miss from cloudfront
x-amz-apigw-id: QNPA8E7YSK4EfgA=
content-length: 3435
pragma: no-cache
etag: W/"d6b-sia6N7ids5ScRDuTaHkjdTsJcfc"
x-amzn-trace-id: Root=1-6581f86c-58d820877f397249772eeec8;Sampled=0;lineage=c8fdcb33:0
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
x-amzn-remapped-date: Tue, 19 Dec 2023 20:09:16 GMT
x-amz-cf-id: KC8ZWFR4jC_8rmu79xYIg11MnRnATHWi2KQwDxamRDduKKL3Rmq0Ww==
expires: -1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
73 KB 146ms
146ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

99dad0d46717cfe49d03e81f5c18954774a1e63adf907614a6b4e2805f5d2305

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74604
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 60 KB
19 KB 167ms
119ms Script
text/javascript 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-cdf265906f6dec5679b5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 00bfb9da74d6c2c325c27e60fc9aea44f272cba1b072ad7b2ba4a805c3e8d555

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: af551ea7-8d26-4be0-8f1b-53006a1344c3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 ip Show response
refinance.quickenloans.com/api/geo/ 161 B
307 B 942ms
941ms XHR
application/json 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/geo/ip

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

50720620cf7e9ce770da56c1b14dc195dc82b8196bda291ddaeaebd9f44576c9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 19 Dec 2023 20:09:16 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"a1-Wapz41YDp04BVkovl+Eu+shBoSc"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 83824840ca621942-FRA
x-xss-protection: 1; mode=block

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
110 B 230ms
230ms XHR
text/plain 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 83824840ca661942-FRA
content-length: 2
x-xss-protection: 1; mode=block

GET
H2 200 qllogo.png
content.refinance.quickenloans.com/msql/ 4 KB
4 KB 49ms
48ms Image
image/png 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/qllogo.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
via: 1.1 57eb57a4c7d431365ab5b2e18c495bf4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
strict-transport-security: max-age=2592000
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 3877
x-xss-protection: 1; mode=block
last-modified: Thu, 14 Dec 2023 07:59:19 GMT
server: cloudflare
etag: "277055237f3837abfae204219c13fa6c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 83824840da7d1942-FRA
x-amz-cf-id: xejDXQ1Ot3VtCKzMSwMlsyHD0_eGxe4Sc0qKBRoeeZzvfKNjBdxFoQ==
expires: Wed, 20 Dec 2023 00:09:15 GMT

GET
H2 200 redarrow1.png
content.refinance.quickenloans.com/msql/ 7 KB
7 KB 50ms
50ms Image
image/png 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/redarrow1.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
via: 1.1 e71b19e5341031237d6419cd8302b6ce.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
strict-transport-security: max-age=2592000
x-amz-cf-pop: LHR5-P7
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: RefreshHit from cloudfront
content-length: 6656
x-xss-protection: 1; mode=block
last-modified: Wed, 06 Dec 2023 14:06:38 GMT
server: cloudflare
etag: "55eb59d4535de0b41be9b7465ec7d9c3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 83824840da831942-FRA
x-amz-cf-id: -fUvHrWQtqzVBuBd6Qqft5qqxUA5DZciuaLKPfcgbQI37Tghg-ozew==
expires: Wed, 20 Dec 2023 00:09:15 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
33 KB 115ms
36ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:34:04 GMT
x-content-type-options: nosniff
age: 95711
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 17 Dec 2024 17:34:04 GMT

GET
H2 200 quicken_sprite_4_4_18.png
content.refinance.quickenloans.com/msql/ 75 KB
75 KB 123ms
123ms Image
image/png 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/quicken_sprite_4_4_18.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
via: 1.1 3f2f1c546e63f10a66abd1c978af36f6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: MISS
strict-transport-security: max-age=2592000
x-amz-cf-pop: AMS1-P3
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 76537
x-xss-protection: 1; mode=block
last-modified: Thu, 14 Dec 2023 07:59:19 GMT
server: cloudflare
etag: "1f80b3d1f05cc5648c262fba9d39b61a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 83824840da811942-FRA
x-amz-cf-id: bheSyhGJEF1BDXBOjc3wS16wAc3dxP7kcG1DmkcHp_AhSkt7JfFHRA==
expires: Wed, 20 Dec 2023 00:09:15 GMT

GET
H2 200 4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2
fonts.gstatic.com/s/shadowsintolighttwo/v17/ 15 KB
16 KB 156ms
77ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/shadowsintolighttwo/v17/4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 08:50:21 GMT
x-content-type-options: nosniff
age: 40734
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15832
x-xss-protection: 0
last-modified: Thu, 24 Aug 2023 20:34:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Dec 2024 08:50:21 GMT

POST
H2 200 interact Show response
adobedc.demdex.net/ee/v1/ 1 KB
1007 B 113ms
63ms Fetch
application/json 63.140.62.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://adobedc.demdex.net/ee/v1/interact?configId=b1d8d3c2-1fda-4646-9d8a-484cec8d3f55&requestId=123713d9-9bbd-4cfd-9b58-d540b55334d3

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.108 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-108.data.adobedc.net

Software

jag /

Resource Hash

360e95f8a6becbfa73ebda02e6a5815a0cacd244fc855b356ffefaeaa4f427f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 19 Dec 2023 20:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: jag
vary: Origin
content-type: application/json;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Retry-After, X-Adobe-Edge, X-Request-ID
x-adobe-edge: IRL1;6
access-control-allow-credentials: true
x-konductor: N/A
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-request-id: 123713d9-9bbd-4cfd-9b58-d540b55334d3

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7CE3
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEHTCJ7CRZTIj1F1TAudfqZA&google_cver=1
https://pixel.everesttech.net/1x1

128 B
796 B

28ms
28ms

Image
image/png

52.214.98.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.214.98.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-98-45.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 19 Dec 2023 20:09:15 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b516-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 19 Dec 2023 20:09:15 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 request.js Show response
script.anura.io/ 55 KB
20 KB 127ms
73ms Script
application/javascript 18.130.48.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/request.js?instance=3439535758&exid=4b91cc67-3fda-5df0-9591-f7907e307f94&source=affl_everflow_ql-lre_9_108&campaign=821666&174447017937

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.db98779aa11320dc7c9a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.130.48.239 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-130-48-239.eu-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

ecb3bb3edf086305f9ab10b027199b670f14ae6dd1d5032f3015e39b2412dc1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2 200 main.74d80534.js Show response
s.pinimg.com/ct/lib/ Frame C025 65 KB
19 KB 57ms
57ms Script
application/javascript 2a02:26f0:3500:88a::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.74d80534.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:88a::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 60cc60a6fcbd230def379432395199b585791ed521e2e5f595369a2193e617fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

akamai-x-true-ttl: 1209600
content-encoding: br
x-cdn: akamai
etag: "cb251578b1e91b3cc440fd1521770cc5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 18895

GET
H2 200 1736491679707345 Show response
connect.facebook.net/signals/config/ Frame C025 115 KB
31 KB 128ms
128ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1736491679707345?v=2.9.138&r=stable&domain=refinance.quickenloans.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7fcc6e4a8b8ea6e4545a158eacf8c69a9519ffce37f16f006d972a409a4be406

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 19 Dec 2023 20:09:15 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: 3mpZk/rm9MMQGurNG/Ap0nN0Khu0lttuPEenXm+pL0+ceUWUmYNnXUnHYjF006Xr1exOryDAiD4Aup+DH61LDQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 10182570.json Show response
s.yimg.com/wi/config/ Frame C025 46 B
686 B 462ms
410ms XHR
application/json 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10182570.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:17 GMT
x-amz-version-id: gZjt8nlhdk7XaZ8Bj.Nq53wtkdCTFxCc
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-request-id: WF8RG61J32K7BMKY
age: 2
x-amz-server-side-encryption: AES256
content-length: 46
x-amz-id-2: QBO6sZnGje33IQbYx0BykCdjqHkbi2NikOyKuA9wUS0y+bjbaUUu1dfPXmZJRCJlzl02NfgRRzETx7eznL3/eA==
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 23 Jan 2025 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 19 Dec 2023 19:43:42 GMT
server: ATS
etag: "f31aca15ae5b24f87583e3de167c9828"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 / Show response
ct.pinterest.com/user/ Frame C025 303 B
623 B 53ms
36ms XHR
application/json 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/user/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&cb=1703016555754&dep=2%2CPAGE_LOAD
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.74d80534.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.0.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4e7140f58b2b89a1c8ffba6df69a1e845f6e8fee48987276a7523b8244191c3e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: gzip
x-cdn: fastly
x-envoy-upstream-service-time: 0
alt-svc: h3=":443";ma=600
x-pinterest-rid: 5843701173512715
content-length: 172
pin-unauth: dWlkPVpUTmtZelE0TlRRdE5qazROaTAwWWpSaExUazBOMkl0WXpBek1URmtObU14TVdWaw
pragma: no-cache
referrer-policy: origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: 8c23f27d55c77c9c78a5d022d53a766b1295cc23
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pd2259 Show response
pix.revjet.com/track/ Frame C025 46 B
222 B 120ms
34ms Script
text/javascript 65.21.233.18
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd2259?__noscript=false&__cbf=revjet.callbacks.cb1703016555755&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.233.18 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.18.233.21.65.clients.your-server.de
Software: /
Resource Hash: ae3dd0ed87e031dd4fcf8add08992045c7180ce281954177782092337e1f7452

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 pd3876 Show response
pix.revjet.com/track/ Frame C025 46 B
223 B 119ms
33ms Script
text/javascript 65.21.233.18
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd3876?__noscript=false&__cbf=revjet.callbacks.cb1703016555756&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 65.21.233.18 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.18.233.21.65.clients.your-server.de
Software: /
Resource Hash: 16093c5a46b2fb683b849fb62e5e29d57a77db9ddf26020cfc2e69092c8a98a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 /
ct.pinterest.com/v3/ Frame C025 35 B
185 B 44ms
37ms Image
image/gif 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ct.pinterest.com/v3/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e%22%2C%22ref%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e%22%2C%22if%22%3Atrue%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%2274d80534%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1703016555764
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.0.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:15 GMT
referrer-policy: origin
x-cdn: fastly
content-type: image/gif
access-control-allow-origin: *
pinterest-version: 8c23f27d55c77c9c78a5d022d53a766b1295cc23
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 1
alt-svc: h3=":443";ma=600
x-pinterest-rid: 1687512441901788
content-length: 35
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 409e6a74-8d7f-465e-87b0-cc6eb99f3a76.js Show response
tr.snapchat.com/config/com/ Frame C025 167 B
442 B 53ms
22ms Script
application/javascript 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/config/com/409e6a74-8d7f-465e-87b0-cc6eb99f3a76.js?v=3.7.3-2312182359

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

fab51ab2765b04f5290d567a98d31b89f6ec64375ee6d29943c835572e99025c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google
server: API Gateway
content-type: application/javascript
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 167

GET
H2 200 i Show response
tr.snapchat.com/cm/ Frame B84E 0
201 B 81ms
27ms Document
text/html 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=409e6a74-8d7f-465e-87b0-cc6eb99f3a76&u_scsid=9a7d0eac-61df-4593-9e3c-3a03cb77d1ae&u_sclid=df61a722-de55-46ae-af60-cedb2b025159

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 19 Dec 2023 20:09:15 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
via: 1.1 google
x-envoy-upstream-service-time: 0

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7CE3
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEH...
https://pixel.everesttech.net/1x1

128 B
691 B

28ms
28ms

Image
image/png

52.214.98.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.214.98.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-98-45.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 19 Dec 2023 20:09:16 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b51f-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 19 Dec 2023 20:09:15 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 interact Show response
somni.quickenloans.com/ee/irl1/v1/ 436 B
1 KB 224ms
153ms Fetch
application/json 2606:4700::6812:1ba3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/ee/irl1/v1/interact?configId=b1d8d3c2-1fda-4646-9d8a-484cec8d3f55&requestId=f2a77e30-fef2-4aad-9a73-c11cd8a01df1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2606:4700::6812:1ba3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c5097d993fdbc9504c971ddab5f8a13744b8cb6f78a1c31314bfd6071c233fa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-adobe-edge: IRL1;6
x-xss-protection: 1; mode=block
x-request-id: f2a77e30-fef2-4aad-9a73-c11cd8a01df1
server: cloudflare
vary: Origin
x-frame-options: SAMEORIGIN
content-type: application/json;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Retry-After, X-Adobe-Edge, X-Request-ID
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
x-konductor: N/A
cf-ray: 838248420e086921-FRA

GET
H2 200 ct.html Show response
ct.pinterest.com/ Frame FC25 565 B
402 B 35ms
34ms Document
text/html 151.101.0.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ct.pinterest.com/ct.html
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.74d80534.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.0.84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443";ma=600
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Tue, 19 Dec 2023 20:09:15 GMT
pinterest-version: 8c23f27d55c77c9c78a5d022d53a766b1295cc23
referrer-policy: origin
x-cdn: fastly
x-envoy-upstream-service-time: 1
x-pinterest-rid: 2439473275894141

GET
H2 200 /
www.facebook.com/tr/ Frame C025 0
185 B 23ms
9ms Image
text/plain 2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com&rl=https%3A%2F%2Frefinance.quickenloans.com&if=true&ts=1703016555815&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4124&fbp=fb.1.1703016555814.1402425566&pm=1&hrl=eb2e92&it=1703016555673&coo=false&cs_cc=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 19 Dec 2023 20:09:15 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 showads.js Show response
ads.anura.io/ 0
354 B 47ms
9ms XHR
application/javascript 18.173.233.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.anura.io/showads.js?236377034207
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.233.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-233-7.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 20:36:09 GMT
content-encoding: gzip
via: 1.1 fffeeadd9939f8749b5df669fcf4e936.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: DUS51-P3
age: 84786
vary: Accept-Encoding
x-cache: Hit from cloudfront
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: application/javascript; charset=utf-8
x-amz-cf-id: l_mK9BNl-Fjh5jdXGToiKq-TJ4HDVe-gCKRJqDS5WGK_tN4mGkuDtQ==

GET
H2

200

j Show response
rp4.liadm.com/ Frame C025
Redirect Chain

https://rp.liadm.com/j?dtstmp=1703016555877&aid=a-06d7&se=e30&duid=ddc3c751f117--01hj1v4s6yber6gc7mcp2vpmpd&tna=v2.11.2&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666...
https://rp4.liadm.com/j?se=e30&duid=ddc3c751f117--01hj1v4s6yber6gc7mcp2vpmpd&aid=a-06d7&tna=v2.11.2&dtstmp=1703016555877&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpke...

13 B
318 B

341ms
108ms

XHR
application/json

34.225.218.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?se=e30&duid=ddc3c751f117--01hj1v4s6yber6gc7mcp2vpmpd&aid=a-06d7&tna=v2.11.2&dtstmp=1703016555877&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&i6=MmEwMzoxYjIwOjY6ZjAxMTo6MWU%3D
Protocol: H2
Server: 34.225.218.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-218-210.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:16 GMT
x-pixel-event-id: 690f73d4-6053-4202-9244-5a718f56e244
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: null
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 13

Redirect headers

location: https://rp4.liadm.com/j?se=e30&duid=ddc3c751f117--01hj1v4s6yber6gc7mcp2vpmpd&aid=a-06d7&tna=v2.11.2&dtstmp=1703016555877&n3pc=true&wpn=lc-bundle&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&i6=MmEwMzoxYjIwOjY6ZjAxMTo6MWU%3D
access-control-allow-origin: https://refinance.quickenloans.com
date: Tue, 19 Dec 2023 20:09:16 GMT
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7CE3
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
691 B

28ms
28ms

Image
image/png

52.214.98.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.214.98.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-98-45.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 19 Dec 2023 20:09:16 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 19 Dec 2023 20:09:15 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 110ms
110ms Ping
application/json 2600:1f18:24e6:b901:e3cd:139:2c08:808
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-QZ1O4OYJ2&batch_time=1703016555878
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:e3cd:139:2c08:808 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 3 KB
1 KB 154ms
74ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1703016555887&cv=11&fst=1703016555887&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-813495030

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

162721fee18565acfc31f802bd4d150db8fa16b429f7c95fb1396a267cfdb066

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1418
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 3 KB
1 KB 138ms
73ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1703016555902&cv=11&fst=1703016555902&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9cb041bfaf7cc9159971a41b7febf64409e311f2b4f6c4a29e7f8a4a26a12d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1415
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 194 KB
71 KB 51ms
51ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6bcd56f5e9accb778832f91ebd5adbd6cb3eaa89e9d60da500548ef09b968de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72423
x-xss-protection: 0
last-modified: Tue, 19 Dec 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 19 Dec 2023 20:09:15 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/ 3 KB
1 KB 112ms
76ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/?random=1703016555931&cv=11&fst=1703016555931&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-755089552

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

294bbc5da69015add7340bf96c97249399d9bad5fefbf1af40ddb14c1b9351fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1413
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 3 KB
1 KB 100ms
78ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1703016555945&cv=11&fst=1703016555945&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-700319321

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6b167367c07b0f87a7dc01185b1842872eccee84d1a4007dd4aa8582e2d78147

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1417
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11388547050/ 3 KB
2 KB 77ms
72ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11388547050/?random=1703016555959&cv=11&fst=1703016555959&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11388547050

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d47cda55c4905ea94f3e306a74eba1a3750649bbcfc3ee0da3b6b8b93ea2edd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1420
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 3 KB
1 KB 75ms
75ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1703016555976&cv=11&fst=1703016555976&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83a33d20da6d8827036a24cbaf7ea38f923bec71e0679c5376da4819e47f237b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1418
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 3 KB
1 KB 79ms
79ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1703016555993&cv=11&fst=1703016555993&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-857412364

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

081d8d1b844a0d158e924b9ecc8349dd46628bfee1af479fa33ad14060a7ef03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1418
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 3 KB
1 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1703016556008&cv=11&fst=1703016556008&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-865435318

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f8b16c27bd4988f20f24e72f407eed1ba4a155a8a6cf09ac0b756412738448a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1416
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11380533681/ 3 KB
1 KB 75ms
75ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11380533681/?random=1703016556025&cv=11&fst=1703016556025&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9168885163&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11380533681

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

182eb27537cfc82037a5bcd94246b08cde8159a752d0b303284b1261270a2f80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1425
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/ 3 KB
1 KB 75ms
75ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/?random=1703016556042&cv=11&fst=1703016556042&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da28b4a8a2fe096fd4ea97bb7323abea1f60845b44a3292b8a0fb3c0c47942b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1419
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/ 3 KB
1 KB 73ms
73ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/?random=1703016556058&cv=11&fst=1703016556058&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b1f697ecb57e8468d26210e9e011716bbfd009b6940bc70a092739b75da21f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1417
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p
tr.snapchat.com/ Frame C025 0
99 B 25ms
24ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 19 Dec 2023 20:09:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google
server: API Gateway
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7CE3
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

28ms
28ms

Image
image/png

52.214.98.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.214.98.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-98-45.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 19 Dec 2023 20:09:16 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 19 Dec 2023 20:09:16 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame C025 0
67 B 29ms
18ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1703016556111&ref=null&cv=20231219-7-RELEASE&tos=7&ssd=1&scd=0&mrir=u&vi=1703016556103
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-vcl-time-ms: 10
date: Tue, 19 Dec 2023 20:09:16 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7518
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v2
x-served-by: cache-fra-eddf8230023-FRA
pragma: no-cache
server: nginx
x-timer: S1703016556.128082,VS0,VE10
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame C025 0
68 B 31ms
21ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1703016556114&ref=null&cv=20231219-7-RELEASE&tos=9&ssd=1&scd=0&mrir=u&vi=1703016556103
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-vcl-time-ms: 11
date: Tue, 19 Dec 2023 20:09:16 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7580
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230023-FRA
pragma: no-cache
server: nginx
x-timer: S1703016556.128654,VS0,VE11
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame C025 0
336 B 24ms
17ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1703016556116&ref=null&cv=20231219-7-RELEASE&tos=11&ssd=1&scd=0&mrir=u&vi=1703016556103
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-vcl-time-ms: 10
date: Tue, 19 Dec 2023 20:09:16 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7500
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230023-FRA
pragma: no-cache
server: nginx
x-timer: S1703016556.127792,VS0,VE10
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 133ms
133ms Ping
application/json 2600:1f18:24e6:b901:e3cd:139:2c08:808
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-QZ1O4OYJ2&batch_time=1703016556131
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:e3cd:139:2c08:808 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 /
www.google.com/pagead/1p-user-list/813495030/ 42 B
108 B 192ms
55ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/813495030/?random=1703016555887&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_3IWja2E7PyD4w2GtbQxwuy9RUtSLZ-MGbtdUnaQtAmFmLziX&random=2675106152&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/813495030/ 42 B
108 B 186ms
49ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/813495030/?random=1703016555887&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_3IWja2E7PyD4w2GtbQxwuy9RUtSLZ-MGbtdUnaQtAmFmLziX&random=2675106152&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
108 B 193ms
56ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1703016555902&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_wTBm4rRaV_xMncIhCG6XrWLy-EAbOPMVfEnQyLRiAgVLK7Wa&random=935043646&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/966730890/ 42 B
108 B 187ms
50ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/966730890/?random=1703016555902&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_wTBm4rRaV_xMncIhCG6XrWLy-EAbOPMVfEnQyLRiAgVLK7Wa&random=935043646&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/755089552/ 42 B
455 B 190ms
54ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/755089552/?random=1703016555931&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_TVGPcqHx-ojq66AinjgtCfFoEToBrjnr75MgiZD_2aChDRoq&random=278402951&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/755089552/ 42 B
108 B 188ms
52ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/755089552/?random=1703016555931&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_TVGPcqHx-ojq66AinjgtCfFoEToBrjnr75MgiZD_2aChDRoq&random=278402951&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/700319321/ 42 B
108 B 193ms
57ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/700319321/?random=1703016555945&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_tHJUM-WNT1Q1G_6iujVbpvpZVYIKwv4_jkmuiMrmcHIc70dc&random=4283602011&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/700319321/ 42 B
455 B 184ms
48ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/700319321/?random=1703016555945&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_tHJUM-WNT1Q1G_6iujVbpvpZVYIKwv4_jkmuiMrmcHIc70dc&random=4283602011&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11388547050/ 42 B
108 B 119ms
56ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11388547050/?random=1703016555959&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_WMDsEJUYY6hqGMp7g47VKKo9XhNovbHnlM_O5lZrR7UAMbMY&random=2166820124&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/11388547050/ 42 B
108 B 80ms
72ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/11388547050/?random=1703016555959&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_WMDsEJUYY6hqGMp7g47VKKo9XhNovbHnlM_O5lZrR7UAMbMY&random=2166820124&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10866179376/ 42 B
108 B 54ms
46ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866179376/?random=1703016555976&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_-yMUwB_7MKkT8kRY4neJYV8KaC8gvXeo2J5Yp3Lc6gdyIWXE&random=681317305&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10866179376/ 42 B
108 B 59ms
57ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10866179376/?random=1703016555976&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_-yMUwB_7MKkT8kRY4neJYV8KaC8gvXeo2J5Yp3Lc6gdyIWXE&random=681317305&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/857412364/ 42 B
108 B 51ms
49ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/857412364/?random=1703016555993&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_BE3pZEhrqTEtxSNGJuNUGvu_kAPG8GjHbgm0xiROJ3RkNjNP&random=4219360737&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/857412364/ 42 B
108 B 55ms
53ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/857412364/?random=1703016555993&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_BE3pZEhrqTEtxSNGJuNUGvu_kAPG8GjHbgm0xiROJ3RkNjNP&random=4219360737&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/865435318/ 42 B
108 B 52ms
50ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865435318/?random=1703016556008&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_21OPPijZqw2S29SO50T4JXIbuB5WyCXa6q1murGV1MtH2GCP&random=1380806907&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/865435318/ 42 B
108 B 57ms
55ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/865435318/?random=1703016556008&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_21OPPijZqw2S29SO50T4JXIbuB5WyCXa6q1murGV1MtH2GCP&random=1380806907&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11380533681/ 42 B
108 B 50ms
48ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11380533681/?random=1703016556025&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9168885163&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_0FeEWpsRhijZNAc7FbOkVzu27Fbts5w4WRu70c5vgsK7dytE&random=3102010825&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/11380533681/ 42 B
108 B 56ms
55ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/11380533681/?random=1703016556025&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9168885163&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_0FeEWpsRhijZNAc7FbOkVzu27Fbts5w4WRu70c5vgsK7dytE&random=3102010825&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/ 3 KB
1 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/?random=1703016556141&cv=11&fst=1703016556141&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&auid=1812343732.1703016555&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7eec92937f93af46a938f01645c1df51ea5122944aa62754c5228c81b6cc74ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1418
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10910338944/ 42 B
108 B 49ms
47ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10910338944/?random=1703016556042&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_7girqkSBX0XH-XeMJtTF6lFUrxM9fIIgRH-xzpZOOhGSUf0e&random=3996674300&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10910338944/ 42 B
108 B 57ms
56ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10910338944/?random=1703016556042&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_7girqkSBX0XH-XeMJtTF6lFUrxM9fIIgRH-xzpZOOhGSUf0e&random=3996674300&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10866176763/ 42 B
108 B 53ms
52ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866176763/?random=1703016556058&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_cpXx31uealxVQrU_AYxc9eKerPWtZhKwR3At0ipDWy0AYyPY&random=1085522960&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10866176763/ 42 B
108 B 55ms
54ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10866176763/?random=1703016556058&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_cpXx31uealxVQrU_AYxc9eKerPWtZhKwR3At0ipDWy0AYyPY&random=1085522960&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p
tr6.snapchat.com/ Frame C025 0
42 B 36ms
25ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr6.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 19 Dec 2023 20:09:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 0
via: 1.1 google
server: API Gateway
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 response.json Show response
script.anura.io/ 141 B
479 B 147ms
106ms XHR
application/json 18.130.48.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/response.json

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.130.48.239 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-130-48-239.eu-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

e454bd3822e3893dc2f69697b74b039003c044b86a61d9caeaa286ccd94c40a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
access-control-allow-methods: POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame C025 43 B
246 B 122ms
38ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2019%20Dec%202023%2020%3A09%3A16%20GMT&n=-1&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&e=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&enc=UTF-8&yv=1.15.1&isIframe=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 19 Dec 2023 20:09:16 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame C025 43 B
632 B 121ms
37ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&e=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&enc=UTF-8&yv=1.15.1&isIframe=1&et=custom&ec=pg1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 19 Dec 2023 20:09:16 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7CE3
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

128 B
691 B

28ms
28ms

Image
image/png

52.214.98.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.214.98.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-98-45.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 19 Dec 2023 20:09:16 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "36b521-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 19 Dec 2023 20:09:16 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 /
www.google.com/pagead/1p-user-list/848879802/ 42 B
108 B 52ms
51ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848879802/?random=1703016556141&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_-bHQc3vaUXwRxn_U5jSdU1ZIFsPZmqUW6cy_GX_MrRMZs6KB&random=2019375325&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/848879802/ 42 B
108 B 59ms
58ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/848879802/?random=1703016556141&cv=11&fst=1703016000000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_-bHQc3vaUXwRxn_U5jSdU1ZIFsPZmqUW6cy_GX_MrRMZs6KB&random=2019375325&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 149ms
149ms Ping
application/json 2600:1f18:24e6:b901:e3cd:139:2c08:808
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-QZ1O4OYJ2&batch_time=1703016556341
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:e3cd:139:2c08:808 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7CE3
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WllINGF3QUFBR1FTRGdObg&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://pixel.everesttech.net/1x1

128 B
691 B

29ms
29ms

Image
image/png

52.214.98.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 52.214.98.45 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-214-98-45.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 19 Dec 2023 20:09:16 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 19 Dec 2023 20:09:16 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 click Show response
www.lmbahsj2.com/sdk/ 85 B
431 B 127ms
127ms Fetch
application/json 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/sdk/click?effp=bd77bf66f27305b12456c965edaa6150&sec_ch_ua_platform=&sec_ch_ua_platform_version=&sec_ch_ua_model=&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e&oid=9&affid=108&__cc=&async=json
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2970155709475bbab640bc32bfcad688afe8bfa80316de41f0fb4485cae4c5fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:16 GMT
via: 1.1 google
server: nginx
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
x-eflow-request-id: 04baf08a-111f-4238-814f-12c593ccd282
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

POST
H3 200 p
tr.snapchat.com/ Frame C025 0
15 B 23ms
23ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 19 Dec 2023 20:09:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google
server: API Gateway
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 161ms
161ms Ping
application/json 2600:1f18:24e6:b901:e3cd:139:2c08:808
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-QZ1O4OYJ2&batch_time=1703016556382
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:e3cd:139:2c08:808 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 119ms
119ms Ping
application/json 2600:1f18:24e6:b901:e3cd:139:2c08:808
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-QZ1O4OYJ2&batch_time=1703016556404
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:24e6:b901:e3cd:139:2c08:808 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 7CE3
Redirect Chain

https://cm.everesttech.net/cm/yh
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZYH4awAAAGQSDgNn&sigv=1&esig=1~3faa35d8729200eda73f4f0c55ace50786c2cf72

0
47 B

32ms
25ms

Image
text/plain

2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZYH4awAAAGQSDgNn&sigv=1&esig=1~3faa35d8729200eda73f4f0c55ace50786c2cf72

Protocol

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:09:16 GMT
strict-transport-security: max-age=31536000
cache-control: no-store
x-content-type-options: nosniff
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZYH4awAAAGQSDgNn&sigv=1&esig=1~3faa35d8729200eda73f4f0c55ace50786c2cf72
Date: Tue, 19 Dec 2023 20:09:16 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WllINGF3QUFBR1FTRGdObg==

170 B
188 B

46ms
46ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WllINGF3QUFBR1FTRGdObg==

Protocol

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f98.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230047-FRA
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1703016557.564343,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WllINGF3QUFBR1FTRGdObg==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 7CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZYH4awAAAGQSDgNn&expires=90

0
239 B

31ms
9ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZYH4awAAAGQSDgNn&expires=90
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-fra-eddf8230047-FRA
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1703016557.650743,VS0,VE0
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZYH4awAAAGQSDgNn&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 7CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZYH4awAAAGQSDgNn
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZYH4awAAAGQSDgNn&C=1

43 B
334 B

29ms
29ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZYH4awAAAGQSDgNn&C=1
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jMlz9u1gc6eojsmKBWJ91kxF4Cfe6wEFCgeJrOwO1NtXJkCKkDh3eRMtkZq1GFVu5EC51H2vugHrHa6%2FrzoqqtTvx3MnnOfCKDGNNuijBgwhiXQgENRszz9AbtXK4pRNNWA6pPAMGkGGkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 838248484ece2bcd-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B6NQsDuyfjkJqxy3%2BXEJDyd0hsHI58xKPtUWOSsrSk%2FJyL1rS5yX3GRLAmRBkuan3NzXVl8CwWK5PgEjLWuIkktE87fREIjPZvSKzadLrN7gFXfAZbg33IOrDzivF77hVR0mXi9i3Y1o9g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=88&external_user_id=ZYH4awAAAGQSDgNn&C=1
cache-control: no-cache
cf-ray: 83824847ee3e2bcd-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

200

bounce
ib.adnxs.com/ Frame 7CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=ZYH4awAAAGQSDgNn
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZYH4awAAAGQSDgNn

43 B
904 B

8ms
7ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZYH4awAAAGQSDgNn

Protocol

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
an-x-request-uuid: 60596609-c3d8-47bf-bda2-b98b6621aa28
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.213.155.136; 185.213.155.136; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
an-x-request-uuid: 0e804f7d-f67d-4aa8-a75f-fb27164204a8
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZYH4awAAAGQSDgNn
cache-control: no-store, no-cache, private
x-proxy-origin: 185.213.155.136; 185.213.155.136; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZYH4awAAAGQSDgNn

43 B
264 B

58ms
29ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZYH4awAAAGQSDgNn
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:17 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230047-FRA
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:16 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1703016557.951960,VS0,VE0
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZYH4awAAAGQSDgNn
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

POST
H2 200 track Show response
trc.pushnami.com/api/push/ 2 B
168 B 185ms
184ms Fetch
text/html 3.225.52.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.52.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-52-6.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: de-DE,de;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Tue, 19 Dec 2023 20:09:17 GMT
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
content-length: 2
content-type: text/html; charset=utf-8

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 317ms
102ms Preflight 3.225.52.6
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.52.6 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-52-6.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Tue, 19 Dec 2023 20:09:17 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 7CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZYH4awAAAGQSDgNn

0
225 B

52ms
15ms

Image
text/html

185.64.191.210
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZYH4awAAAGQSDgNn
Protocol: H2
Server: 185.64.191.210 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 19 Dec 2023 20:09:15 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by: cache-fra-eddf8230047-FRA
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:17 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1703016557.053459,VS0,VE0
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZYH4awAAAGQSDgNn
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET

partner
sync.search.spotxchange.com/ Frame 7CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZYH4awAAAGQSDgNn&img=1

0
0

GET
H2

200

b.php
www.facebook.com/fr/ Frame 7CE3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZYH4awAAAGQSDgNn&t=2592000&o=0

43 B
1023 B

105ms
104ms

Image
image/gif

2a03:2880:f176:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZYH4awAAAGQSDgNn&t=2592000&o=0

Protocol

Server

2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), keyboard-map=(), xr-spatial-tracking=()
date: Tue, 19 Dec 2023 12:09:17 PST
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
pragma: public
x-fb-debug: JeJO6dNki7vvYt+JKDAJ5BtLHPst1Ak+FG36qS2H5m0R1Oza9AaWVc2gtA1zszMce8yICQqHqMD4kkw051rNiQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: image/gif
origin-agent-cluster: ?0
cache-control: public, max-age=0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=()
expires: Tue, 19 Dec 2023 12:09:17 PST

Redirect headers

x-served-by: cache-fra-eddf8230047-FRA
pragma: no-cache
date: Tue, 19 Dec 2023 20:09:17 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1703016557.253581,VS0,VE0
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZYH4awAAAGQSDgNn&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame C025 0
101 B 17ms
17ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=1556&scd=0&ssd=1&est=1703016556105&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1703016557661&mrir=u&vi=1703016556103&ref=null&cv=20231219-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-vcl-time-ms: 10
date: Tue, 19 Dec 2023 20:09:17 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7279
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230023-FRA
pragma: no-cache
server: nginx
x-timer: S1703016558.666158,VS0,VE10
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame C025 0
93 B 17ms
17ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=1557&scd=0&ssd=1&est=1703016556105&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1703016557662&mrir=u&vi=1703016556103&ref=null&cv=20231219-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-vcl-time-ms: 11
date: Tue, 19 Dec 2023 20:09:17 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7999
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230023-FRA
pragma: no-cache
server: nginx
x-timer: S1703016558.666418,VS0,VE11
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame C025 0
68 B 25ms
25ms XHR
image/gif 151.101.1.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=1557&scd=0&ssd=1&est=1703016556105&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1703016557662&mrir=u&vi=1703016556103&ref=null&cv=20231219-7-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-vcl-time-ms: 18
date: Tue, 19 Dec 2023 20:09:17 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 7435
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-fra-eddf8230023-FRA
pragma: no-cache
server: nginx
x-timer: S1703016558.666840,VS0,VE18
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 18ms
17ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je3bt0v9169491831&_p=1703016555145&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=334719080.1703016555&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&_s=3&sid=1703016555&sct=1&seg=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D108%26pkey2%3D821666%26pkey3%3Dd281b3d4c4ed48f6b92aa65f7374a59e%26sourceid%3Daffl_everflow_ql-lre_9_108%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D108%26_ef_transaction_id%3Dd281b3d4c4ed48f6b92aa65f7374a59e&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=scroll&epn.percent_scrolled=90&_et=3&tfd=7195
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Dec 2023 20:09:20 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sync.search.spotxchange.com
URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZYH4awAAAGQSDgNn&img=1

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

50 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 17:05:02	Name: X-AB Value: b0abdf9f9dff4cfeb2717a9960d575ec
.liadm.com/j	1970-01-21 02:39:36	Name: lidid Value: 6a900469-c2fe-4033-89c1-33e2d4d5ec27
.quickenloans.com/	1970-01-21 01:49:12	Name: visitorId Value: 0870d112-f3e5-4b71-ab7e-6de72b3b5e92
refinance.quickenloans.com/	1970-01-21 01:49:12	Name: visitorId Value: 0870d112-f3e5-4b71-ab7e-6de72b3b5e92
refinance.quickenloans.com/	1970-01-20 17:13:41	Name: contentTarget Value: %7B%22sourceId%22%3A%22affl_everflow_ql-lre_9_108%22%7D
refinance.quickenloans.com/	1970-01-20 17:03:37	Name: _dd_s Value: rum=1&id=641f5a23-fadf-4152-b62a-f99285b1f1d1&created=1703016555202&expire=1703017455202
.demdex.net/	1970-01-20 21:22:48	Name: demdex Value: 41169317444863454642814777004463006696
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
.quickenloans.com/	1970-01-20 19:13:12	Name: _gcl_au Value: 1.1.1812343732.1703016555
.everesttech.net/	1970-01-21 01:49:12	Name: everest_g_v2 Value: g_surferid~ZYH4awAAAGQSDgNn
.agkn.com/	1970-01-21 01:49:12	Name: ab Value: 0001%3A7AcZ%2BZY8KRHKp8v6NgBNNiZf%2FOl0Iu%2FY
.dpm.demdex.net/	1970-01-20 21:22:48	Name: dpm Value: 41169317444863454642814777004463006696
.quickenloans.com/	1970-01-21 02:39:36	Name: _ga Value: GA1.1.334719080.1703016555
.quickenloans.com/	1970-01-21 02:39:36	Name: _ga_RXLL9Z7XBK Value: GS1.1.1703016555.1.1.1703016555.0.0.0
.quickenloans.com/	1970-01-21 02:39:36	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 179643557%7CMCIDTS%7C19711%7CMCMID%7C41384716531750047202836301657494710048%7CMCAAMLH-1703621355%7C6%7CMCAAMB-1703621355%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1703023755s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19718%7CvVersion%7C5.5.0
refinance.quickenloans.com/	1970-01-20 17:13:41	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNGI5MWNjNjctM2ZkYS01ZGYwLTk1OTEtZjc5MDdlMzA3Zjk0IiwidmlzaXRvcklkIjoiMDg3MGQxMTItZjNlNS00YjcxLWFiN2UtNmRlNzJiM2I1ZTkyIiwic2Vzc2lvbklkIjoiMTA1MmZlM2MtOGEwNi00MmQwLWFiZWYtNGFmMzhlMmUyNmMwIiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiIxMDgiLCJwa2V5MiI6IjgyMTY2NiIsInBrZXkzIjoiZDI4MWIzZDRjNGVkNDhmNmI5MmFhNjVmNzM3NGE1OWUiLCJzb3VyY2VJZCI6ImFmZmxfZXZlcmZsb3dfcWwtbHJlXzlfMTA4Iiwic2lkIjoiOSIsImNtcGlkIjoiOSIsImNydGlkIjoiIiwib2lkIjoiOSIsImFmZmlkIjoiMTA4IiwiX2VmX3RyYW5zYWN0aW9uX2lkIjoiZDI4MWIzZDRjNGVkNDhmNmI5MmFhNjVmNzM3NGE1OWUiLCJhZ2UiOm51bGwsImRldmljZSI6bnVsbCwiZm9yY2VOYW1lcyI6bnVsbCwiZm9yY2VJcCI6bnVsbCwiZm9yY2VUZXN0SWRzIjpudWxsLCJpbnF1aXJ5SWQiOm51bGwsImlucXVpcnlTaWduYXR1cmUiOm51bGwsImlzVGVzdCI6bnVsbCwibGV2ZWxPZkVkdWNhdGlvbiI6bnVsbCwibW9pZCI6bnVsbCwicHJvcGVydHlTdGF0ZUNvZGUiOm51bGwsInJlc29sdXRpb24iOiIiLCJ0dFRyYWNlSWQiOm51bGwsInByb3ZpZGVySWQiOm51bGwsInFscyI6bnVsbCwic3RpZCI6bnVsbCwib3ZrZXkiOm51bGwsIm92cmF3IjpudWxsLCJvdm10YyI6bnVsbCwibW9ydGdhZ2VCYWxhbmNlUmFuZ2UiOm51bGwsImRhdGVOb3ciOjE3MDMwMTY1NTUxNzUsInJhbmRvbU51bWJlciI6NTY2ODgsIm1hcmtldGluZ09mZmVySWQiOm51bGwsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDIzLTEyLTE5VDIwOjA5OjE1LjI3NVoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL3JlZmluYW5jZS5xdWlja2VubG9hbnMuY29tIiwicHJlc2VudGF0aW9uTmFtZSI6IjI4OTA1MDRfTVNRTF9MUkVfTFBfMjAyMy0xMC0xN19jYWxjdWxhdG9yX2xpbmtzIiwiZGVzdGluYXRpb25VcmwiOiJodHRwczovL3JlZmluYW5jZS5xdWlja2VubG9hbnMuY29tLz9wa2V5MT0xMDgmcGtleTI9ODIxNjY2JnBrZXkzPWQyODFiM2Q0YzRlZDQ4ZjZiOTJhYTY1ZjczNzRhNTllJnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbHJlXzlfMTA4JnNpZD05JmNtcGlkPTkmY3J0aWQ9Jm9pZD05JmFmZmlkPTEwOCZfZWZfdHJhbnNhY3Rpb25faWQ9ZDI4MWIzZDRjNGVkNDhmNmI5MmFhNjVmNzM3NGE1OWUiLCJ2ZXJ0aWNhbE5hbWUiOiJNU1FMX0xSRV9MQU5ESU5HIiwicmVmZXJyaW5nVXJpIjoiIiwiZmxvd0lkIjoiTVNRTF9MUkVfTEFORElOR19WRVJUSUNBTF9GTE9XXzEiLCJ0ZXN0SWQiOjIxNTkxODksImNsaWVudElwQWRkcmVzcyI6IjJhMDM6MWIyMDo2OmYwMTE6OjFlIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjYwOTkuMTA5IFNhZmFyaS81MzcuMzYiLCJib3QiOmZhbHNlLCJpYXQiOjE3MDMwMTY1NTV9.FgDEqgsD39S7JE1imCzW3k5U9QUB0NPEXAHc_NbGOmz2I__lwDxGi0LRWkBcpOwrO0-zfmpkoN-77-PLpPXENW5emST3v0gA-wLu0gRXuEQIMHIqBXoVXG4js5voHz5KDQMxYMB-BxknkuJ5zzxfN4Wtg0mODZ4jmbhSRSlUR6lKRK7U-S39UsI-HpVEqQaA5Malzx18Y130YX93DAB_xfsCVfuYEbc7AJ2TExRSG6xQgZv-icvjVH_4FVUk8L1kY_WlOQnu1gLeQfdNPe3eNpi0Vzbl7kvomXbPd8p2qjFpjZSdZ51luKw0H-mjvWiAEgutwHoOnTc7VjKCjd7oLQsv4efOAwkGGXMS6H1i4-rhJRqswTQrE8RCrspgIaAH2P0jamA0tvwZv2IgzK0f-Tag-OsTaURXhtMJhKajn1uNIDoYRBBAuGz6PfMvVWt3nOCzAjgwBPXoh6X6jKeFYXrUuLQbAFSf1l4r9Ak6MysMdYbQokjaQghXExXC9QSDWMst5kH2398R8fxK7cFWXBGqZmeIRl_PChqWP7cmpZN916X7LTalCTCB4-I8Bhle5XMCTqT6iXjDLXc9k2gzCOUiasdqcu2TRzuADem5Gv4W_Fc7T-YABR1P8DCf0xKj5sKg-pzzlSZlgLyZT1JftjsFU_w8NB5RQMyLbF3vLR4XfNITqN91ikmSh7vv6vDAoY2uVfoT12j9WLt-t8wDeD8MceNchMOe0HMuEHTB75sbl2PIzzGa-YD-h7sNgfh_BwBfHYiIs7fC4vPGE_iP0swE8mMc-RDyL5NcU64cMsmAKrWMic8_-5po3btiM0KQJwxBjPe4DVr19fqZA0crODYXHxMlzUavNz9_-SqyQzS25yKjBQ0UlMz-Pn5eSpMdiUnqePgAcNODvnyxc3207YTxKr1agHky0oJB4XAEhZDG3yD_1MJoDTCmXgeF_dnxbx0BdWe-B3hs-4vSn5x28kSZmbD15n-yD0rtvwggMvYd3lXui_Hyp6_A64oCM_gebS3hfr9lkkjEk6913o7dcGhYTCefBXda-rCmqhXxpz1ATMy0jfywEqEs1s4CY8KNmSKbKgjGv7Jv61zwAbWDdJ_afF00B8QOyt_iqmKboa7wYgZ2WJHubzlIeOSHepOYlfg0Qi-tKk0mhUloIGvpqFM37sOTqelTCP6R9672n3Dzi9SkV_6JUTkc6wNJxQ4Zm1ZOUoC2wjgdd65bt895zRN66gGM4DMFScoKuFnO7JQ4k3sAj5V-DnjinwmtFqWl65afwGcvjpzLma68Co3F_SvPu288x0E4xtsVFSuwmFUp2zOR0st5ExU1hU0ocNBgzieOLpXY8XhVfwfjcY8m1A
.quickenloans.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .quickenloans.com
.doubleclick.net/	1970-01-21 02:25:12	Name: IDE Value: AHWqTUmqxKSn0zq0-F_oYxCrb8deS2YUQulymN_cehzuZItydVoPTs-Dw1axnebpcGk
.quickenloans.com/	1970-01-21 02:39:36	Name: _lc2_fpi Value: ddc3c751f117--01hj1v4s6yber6gc7mcp2vpmpd
.quickenloans.com/	1970-01-21 02:39:36	Name: _lc2_fpi_meta Value: {%22w%22:1703016555742}
.quickenloans.com/	1970-01-21 02:33:23	Name: _scid Value: ff0af6b1-ec7b-4cc6-94bc-2d30c7bc7f66
.quickenloans.com/	1970-01-21 02:33:23	Name: _scid_r Value: ff0af6b1-ec7b-4cc6-94bc-2d30c7bc7f66
.quickenloans.com/	1970-01-20 17:03:38	Name: mboxEdgeCluster Value: 37
.quickenloans.com/	1970-01-20 17:03:38	Name: kndctr_5D60123F5245B13E0A490D45_AdobeOrg_cluster Value: irl1
.quickenloans.com/	1970-01-21 02:32:24	Name: kndctr_5D60123F5245B13E0A490D45_AdobeOrg_identity Value: CiY0MTM4NDcxNjUzMTc1MDA0NzIwMjgzNjMwMTY1NzQ5NDcxMDA0OFIRCM_JyZ3IMRgBKgRJUkwxMAPwAc_JyZ3IMQ==
.pinterest.com/	1970-01-21 01:49:12	Name: ar_debug Value: 1
.refinance.quickenloans.com/	1970-01-21 01:49:12	Name: _pin_unauth Value: dWlkPVpUTmtZelE0TlRRdE5qazROaTAwWWpSaExUazBOMkl0WXpBek1URmtObU14TVdWaw
.quickenloans.com/	1970-01-20 19:13:12	Name: _fbp Value: fb.1.1703016555814.1402425566
.revjet.com/	1970-01-21 02:39:36	Name: trx Value: 6063208512248505684
.everesttech.net/	1970-01-20 17:48:14	Name: ev_sync_ax Value: 20231219
.everesttech.net/	1969-12-31 23:59:59	Name: everest_session_v2 Value: ZYH4awAAAe59jF3k
.quickenloans.com/	1970-01-21 02:39:36	Name: mbox Value: session%2341384716531750047202836301657494710048%2DEDfOIb%231703018415
.quickenloans.com/	1970-01-20 17:03:38	Name: __cf_bm Value: m..DTAA7opJ9r8UEAwTGm4bJYM08DfyG75GMYJ8xuyE-1703016555-1-ATBnBgaEu6QRhV+ZXcySLXGD1TeOcSDtOIMrXoeKsQt132ATZFPmFoPXrYiRJ29KzB+RLXbmU3bQJBTnx/LUvkE=
.pmsrv.co/	1970-01-20 19:15:00	Name: _pmedia_opt-out Value: 1
.liadm.com/	1970-01-21 02:39:36	Name: lidid Value: 6a900469-c2fe-4033-89c1-33e2d4d5ec27
.yahoo.com/	1970-01-21 01:49:34	Name: A3 Value: d=AQABBGz4gWUCEGJFtYgctjmt5fxFFEu9HS4FEgEBAQFJg2WLZeAPyiMA_eMAAA&S=AQAAAl-cdAXZgoWWzsaKhLbSGDE
.everesttech.net/	1970-01-20 17:48:14	Name: ev_sync_yh Value: 20231219
www.lmbahsj2.com/	1970-01-20 17:05:02	Name: uniqueClick Value: 792f302a-86e7-43ff-b6c4-8ffbb429c3c1:1703016556
www.lmbahsj2.com/	1970-01-20 19:13:12	Name: transaction_id Value: d281b3d4c4ed48f6b92aa65f7374a59e
.quickenloans.com/	1970-01-20 17:46:48	Name: ef_witness Value: 1
.quickenloans.com/	1970-01-20 17:46:48	Name: ef_tid_c_o_9 Value: d281b3d4c4ed48f6b92aa65f7374a59e
.quickenloans.com/	1970-01-20 17:46:48	Name: ef_tid_c_a_1 Value: d281b3d4c4ed48f6b92aa65f7374a59e
.casalemedia.com/	1970-01-21 01:49:12	Name: CMID Value: ZYH4bI97SSS5pTxjZQaASQAA
.casalemedia.com/	1970-01-20 19:13:12	Name: CMPS Value: 5282
.casalemedia.com/	1970-01-20 19:13:12	Name: CMPRO Value: 5282
.adnxs.com/	1970-01-20 19:13:12	Name: uuid2 Value: 6075030771130139081
.adnxs.com/	1970-01-20 19:13:12	Name: anj Value: dTM7k!M4.FErk#WF']wIg2E?`DO0h]!@wnfH)iR8PMp-v=0Bd7dc+QFiJ%C+3aDb035PRRPa@XE(j#iP(Md+uBZ.Nkx3I%>M!]On2bKke8php!!-#!kPH:
.mortgage.quickenloans.com/	1970-01-20 17:03:38	Name: __cf_bm Value: cSqg0TD.WhGTvBG9ZS2qkE3xwbBIH6eoBiywtPauwFo-1703016557-1-AaUE3iC0yhDE22RmsfEq2sCG7GbJB8g23fYOY7/faoF6KN2uCWK4FYInzAFacmNroaXk0UEJwLZsdpB/kM/WOZM=
.demdex.net/	1970-01-20 21:22:48	Name: dextp Value: 21-1-1703016555402\|771-1-1703016555510\|1083-1-1703016555657\|1085-1-1703016555767\|1086-1-1703016555878\|1087-1-1703016556102\|1088-1-1703016556228\|19913-1-1703016556343\|83349-1-1703016556445\|144230-1-1703016556546\|144231-1-1703016556646\|144232-1-1703016556746\|144233-1-1703016556847\|144234-1-1703016556947\|144235-1-1703016557048\|144236-1-1703016557148\|144237-1-1703016557248
.refinance.quickenloans.com/	1970-01-20 17:03:38	Name: __cf_bm Value: oL0TPvZp8D0Z.YUseKyz52d.CfNAm7.o3PktwdcJ0eo-1703016557-1-AWEDpizgLSqYYueljTZreqfSz67h1hvW9zwoKVRCnE1B0DxulldYUU3Yfp7gWi0nbkvX0zXhhIVrkRpeA/oewY4=

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZYH4awAAAGQSDgNn&img=1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
other	error	URL: https://refinance.quickenloans.com/?pkey1=108&pkey2=821666&pkey3=d281b3d4c4ed48f6b92aa65f7374a59e&sourceid=affl_everflow_ql-lre_9_108&sid=9&cmpid=9&crtid=&oid=9&affid=108&_ef_transaction_id=d281b3d4c4ed48f6b92aa65f7374a59e Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
adobedc.demdex.net
ads.anura.io
ads.revjet.com
ads.yahoo.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
content.refinance.quickenloans.com
cs-cdn.deviceatlas.com
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
fonts.cdnfonts.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
pix.revjet.com
pixel.everesttech.net
pixel.rubiconproject.com
psp.pushnami.com
quicken.demdex.net
refinance.quickenloans.com
region1.google-analytics.com
rp.liadm.com
rp4.liadm.com
rum-http-intake.logs.datadoghq.com
s.pinimg.com
s.yimg.com
sc-static.net
script.anura.io
somni.quickenloans.com
somni.rocketmortgage.com
sp.analytics.yahoo.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
sync-tm.everesttech.net
sync.search.spotxchange.com
tr.snapchat.com
tr6.snapchat.com
trackpixel.refinance.quickenloans.com
trc.pushnami.com
trc.taboola.com
us-u.openx.net
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
sync.search.spotxchange.com
108.157.5.251
151.101.0.84
151.101.1.44
151.101.66.49
172.217.23.98
172.64.151.101
18.130.48.239
18.154.63.17
18.154.63.95
18.173.225.115
18.173.233.7
18.195.197.47
185.64.191.210
2001:4860:4802:32::36
212.82.100.181
216.58.206.34
2600:1f18:24e6:b901:e3cd:139:2c08:808
2600:1f18:730:b120:12e:9f8f:e13b:3343
2600:9000:2315:9c00:a:8e7d:9900:93a1
2600:9000:243d:5600:8:8845:1500:93a1
2606:4700::6810:3965
2606:4700::6812:1ba3
2606:4700::6812:94b
2606:4700::6812:c2b
2606:4700:e4::ac40:a21d
2a00:1288:80:807::2
2a00:1450:4001:803::2003
2a00:1450:4001:810::2004
2a00:1450:4001:813::2003
2a00:1450:4001:828::2002
2a00:1450:4001:82f::2008
2a00:1450:4001:831::200a
2a02:26f0:3500:580::1e80
2a02:26f0:3500:88a::1931
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
3.225.52.6
34.225.218.210
34.255.242.39
34.98.64.218
35.190.43.134
35.201.76.131
37.252.173.215
52.214.98.45
52.58.191.183
54.74.162.209
54.84.223.12
63.140.62.108
63.140.62.22
65.109.98.105
65.21.233.18
69.173.144.139
00bfb9da74d6c2c325c27e60fc9aea44f272cba1b072ad7b2ba4a805c3e8d555
02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9
081d8d1b844a0d158e924b9ecc8349dd46628bfee1af479fa33ad14060a7ef03
0a62530dd1701bdc8d1b3ece6ee812c57c812833d0eecc9163987c8a211b52f0
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d
0d7ec14ee54363a39cd2e2d9d4b4831c5a81ee4b4abff76bef6fec3846651711
0dd1971699f19f33219608023cd1f3294e8c0bed22cd575610c85644e5942271
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
12ee117325990965090cc5c5dfa8117e8866e93c4fdf72fd1f08f24f0b621925
16093c5a46b2fb683b849fb62e5e29d57a77db9ddf26020cfc2e69092c8a98a7
162721fee18565acfc31f802bd4d150db8fa16b429f7c95fb1396a267cfdb066
182eb27537cfc82037a5bcd94246b08cde8159a752d0b303284b1261270a2f80
1a8e8324e07c5c4216ad113239cfbba5cf7aad11fe45fc21ad17e5c8bf8d9795
1f6202bcabf6c0e10a91e5786d6b188cda939b2d643bf8378b031345d4218d95
1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
294bbc5da69015add7340bf96c97249399d9bad5fefbf1af40ddb14c1b9351fc
2970155709475bbab640bc32bfcad688afe8bfa80316de41f0fb4485cae4c5fa
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
360e95f8a6becbfa73ebda02e6a5815a0cacd244fc855b356ffefaeaa4f427f9
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae
411d8911431f717d31441fa671afbb75c6d7ec3699b4b5beed03a898696dca45
4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91
4b1f697ecb57e8468d26210e9e011716bbfd009b6940bc70a092739b75da21f6
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e7140f58b2b89a1c8ffba6df69a1e845f6e8fee48987276a7523b8244191c3e
4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b
50720620cf7e9ce770da56c1b14dc195dc82b8196bda291ddaeaebd9f44576c9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cebbf56010ec892e48d050a6e9b7880a0f6c33c3c346198856e3d6fb89f9c9
5e2edf1df13f2a3f81cf4d8be5d56a7d595b63198b409f788cc23b79b7d73b75
60cc60a6fcbd230def379432395199b585791ed521e2e5f595369a2193e617fb
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
62ae8df7adbef15f0d7cc4faea7eb3f0b48f4e2f9b978a75559396ba95f6a934
6596ea36bf758c2f1d6dd8d40249ab6dae02d46a4aa02c393d65acb0fab0866f
6b167367c07b0f87a7dc01185b1842872eccee84d1a4007dd4aa8582e2d78147
6d0e42e206210734979280d54ae436cb3d3858e91f53f29ebfaf04f40e1649c4
756cca29e306e66f94e7b705c45bb0bc0315d7e745c159971cbecc65e62e7d3f
75a0eb62f648249c345fb2cc0f68ede6d83a790887abdee112cd6d1bb38cb042
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7eec92937f93af46a938f01645c1df51ea5122944aa62754c5228c81b6cc74ed
7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5
7fcc6e4a8b8ea6e4545a158eacf8c69a9519ffce37f16f006d972a409a4be406
83a33d20da6d8827036a24cbaf7ea38f923bec71e0679c5376da4819e47f237b
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
8c5097d993fdbc9504c971ddab5f8a13744b8cb6f78a1c31314bfd6071c233fa
8f39a2061c1020d178e81f82e72d9b52fb89610d33478a67942af079707f3bc7
904014be32019db1c8a8639f388a6c213d7110b86e706f808514a50f81042e7b
9280647a0566dd533eee81096561ecd5712a52e0b9bf323da2b303ad184d28c2
9581e5219b3920c05f832b3941538ea09ca50692a14ea441bd65abdde5807b3c
99dad0d46717cfe49d03e81f5c18954774a1e63adf907614a6b4e2805f5d2305
a6bcd56f5e9accb778832f91ebd5adbd6cb3eaa89e9d60da500548ef09b968de
ab12e815caea6aba8fe2da60e7d298cccb649166f81926ff64e5dc56ea526522
ae3dd0ed87e031dd4fcf8add08992045c7180ce281954177782092337e1f7452
afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4759a91e08e1ca5f28ebc48ce581513ea09c7f4b5b453cf725512244aa02a85
b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c6659e8919d1cde02448dce70dfd9ef0d9b3ba4d416fd904ab564baff472c1ca
c6a68140af49d3d52d2bb57e765c1824bf8077ab8960008071e9b8609728c6dd
c73d2ce037c50af9885ecc400ab8ec4546686a5bb8fab56013eb4b7ad3a5fe8f
c9cb041bfaf7cc9159971a41b7febf64409e311f2b4f6c4a29e7f8a4a26a12d7
d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321
d47cda55c4905ea94f3e306a74eba1a3750649bbcfc3ee0da3b6b8b93ea2edd8
d4c5dfa4eaa8d6f0771a291c32a2512a2a5bbf44a3d0be9c890161c83cc4eb35
d5affff87cbf96f15e9d5b4e2576c20dff194831516d5d3357d11e07425d3bcb
da28b4a8a2fe096fd4ea97bb7323abea1f60845b44a3292b8a0fb3c0c47942b0
dcaf7fe14f777b4d06a3c9c2544e764fe4b8a85c0f4572161e5ffa42aecb37ca
dcf6c8f4f1e21735328826e20d2cf2cf3a47bae76be1a0e4eda254346f233e55
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e454bd3822e3893dc2f69697b74b039003c044b86a61d9caeaa286ccd94c40a8
e50f4117972838fbf7a7460d9e4d103842d1df99d2a2bab935b3bd8cf677dd54
ead030154a651dbf216d5c043e974bb3f78b640078472f63d4277db7deb1faae
ecb3bb3edf086305f9ab10b027199b670f14ae6dd1d5032f3015e39b2412dc1c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef45c21f7e054481c81992c1a46293a28c9bb8b3722bc566479326187f473c8c
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0
f83b1a3ea61ad62e47fad82de5495a2547e2f12e591ad8108050538c566ae1e3
f841a3dc1291a53e65c17931f3569cb5c2a956f1a1222b93b46c7881b6fce7fd
f8b16c27bd4988f20f24e72f407eed1ba4a155a8a6cf09ac0b756412738448a2
fab51ab2765b04f5290d567a98d31b89f6ec64375ee6d29943c835572e99025c
fe49fc14b70cfc4f3edbc08e58087ca0f6e948a953c3eaeabdc7e78f512e5a22

refinance.quickenloans.com Open in urlscan Pro 2606:4700::6812:c2b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

154 Requests

86 %HTTPS

40 %IPv6

41 Domains

60 Subdomains

49 IPs

5 Countries

2014 kBTransfer

6067 kBSize

50 Cookies

20 Outgoing links

Redirected requests

154 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:c2b Public Scan

Screenshot
Live screenshot

Full Image

154
Requests

86 %
HTTPS

40 %
IPv6

41
Domains

60
Subdomains

49
IPs

5
Countries

2014 kB
Transfer

6067 kB
Size

50
Cookies

154 HTTP transactions
0 data transactions