refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:d2b Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://echo4.bluehornet.com/ct/102343045:TjwABiGNx:m:1:3673644272:C460494B4F8F66417CCBCFBB15987927:r
Effective URL:
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cm...
Submission: On September 18 via manual (September 18th 2023, 1:09:34 pm UTC) from US — Scanned from US

Summary HTTP 156 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 53 IPs in 3 countries across 46 domains to perform 156 HTTP transactions. The main IP is 2606:4700::6812:d2b, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 20th 2022. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.184.143.209 54.184.143.209	16509 (AMAZON-02) (AMAZON-02)
1 1	34.36.162.171 34.36.162.171	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 3	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
14	2606:4700::68... 2606:4700::6812:d2b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.239.183.117 18.239.183.117	16509 (AMAZON-02) (AMAZON-02)
1	3.18.206.181 3.18.206.181	16509 (AMAZON-02) (AMAZON-02)
4	2600:141b:f00... 2600:141b:f000:c0b4::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	18.160.18.24 18.160.18.24	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:402... 2607:f8b0:4020:807::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3965	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 5	52.55.2.158 52.55.2.158	14618 (AMAZON-AES) (AMAZON-AES)
1	108.139.53.136 108.139.53.136	16509 (AMAZON-02) (AMAZON-02)
19	2607:f8b0:402... 2607:f8b0:4020:804::2008	15169 (GOOGLE) (GOOGLE)
1	34.202.55.199 34.202.55.199	14618 (AMAZON-AES) (AMAZON-AES)
1 3	52.46.143.56 52.46.143.56	16509 (AMAZON-02) (AMAZON-02)
1 3	172.217.13.162 172.217.13.162	15169 (GOOGLE) (GOOGLE)
3 14	2607:f8b0:402... 2607:f8b0:4020:804::2002	15169 (GOOGLE) (GOOGLE)
14	2607:f8b0:400... 2607:f8b0:4006:81c::2004	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:402... 2607:f8b0:4020:804::2003	15169 (GOOGLE) (GOOGLE)
2	44.216.88.67 44.216.88.67	14618 (AMAZON-AES) (AMAZON-AES)
1	52.54.223.166 52.54.223.166	14618 (AMAZON-AES) (AMAZON-AES)
2	63.140.38.113 63.140.38.113	14618 (AMAZON-AES) (AMAZON-AES)
8 8	54.92.195.210 54.92.195.210	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.38.225 63.140.38.225	14618 (AMAZON-AES) (AMAZON-AES)
2	2607:f8b0:400... 2607:f8b0:4006:809::200e	15169 (GOOGLE) (GOOGLE)
4 4	172.217.13.166 172.217.13.166	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:402... 2607:f8b0:4020:805::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::15	15169 (GOOGLE) (GOOGLE)
1	18.238.25.49 18.238.25.49	16509 (AMAZON-02) (AMAZON-02)
1 1	3.160.22.127 3.160.22.127	16509 (AMAZON-02) (AMAZON-02)
7 8	172.217.13.194 172.217.13.194	15169 (GOOGLE) (GOOGLE)
6 12	54.236.156.168 54.236.156.168	14618 (AMAZON-AES) (AMAZON-AES)
2	2600:1400:d:5... 2600:1400:d:5a9::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	72.251.228.33 72.251.228.33	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1	2600:9000:23c... 2600:9000:23cb:7200:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
10	151.101.65.44 151.101.65.44	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:84b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2001:4998:14:... 2001:4998:14:800::1000	14777 (YAHOO) (YAHOO)
1	2a04:4e42::396 2a04:4e42::396	54113 (FASTLY) (FASTLY)
1	13.225.63.247 13.225.63.247	16509 (AMAZON-02) (AMAZON-02)
4	104.77.9.10 104.77.9.10	16625 (AKAMAI-AS) (AKAMAI-AS)
2	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
1	2600:9000:251... 2600:9000:2514:1000:a:8e7d:9900:93a1	16509 (AMAZON-02) (AMAZON-02)
1	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
2	15.204.180.50 15.204.180.50	16276 (OVH) (OVH)
2	52.205.43.200 52.205.43.200	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	76.13.32.146 76.13.32.146	26101 (YAHOO-BF1) (YAHOO-BF1)
1 1	2600:1f18:730... 2600:1f18:730:b120:ec5e:651e:a0cc:77a3	14618 (AMAZON-AES) (AMAZON-AES)
1	100.24.159.94 100.24.159.94	14618 (AMAZON-AES) (AMAZON-AES)
2	104.77.220.247 104.77.220.247	16625 (AKAMAI-AS) (AKAMAI-AS)
7 7	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	104.18.27.193 104.18.27.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	68.67.179.155 68.67.179.155	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	8.28.7.83 8.28.7.83	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2	34.193.178.107 34.193.178.107	14618 (AMAZON-AES) (AMAZON-AES)
156	53

1 54.184.143.209 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-184-143-209.us-west-2.compute.amazonaws.com

echo4.bluehornet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.36.162.171 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 171.162.36.34.bc.googleusercontent.com

www.npvnt7trk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.76.131 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:4700::6812:d2b (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.183.117 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-183-117.bos50.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.18.206.181 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-18-206-181.us-east-2.compute.amazonaws.com

cs-cdn.deviceatlas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:141b:f000:c0b4::1e80 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.160.18.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-18-24.iad12.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4020:807::200a (Montreal, Canada)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3965 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.55.2.158 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-55-2-158.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.53.136 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-53-136.jfk50.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2607:f8b0:4020:804::2008 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.202.55.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-55-199.compute-1.amazonaws.com

pixel1083.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.46.143.56 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.13.162 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2607:f8b0:4020:804::2002 (Montreal, Canada) 3 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2607:f8b0:4006:81c::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4020:804::2003 (Montreal, Canada)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.216.88.67 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-216-88-67.compute-1.amazonaws.com

script.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.54.223.166 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-223-166.compute-1.amazonaws.com

quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.38.113 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-113.data.adobedc.net

somni.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.92.195.210 (Ashburn, United States) 8 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-92-195-210.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.38.225 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-225.data.adobedc.net

quickenloans.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:809::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.13.166 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4020:805::2002 (Montreal, Canada)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::15 (United States)

ASN15169 (GOOGLE, US)

sgtm.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.25.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-25-49.cmh68.r.cloudfront.net

ads.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.160.22.127 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-3-160-22-127.cmh68.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.217.13.194 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: yul03s05-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 54.236.156.168 (Ashburn, United States) 6 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-236-156-168.compute-1.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1400:d:5a9::1931 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.251.228.33 (United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: mantis002-nyj.tokbox.com

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23cb:7200:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.65.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:84b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mortgage.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2001:4998:14:800::1000 (United States)

ASN14777 (YAHOO, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.63.247 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-247.ewr53.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.77.9.10 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-77-9-10.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

cdn1.decide.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn1.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2514:1000:a:8e7d:9900:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.pmsrv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.204.180.50 (Reston, United States)

ASN16276 (OVH, FR)
PTR: ext.svh244.incmdb.net

pix.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.205.43.200 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-43-200.compute-1.amazonaws.com

psp.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 76.13.32.146 (Lockport, United States)

ASN26101 (YAHOO-BF1, US)
PTR: spdc.pbp.vip.bf1.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b120:ec5e:651e:a0cc:77a3 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 100.24.159.94 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-24-159-94.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.77.220.247 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-77-220-247.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.66.49 (United States) 7 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.27.193 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.179.155 (North Bergen, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.193.178.107 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-178-107.compute-1.amazonaws.com

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	everesttech.net 21 redirects pixel1083.everesttech.net cm.everesttech.net — Cisco Umbrella Rank: 1990 pixel.everesttech.net — Cisco Umbrella Rank: 7943 sync-tm.everesttech.net — Cisco Umbrella Rank: 1237	11 KB
26	doubleclick.net 14 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 66 ad.doubleclick.net — Cisco Umbrella Rank: 180 cm.g.doubleclick.net — Cisco Umbrella Rank: 329	22 KB
19	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 111	1 MB
17	quickenloans.com refinance.quickenloans.com static-msql-prod.refinance.quickenloans.com trackpixel.refinance.quickenloans.com content.refinance.quickenloans.com somni.quickenloans.com — Cisco Umbrella Rank: 680106 cdn.mortgage.quickenloans.com	316 KB
16	google.com www.google.com — Cisco Umbrella Rank: 11 adservice.google.com — Cisco Umbrella Rank: 182	2 KB
10	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 1262 trc.taboola.com — Cisco Umbrella Rank: 907	22 KB
6	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 319 quicken.demdex.net — Cisco Umbrella Rank: 194145	9 KB
6	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 5657 psp.pushnami.com — Cisco Umbrella Rank: 29567 trc.pushnami.com — Cisco Umbrella Rank: 5815	20 KB
4	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1943 ads.yahoo.com — Cisco Umbrella Rank: 11896	1 KB
4	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 2721	8 KB
4	yimg.com s.yimg.com — Cisco Umbrella Rank: 814	14 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 113	3 KB
4	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 626	112 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 4242 rp.liadm.com — Cisco Umbrella Rank: 2359 rp4.liadm.com — Cisco Umbrella Rank: 5359	15 KB
3	revjet.com ads.revjet.com — Cisco Umbrella Rank: 6451 pix.revjet.com — Cisco Umbrella Rank: 5655	9 KB
3	anura.io script.anura.io — Cisco Umbrella Rank: 56830 ads.anura.io — Cisco Umbrella Rank: 74633	20 KB
3	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 178	20 KB
3	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 429	3 KB
3	lmbahsj2.com 1 redirects www.lmbahsj2.com	19 KB
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 863	500 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 360	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 1026	1 KB
2	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 1031	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 109	863 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 229	83 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 1150	20 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 96	21 KB
2	gstatic.com fonts.gstatic.com	48 KB
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 1547	452 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 649	755 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 2076	637 B
1	lockerdomecdn.com cdn1.lockerdomecdn.com — Cisco Umbrella Rank: 42043	777 B
1	pmsrv.co c.pmsrv.co — Cisco Umbrella Rank: 128594	4 KB
1	decide.dev cdn1.decide.dev — Cisco Umbrella Rank: 40358	624 B
1	sc-static.net sc-static.net — Cisco Umbrella Rank: 1100	17 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1759	8 KB
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 936	634 B
1	lowermybills.com sgtm.lowermybills.com	550 B
1	omtrdc.net quickenloans.tt.omtrdc.net — Cisco Umbrella Rank: 362616	853 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 2469	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1476	7 KB
1	deviceatlas.com cs-cdn.deviceatlas.com — Cisco Umbrella Rank: 186698	22 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 6049	7 KB
1	npvnt7trk.com 1 redirects www.npvnt7trk.com	467 B
1	bluehornet.com 1 redirects echo4.bluehornet.com — Cisco Umbrella Rank: 164352	801 B
0	spotxchange.com Failed sync.search.spotxchange.com Failed
156	46

	Domain	Requested by
19	www.googletagmanager.com	refinance.quickenloans.com assets.adobedtm.com www.googletagmanager.com trackpixel.refinance.quickenloans.com
14	www.google.com	refinance.quickenloans.com
14	googleads.g.doubleclick.net	3 redirects www.googletagmanager.com
12	pixel.everesttech.net	6 redirects
9	trc.taboola.com	cdn.taboola.com
8	cm.g.doubleclick.net	7 redirects
8	cm.everesttech.net	8 redirects
7	sync-tm.everesttech.net	7 redirects
5	content.refinance.quickenloans.com	refinance.quickenloans.com static-msql-prod.refinance.quickenloans.com
5	dpm.demdex.net	1 redirects refinance.quickenloans.com
5	refinance.quickenloans.com	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
4	pixel.mathtag.com	trackpixel.refinance.quickenloans.com pixel.mathtag.com refinance.quickenloans.com
4	s.yimg.com	refinance.quickenloans.com www.datadoghq-browser-agent.com s.yimg.com
4	ad.doubleclick.net	4 redirects
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
4	assets.adobedtm.com	refinance.quickenloans.com assets.adobedtm.com
3	sp.analytics.yahoo.com	refinance.quickenloans.com
3	www.googleadservices.com	1 redirects www.googletagmanager.com trackpixel.refinance.quickenloans.com
3	s.amazon-adsystem.com	1 redirects refinance.quickenloans.com
3	www.lmbahsj2.com	1 redirects trackpixel.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	trc.pushnami.com	www.datadoghq-browser-agent.com
2	us-u.openx.net	1 redirects
2	ib.adnxs.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	ct.pinterest.com	s.pinimg.com refinance.quickenloans.com
2	www.facebook.com	refinance.quickenloans.com
2	psp.pushnami.com	www.datadoghq-browser-agent.com
2	pix.revjet.com	ads.revjet.com
2	connect.facebook.net	refinance.quickenloans.com connect.facebook.net
2	s.pinimg.com	refinance.quickenloans.com s.pinimg.com
2	adservice.google.com	refinance.quickenloans.com
2	www.google-analytics.com	www.googletagmanager.com www.datadoghq-browser-agent.com
2	somni.quickenloans.com	www.datadoghq-browser-agent.com assets.adobedtm.com
2	script.anura.io	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	fonts.gstatic.com	fonts.googleapis.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
1	image2.pubmatic.com
1	pixel.rubiconproject.com
1	ads.yahoo.com
1	rp4.liadm.com	refinance.quickenloans.com
1	rp.liadm.com	1 redirects
1	alb.reddit.com
1	cdn1.lockerdomecdn.com	trackpixel.refinance.quickenloans.com
1	c.pmsrv.co	trackpixel.refinance.quickenloans.com
1	cdn1.decide.dev	trackpixel.refinance.quickenloans.com
1	sc-static.net	refinance.quickenloans.com
1	www.redditstatic.com	refinance.quickenloans.com
1	cdn.mortgage.quickenloans.com	trackpixel.refinance.quickenloans.com
1	cdn.taboola.com	refinance.quickenloans.com
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	refinance.quickenloans.com
1	aa.agkn.com	1 redirects
1	ads.anura.io	www.datadoghq-browser-agent.com
1	sgtm.lowermybills.com	www.datadoghq-browser-agent.com
1	quickenloans.tt.omtrdc.net	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	pixel1083.everesttech.net	refinance.quickenloans.com
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	cs-cdn.deviceatlas.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
1	www.npvnt7trk.com	1 redirects
1	echo4.bluehornet.com	1 redirects
0	sync.search.spotxchange.com Failed
156	66

This site contains links to these domains. Also see Links.

Domain
www.lowermybills.com
privacyportal-cdn.onetrust.com
www.fhfa.gov
capitalmarkets.fanniemae.com
www.nmlsconsumeraccess.org
www.rocketmortgage.com
www.remodelingcalculator.org
www.nytimes.com
www.lendingtree.com
marketing.lowermybills.com

Subject Issuer	Validity	Valid
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2022-12-20` - `2023-12-20`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M02	`2023-02-02` - `2024-03-02`	a year	crt.sh
*.deviceatlas.com Go Daddy Secure Certificate Authority - G2	`2023-03-04` - `2024-04-04`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
*.pushnami.com Amazon RSA 2048 M01	`2023-03-04` - `2024-04-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-14` - `2024-01-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.tmogul.com Amazon RSA 2048 M01	`2023-05-16` - `2024-06-13`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
script.anura.io Amazon RSA 2048 M01	`2023-04-24` - `2024-05-21`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
somni.quickenloans.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-14` - `2024-04-13`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2023-08-22` - `2024-09-21`	a year	crt.sh
sgtm.lowermybills.com GTS CA 1D4	`2023-09-02` - `2023-12-01`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
ads.anura.io Amazon RSA 2048 M01	`2023-05-30` - `2024-06-27`	a year	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-07` - `2024-08-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-06-27` - `2023-09-25`	3 months	crt.sh
*.revjet.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-04-11`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M02	`2023-02-28` - `2024-01-30`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2022-12-08` - `2023-12-31`	a year	crt.sh
mortgage.quickenloans.com Cloudflare Inc ECC CA-3	`2022-11-10` - `2023-11-10`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-08-14` - `2023-10-04`	2 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-25` - `2024-02-21`	6 months	crt.sh
sc-static.net Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
pixel.mathtag.com DigiCert TLS RSA SHA256 2020 CA1	`2023-05-07` - `2024-05-07`	a year	crt.sh
cdn1.decide.dev R3	`2023-09-03` - `2023-12-02`	3 months	crt.sh
pmsrv.co Amazon RSA 2048 M02	`2023-09-16` - `2024-10-14`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2023-04-28` - `2024-05-13`	a year	crt.sh
cdn1.lockerdomecdn.com R3	`2023-09-03` - `2023-12-02`	3 months	crt.sh
s.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-03` - `2024-02-19`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-01` - `2024-02-28`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-05-30` - `2023-11-22`	6 months	crt.sh
*.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Frame ID: 9235CCF9A5DA373D543ECBD5517BB5E2
Requests: 98 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: F931D58736924F40ECFDDB6701B5EB4D
Requests: 19 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: 4289E9C23FB8FDE14A1DBBD0AC651D2D
Requests: 34 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: 1E3B7A9B0620831C0EA7CECA25981ED3
Requests: 1 HTTP requests in this frame

Frame: https://pixel.mathtag.com/sync/iframe?mt_uuid=38f46508-4c09-4d00-ad83-0286dec2ba7e&no_iframe=1&mt_adid=245296&source=mathtag
Frame ID: 2DEE07D98C44826C5BF734E9C388A5FB
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Refinance Mortgage, Refinancing Rates, Mortgage Rates

Page URL History Show full URLs

http://echo4.bluehornet.com/ct/102343045:TjwABiGNx:m:1:3673644272:C460494B4F8F66417CCBCFBB15987927:r HTTP 302
https://www.npvnt7trk.com/3J67C/79C6G4/?sub1=A20916 HTTP 302
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=043633dfaff64f4db59ead26df1bb9d1 HTTP 302
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

156
Requests

83 %
HTTPS

34 %
IPv6

46
Domains

66
Subdomains

53
IPs

3
Countries

2217 kB
Transfer

6240 kB
Size

68
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.lowermybills.com/legal/stateprivacy/
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: https://capitalmarkets.fanniemae.com/media/20371/display
Title: https://capitalmarkets.fanniemae.com/media/20371/display

Search URL Search Domain Scan URL

URL: https://www.nmlsconsumeraccess.org/
Title: www.NMLSConsumerAccess.org

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/email-policy
Title: E-Mail Policy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/security-privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/disclosures-licenses
Title: Disclosures and Licenses

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/opt-out?show=email
Title: Communication Opt-Out

Search URL Search Domain Scan URL

URL: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/
Title: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates
Title: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates

Search URL Search Domain Scan URL

URL: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/
Title: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/

Search URL Search Domain Scan URL

URL: https://www.lowermybills.com/legal/terms/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.lowermybills.com/legal/privacy/
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://www.lowermybills.com/legal/licenses/
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://www.lowermybills.com/legal/ad-targeting/
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://marketing.lowermybills.com/api/marketing/redirect?uid=214966&prd=MS
Title: Go To LowerMyBills

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://echo4.bluehornet.com/ct/102343045:TjwABiGNx:m:1:3673644272:C460494B4F8F66417CCBCFBB15987927:r HTTP 302
https://www.npvnt7trk.com/3J67C/79C6G4/?sub1=A20916 HTTP 302
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=043633dfaff64f4db59ead26df1bb9d1 HTTP 302
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1695042568017 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1695042568017

Request Chain 21

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894 HTTP 302
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Request Chain 22

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=CEwIZZPRGMWNoPMPzvqGmA8&random=1540127014&sscte=1&crd=CKG4sQI&pscrd=IhMIk_Ws0Z20gQMVxQZoCB1OvQHz HTTP 302
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1540127014&sscte=1&crd=CKG4sQI&pscrd=IhMIk_Ws0Z20gQMVxQZoCB1OvQHz&is_vtc=1&ocp_id=CEwIZZPRGMWNoPMPzvqGmA8&random=1516005530

Request Chain 36

https://cm.everesttech.net/cm/dd?d_uuid=31366899561828374250697598167542927278 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZQhMCAAABMafLGzY&d_uuid=31366899561828374250697598167542927278

Request Chain 44

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=224440235.1695042569;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CKbjytGdtIEDFWEeigMdXKUGRQ;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=224440235.1695042569;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CKbjytGdtIEDFWEeigMdXKUGRQ;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408

Request Chain 45

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=224440235.1695042569;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CPDnytGdtIEDFZ_tKAUdY7sOCw;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=224440235.1695042569;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CPDnytGdtIEDFZ_tKAUdY7sOCw;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408

Request Chain 50

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=31366899561828374250697598167542927278 HTTP 302
https://dpm.demdex.net/ibs:dpid=21&dpuuid=214270604643006552279

Request Chain 52

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=1070626598&cv=11&fst=1695042568799&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=CEwIZd70Moab_gSr5J7IBw&sscte=1&crd=CKG4sQI&pscrd=Ek5DaEVJOE9xZnFBWVF4Zm14X2UySi05Q3JBUklsQUpDSWZhamxsUlB5dExqakNBNE1ZWEprWVZMWDZNOWc2T2pMa0pRcDJIbmRHcVhiNXcaV0NoQUk4T3FmcUFZUXBkanhndS1GcThrZUVpMEEwQ3NKbm5yWWVfb3VKN0RUS2k2QmNZQXNTaWROMVBDeXBvSzJEX2JiRzJQb1dVX2RNYmJzLTVmZUdUMCITCN6Yx9GdtIEDFYaNnwodK7IHeQ HTTP 302
https://www.google.com/pagead/1p-conversion/1062919768/?random=1070626598&cv=11&fst=1695042568799&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CKG4sQI&pscrd=Ek5DaEVJOE9xZnFBWVF4Zm14X2UySi05Q3JBUklsQUpDSWZhamxsUlB5dExqakNBNE1ZWEprWVZMWDZNOWc2T2pMa0pRcDJIbmRHcVhiNXcaV0NoQUk4T3FmcUFZUXBkanhndS1GcThrZUVpMEEwQ3NKbm5yWWVfb3VKN0RUS2k2QmNZQXNTaWROMVBDeXBvSzJEX2JiRzJQb1dVX2RNYmJzLTVmZUdUMCITCN6Yx9GdtIEDFYaNnwodK7IHeQ&is_vtc=1&ocp_id=CEwIZd70Moab_gSr5J7IBw&cid=CAQSKQBpAlJWYw_1j9r2s6yYCvQKnZB-E1OaJHDdKWWvh6euJ-MVs7hkKHE3&random=3817422041

Request Chain 53

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935 HTTP 302
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=809539622

Request Chain 54

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MzEzNjY4OTk1NjE4MjgzNzQyNTA2OTc1OTgxNjc1NDI5MjcyNzg= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEI2XhPfX9S8p_ZLXgPUimSU&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 55

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESECA5BNGmPROhpcde771Y-LQ&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 86

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESECA5BNGmPROhpcde771Y-LQ&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 92

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESEN6gJbo0OFVD2Si_KMyyPjs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 107

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESEN6gJbo0OFVD2Si_KMyyPjs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 119

https://rp.liadm.com/j?dtstmp=1695042569767&aid=a-06d7&se=e30&duid=ddc3c751f117--01ham6j13qnnc7ed6hc22vcdhr&tna=v2.7.11&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&ext_s_ecid=MCMID%7C31556989266148752570712365094339234662&wpn=lc-bundle HTTP 302
https://rp4.liadm.com/j?dtstmp=1695042569767&aid=a-06d7&se=e30&duid=ddc3c751f117--01ham6j13qnnc7ed6hc22vcdhr&tna=v2.7.11&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&ext_s_ecid=MCMID%7C31556989266148752570712365094339234662&wpn=lc-bundle&i6=MjYwMjpmZmM4OjI6MTA0OjoxNQ%3D%3D&n3pc=true

Request Chain 120

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEN6gJbo0OFVD2Si_KMyyPjs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 130

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEN6gJbo0OFVD2Si_KMyyPjs&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 136

https://cm.everesttech.net/cm/yh HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZQhMCAAABMafLGzY&sigv=1&esig=1~a01c40672aa0aec14338fcb1a79bd7a5a0a26f93

Request Chain 138

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WlFoTUNBQUFCTWFmTEd6WQ==

Request Chain 139

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZQhMCAAABMafLGzY&expires=90

Request Chain 140

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZQhMCAAABMafLGzY HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZQhMCAAABMafLGzY&C=1

Request Chain 142

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=ZQhMCAAABMafLGzY HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZQhMCAAABMafLGzY

Request Chain 143

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZQhMCAAABMafLGzY HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=ZQhMCAAABMafLGzY

Request Chain 144

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZQhMCAAABMafLGzY

Request Chain 147

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZQhMCAAABMafLGzY&img=1

Request Chain 151

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZQhMCAAABMafLGzY&t=2592000&o=0

156 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
refinance.quickenloans.com/
Redirect Chain

http://echo4.bluehornet.com/ct/102343045:TjwABiGNx:m:1:3673644272:C460494B4F8F66417CCBCFBB15987927:r
https://www.npvnt7trk.com/3J67C/79C6G4/?sub1=A20916
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=043633dfaff64f4db59ead26df1bb9d1
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84...

126 KB
25 KB

692ms
622ms

Document
text/html

2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

1c89cbec675b4ef1f30d210dffc24378ba72c4b7703897d4dd106592b3928953

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8089d2c9e8214bc3-BUF
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Mon, 18 Sep 2023 13:09:27 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 270
content-type: text/html; charset=utf-8
date: Mon, 18 Sep 2023 13:09:26 GMT
location: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: 6112ba40-1c16-4940-b2b1-729a53be93ca

GET
H2 200 main.25362decf154d770ed63.css
static-msql-prod.refinance.quickenloans.com/ 70 KB
12 KB 113ms
96ms Stylesheet
text/css 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37a8e8357abacc4b3eddfc0933a0c596f3a2b5d3b104e2ebe2816fb4ea40d93a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:27 GMT
x-amz-version-id: Ps21xInRjVEsNqIfwu9beJyTzLq0DcsE
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 7059c9fc065ed611eb4484ede494f844.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR53-C3
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Aug 2023 02:02:26 GMT
server: cloudflare
etag: W/"fb5e546b4e5a32c5ece2b5b41477d75f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 8089d2cde82f4bc3-BUF
x-amz-cf-id: yV9mmg1pvrbmhi1JQUuOfN4cilrbooCcVX78cbcGibBaTeCi697UsA==
expires: Mon, 18 Sep 2023 17:09:27 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 21 KB
7 KB 102ms
32ms Script
application/x-javascript 18.239.183.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.239.183.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-239-183-117.bos50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b58109431c3adc92bccc460ac5dc394dc4f0979d24656f7a52503e6c77709d0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 18 Sep 2023 08:09:21 GMT
via: 1.1 0b6269442410aef6754183c357281644.cloudfront.net (CloudFront)
x-amz-cf-pop: BOS50-P4
age: 18007
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6676
x-xss-protection: 1; mode=block
last-modified: Wed, 03 May 2023 13:48:29 GMT
server: AmazonS3
etag: "befec09eb386fc68a0869c8d1b529dd6"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: MTCNNwlc2-P-ISPB7tNQiTP55ByBMp_Z-bRBYqMPhesaV7_8VhinRw==

GET
H2 200 dacs.js Show response
cs-cdn.deviceatlas.com/ 21 KB
22 KB 503ms
76ms Script
application/javascript 3.18.206.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cs-cdn.deviceatlas.com/dacs.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

3.18.206.181 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-18-206-181.us-east-2.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

1ef8b676943da5a052097007d8e7f47d3b3216a4ef8b1f5db32705f187d28c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:27 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 06 Apr 2023 14:32:01 GMT
server: nginx/1.17.9
accept-ch: DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data
etag: "231a1b0e4a218e6728e35e117d2dcf49"
x-cache: HIT
content-type: application/javascript
cache-control: no-cache
accept-ranges: bytes
content-length: 21948
expires: Mon, 18 Sep 2023 13:09:26 GMT

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
583 B 115ms
93ms Script
application/javascript 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d16a4f6786e1b33a7c80a049e565cb270bc7bc03fc2a3e34b38199124e4bec4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-9515944330e4759323b9.js
date: Mon, 18 Sep 2023 13:09:27 GMT
via: 1.1 f458ab1245bb4f257969c1da8e708f88.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P2
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 11 Sep 2023 16:36:20 GMT
server: cloudflare
etag: W/"df8e9a15824b00e1dcf4d9d114ce4f45"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8089d2cdf8304bc3-BUF
x-amz-cf-id: l-j95Zj8L8Udq6MX6EMyR5TyG1qgFV_2ZfxnQfI8nicn4KDIJrbrug==
expires: Mon, 18 Sep 2023 17:09:27 GMT

GET
H2 200 launch-ENac0456a305144bd1997bb2b709c90a1c.min.js Show response
assets.adobedtm.com/ 281 KB
89 KB 137ms
36ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2677ade12878022f72b418ea075be3a4fd528719383bc9f335af9ee9f9dd53a1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:27 GMT
content-encoding: gzip
last-modified: Tue, 25 Apr 2023 12:25:18 GMT
server: AkamaiNetStorage
etag: "13f57d277ab7314152718fd2470ef6da:1682425518.775812"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 90816
expires: Mon, 18 Sep 2023 14:09:27 GMT

GET
H2 200 623bac6703b37600138f67a3 Show response
api.pushnami.com/scripts/v1/push/ 87 KB
18 KB 132ms
38ms Script
application/javascript 18.160.18.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.18.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-18-24.iad12.r.cloudfront.net
Software: /
Resource Hash: 6596ea36bf758c2f1d6dd8d40249ab6dae02d46a4aa02c393d65acb0fab0866f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 12:59:59 GMT
content-encoding: gzip
via: 1.1 a85e1510327226089dfd77f1b1c39ad8.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P4
age: 568
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: qTpu-GXf4TI86eA02Gs_NZWqEJyLa--UW8-kclNBBWrcVuRRLpMdDQ==

GET
H2 200 css2
fonts.googleapis.com/ 875 B
835 B 138ms
57ms Stylesheet
text/css 2607:f8b0:4020:807::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0dd1971699f19f33219608023cd1f3294e8c0bed22cd575610c85644e5942271

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Sep 2023 13:09:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 13:01:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Sep 2023 13:09:27 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
801 B 141ms
60ms Stylesheet
text/css 2607:f8b0:4020:807::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ead030154a651dbf216d5c043e974bb3f78b640078472f63d4277db7deb1faae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Sep 2023 13:09:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:38:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Sep 2023 13:09:27 GMT

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
835 B 163ms
82ms Stylesheet
text/css 2607:f8b0:4020:807::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8eb072483e96c9baf13945a9ec7a1ee671d075bf6c073c18cefbb09c31e3c7ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Sep 2023 13:09:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 13:09:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Sep 2023 13:09:27 GMT

GET
H2 200 css2
fonts.googleapis.com/ 427 B
399 B 160ms
80ms Stylesheet
text/css 2607:f8b0:4020:807::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 18 Sep 2023 13:09:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 13:06:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 18 Sep 2023 13:09:27 GMT

GET
H2 200 main.25362decf154d770ed63.js Show response
static-msql-prod.refinance.quickenloans.com/ 550 KB
154 KB 58ms
58ms Script
application/javascript 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2412cd19e10c14ec852b88cbc88e7168721d2352d5db7420fe76b2ecf35e3ff

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:27 GMT
x-amz-version-id: 5RnbXVovFIxKGqNbtD0Bx_vvWsdjn3bZ
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 890550823a9a161b47289586a4b1b944.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: EWR53-C3
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Aug 2023 02:02:26 GMT
server: cloudflare
etag: W/"42a62fb95d3cddb3feccdc88bdabc59f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8089d2cf58374bc3-BUF
x-amz-cf-id: 8oE7geEEjPI1g8qxrd4xpHJt6VoJVSCs2pF0KwvkMnD5vU0V8Dsf_w==
expires: Mon, 18 Sep 2023 17:09:27 GMT

GET
H2 200 v8b253dfea2ab4077af8c6f58422dfbfd1689876627854 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 123ms
57ms Script
text/javascript 2606:4700::6810:3965
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v8b253dfea2ab4077af8c6f58422dfbfd1689876627854
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c235f21017bcc11fcaa31d7dfd9855aaebcbf5f6d7ee9bf9f2e98a910907c391

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:27 GMT
content-encoding: gzip
last-modified: Thu, 20 Jul 2023 18:10:27 GMT
server: cloudflare
etag: W/"2023.7.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8089d2d13c4e4bc7-BUF

GET
H2 200 pixel-9515944330e4759323b9.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 184 KB
25 KB 99ms
99ms Script
application/javascript 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6fd1d4b577b900581547964aafb80eb61f0e3700d0dbb42ffe8e2b410f7d4ad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:27 GMT
content-encoding: gzip
via: 1.1 f02cf2ecd058a7a1d8c5fa3141054f42.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: BOS50-P2
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 11 Sep 2023 16:05:29 GMT
server: cloudflare
etag: W/"d28a74eca97fb9da232f4473cea0eac1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8089d2d1783b4bc3-BUF
x-amz-cf-id: 8oJHfHhsLenu-TT2Pdt1BVMq3vM5NvYbKqi9ExHfWn5Pk9RSWGyGHw==
expires: Mon, 18 Sep 2023 17:09:27 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1695042568017
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1695042568017

4 KB
2 KB

45ms
44ms

XHR
application/json

52.55.2.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1695042568017

Requested by

Protocol

HTTP/1.1

Server

52.55.2.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-2-158.compute-1.amazonaws.com

Software

Resource Hash

1fc55355e3f94d05691245507674666443d099d7a73913a8d853d0c633d3801c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v049-09e4a7270.edge-va6.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: YhEzThBzRkI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1257
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-va6-2-v049-04585719e.edge-va6.demdex.com 5 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: WxnSCyT2TGo=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1695042568017
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 34 KB
12 KB 35ms
35ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "dfdd9e1f988805f0c2fbb10cd6b8f034:1663863409.614694"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12384
expires: Mon, 18 Sep 2023 14:09:28 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 3 KB
2 KB 35ms
34ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "b89fcb8870ac40eecb6d3cc844d35389:1663863409.92483"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1598
expires: Mon, 18 Sep 2023 14:09:28 GMT

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 25 KB
9 KB 36ms
35ms Script
application/x-javascript 2600:141b:f000:c0b4::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:f000:c0b4::1e80 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:50 GMT
server: AkamaiNetStorage
etag: "d220d501715e0484d0dddeac614f902c:1663863410.217006"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8755
expires: Mon, 18 Sep 2023 14:09:28 GMT

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 367ms
38ms Script
application/javascript 108.139.53.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.53.136 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-53-136.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:12 GMT
content-encoding: br
via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P1
age: 18
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: u6eFM5xJFU6z1XyY6wSYWnYadILaF4rJvgXPn0WD6rTgknL-ZfjPMw==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 116 KB
45 KB 430ms
101ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4757fa5c80eeaf844fbb9780ee8cc035a8080dfe19d5ab77d470716728d9d992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45480
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 181 KB
66 KB 344ms
60ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

48c42e472dd885d66d30bff44848b9c93bf181ba935ac3c9b0072ed1ac5fa05d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67571
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H/1.1 200
OK p
pixel1083.everesttech.net/1083/ 128 B
796 B 359ms
40ms Image
image/png 34.202.55.199
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel1083.everesttech.net/1083/p?ev_transid=&ev_=%loanpurpose%&_lead=1
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.202.55.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-55-199.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:28 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

GET
H/1.1

200
OK

iui3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...

43 B
855 B

60ms
60ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Requested by

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 18 Sep 2023 13:09:28 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 51XET9N6Y70ZPXZV0YK8
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 18 Sep 2023 13:09:28 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: H5PA3TMW816WV089TBD6
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/776757481/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=CEwIZZPRGMWNoP...
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1540127014&sscte=1&crd=CKG4sQI&pscr...

42 B
455 B

111ms
54ms

Image
image/gif

2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1540127014&sscte=1&crd=CKG4sQI&pscrd=IhMIk_Ws0Z20gQMVxQZoCB1OvQHz&is_vtc=1&ocp_id=CEwIZZPRGMWNoPMPzvqGmA8&random=1516005530

Requested by

Protocol

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1540127014&sscte=1&crd=CKG4sQI&pscrd=IhMIk_Ws0Z20gQMVxQZoCB1OvQHz&is_vtc=1&ocp_id=CEwIZZPRGMWNoPMPzvqGmA8&random=1516005530
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 5 KB
3 KB 206ms
206ms XHR
application/json 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

f2f7fefae346ab308ff32a04c07e32e0660b23dc5c71d3bdfd0738dda553ffc5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
accept-language: en-US,en;q=0.9
Authorization: Bearer null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"1335-w5luCyjDXNU1Vv3s1kzNfg72zMU"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 8089d2d3383f4bc3-BUF
x-xss-protection: 1; mode=block

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
744 B 130ms
105ms Image
image/png 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
via: 1.1 48fa2d8b9525abe889eff7ccc8591f7e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Wed, 05 Apr 2023 16:06:10 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8089d2d4b8454bc3-BUF
x-amz-cf-id: lqlVQ7YiNYKlbJ6S-9sq3bnuSCsup-Tv9mpMXV0ZE8JcQTw3wKeQCQ==
expires: Mon, 18 Sep 2023 17:09:28 GMT

GET
H2 200 overlay-close.svg
content.refinance.quickenloans.com/msql/EdisonOverlay/ 586 B
590 B 122ms
97ms Image
image/svg+xml 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/EdisonOverlay/overlay-close.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Feb 2023 23:45:55 GMT
server: cloudflare
etag: W/"58887760fe01f3933d5ae2d7bcc3f373"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8089d2d4b8474bc3-BUF
x-amz-cf-id: Qw6lI1wdKhpkBRrWx6N_QOnF59bgpv65gGDQUf2iGAJal0BW98G64A==
expires: Mon, 18 Sep 2023 17:09:28 GMT

GET
H2 200 qllogo.png
content.refinance.quickenloans.com/msql/ 4 KB
4 KB 120ms
96ms Image
image/png 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/qllogo.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
via: 1.1 bf8d7cb6fca5d51158e1109ca40fe242.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 3877
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Feb 2023 23:45:55 GMT
server: cloudflare
etag: "277055237f3837abfae204219c13fa6c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8089d2d4b8464bc3-BUF
x-amz-cf-id: iSYKBaHOQ3EjduumXoe_SA1k9cuc_cx453w7z9cBhDF0r6Dh5KrcaQ==
expires: Mon, 18 Sep 2023 17:09:28 GMT

GET
H2 200 redarrow1.png
content.refinance.quickenloans.com/msql/ 7 KB
7 KB 118ms
94ms Image
image/png 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/redarrow1.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
via: 1.1 b061677c943d1f77545875c9145119b4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: GIG51-C2
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
content-length: 6656
x-xss-protection: 1; mode=block
last-modified: Wed, 05 Apr 2023 16:06:10 GMT
server: cloudflare
etag: "55eb59d4535de0b41be9b7465ec7d9c3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8089d2d4b8444bc3-BUF
x-amz-cf-id: N2L_gqiOw6KFtxdMEgKDgXIbRdE_vwMCJ7fuNGYfDvnNS4fH3rPMLA==
expires: Mon, 18 Sep 2023 17:09:28 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
33 KB 113ms
31ms Font
font/woff2 2607:f8b0:4020:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Sat, 16 Sep 2023 17:01:52 GMT
x-content-type-options: nosniff
age: 158856
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Sep 2024 17:01:52 GMT

GET
H2 200 4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2
fonts.gstatic.com/s/shadowsintolighttwo/v17/ 15 KB
16 KB 146ms
64ms Font
font/woff2 2607:f8b0:4020:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/shadowsintolighttwo/v17/4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Sat, 16 Sep 2023 22:45:14 GMT
x-content-type-options: nosniff
age: 138254
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15832
x-xss-protection: 0
last-modified: Thu, 24 Aug 2023 20:34:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Sep 2024 22:45:14 GMT

POST
H2 200 ip Show response
refinance.quickenloans.com/api/geo/ 163 B
270 B 193ms
193ms XHR
application/json 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/geo/ip

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

ad7663f9710984dd27935c778f95d5edbf5629cbaf71cc2a08391da2aa3d87a3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"a3-Ld1kGWROflGzGxKHK0xEMwmMNmo"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 8089d2d4c8484bc3-BUF
x-xss-protection: 1; mode=block

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
110 B 409ms
408ms XHR
text/plain 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 8089d2d4e84a4bc3-BUF
content-length: 2
x-xss-protection: 1; mode=block

GET
H2 200 quicken_sprite_4_4_18.png
content.refinance.quickenloans.com/msql/ 75 KB
75 KB 84ms
84ms Image
image/png 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/quicken_sprite_4_4_18.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
via: 1.1 ab734ad5d81cc9d470b6176a05dd968e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 76537
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Feb 2023 17:04:39 GMT
server: cloudflare
etag: "1f80b3d1f05cc5648c262fba9d39b61a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8089d2d4e84b4bc3-BUF
x-amz-cf-id: LLCALkpj6DQOoSdXpkTtSgPp5K0fLOV6DyHpWWgyyZSH-4zBj5oRlQ==
expires: Mon, 18 Sep 2023 17:09:28 GMT

GET
H2 200 request.js Show response
script.anura.io/ 54 KB
20 KB 252ms
157ms Script
application/javascript 44.216.88.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/request.js?instance=3439535758&exid=b96f7bcc-db9e-53ec-ba03-d6ef8b69fa47&source=lmb-54867-113582-809&campaign=2&709799460366

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.25362decf154d770ed63.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.216.88.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-216-88-67.compute-1.amazonaws.com

Software

nginx /

Resource Hash

7a263580491a7b7e9fe90672238ffb3ac54703161066ed30091c28980e02d4bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H/1.1 200
OK dest5.html Show response
quicken.demdex.net/ Frame F931 7 KB
3 KB 196ms
42ms Document
text/html 52.54.223.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.54.223.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-54-223-166.compute-1.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-va6-2-v049-0f5d83cd1.edge-va6.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: V8Y7C/uQSL8=
content-encoding: gzip
date: Mon, 18 Sep 2023 13:09:28 GMT
last-modified: Wed, 28 Jun 2023 13:21:12 GMT
vary: accept-encoding

GET
H2 200 id Show response
somni.quickenloans.com/ 48 B
469 B 183ms
34ms XHR
application/x-javascript 63.140.38.113
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=31556989266148752570712365094339234662&ts=1695042568512

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.113 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-113.data.adobedc.net

Software

jag /

Resource Hash

9195c01364f9d8605417254814ecfb809833b2807bc45d3164cc0fce6b96ca2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=ZQhMCAAABMafLGzY&d_uuid=31366899561828374250697598167542927278
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=31366899561828374250697598167542927278
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZQhMCAAABMafLGzY&d_uuid=31366899561828374250697598167542927278

0
663 B

43ms
43ms

Image
text/plain

52.55.2.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZQhMCAAABMafLGzY&d_uuid=31366899561828374250697598167542927278

Requested by

Protocol

HTTP/1.1

Server

52.55.2.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-2-158.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v049-0a44897b1.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: tLoCd+kbSeM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZQhMCAAABMafLGzY&d_uuid=31366899561828374250697598167542927278
Date: Mon, 18 Sep 2023 13:09:28 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
quickenloans.tt.omtrdc.net/rest/v1/ 355 B
853 B 161ms
64ms XHR
application/json 63.140.38.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://quickenloans.tt.omtrdc.net/rest/v1/delivery?client=quickenloans&sessionId=75fb760491a8401c9afbfaf86c7d57bd&version=2.10.2

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.225 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-225.data.adobedc.net

Software

jag /

Resource Hash

d6536ea7ec3e097479827159fd197a7110053263dd9209b3a33d616a2efab54a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: f105f66b-2bd0-4f3d-8c3a-a8523a0d3cc2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 235 KB
83 KB 69ms
66ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-WQ7TGZQSWQ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

352dfd9b6f1ce246ae2843a7c8fb82182d8e1449cd722d1572105a99aaff5fb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 84368
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
66 KB 69ms
67ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-4641735&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7a4f7f6b7b8051a0361a5128495a8137e1d146dbdd6666cb709d628e9492f817

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67074
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 233 KB
80 KB 102ms
100ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1fbbdbb0716bc4c289e0aa2c52df10c3e885db82431a089f6ab00b54d4fe5c79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81835
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
66 KB 71ms
70ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9045885&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5db16b87d5d9e56d89df05b4f4c17866db07610de5a82226788be81b1ec55be1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67075
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 181 KB
66 KB 95ms
94ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b137a269bf7179847c55069c87d5c118de379ad6e622cfecf477340d639eacaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67635
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 81ms
25ms Script
text/javascript 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 18 Sep 2023 12:27:56 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 2492
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 18 Sep 2023 14:27:56 GMT

GET
H2

200

dc_pre=CKbjytGdtIEDFWEeigMdXKUGRQ;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~ore...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=224440235.1695042569;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uap...
https://ad.doubleclick.net/activity;dc_pre=CKbjytGdtIEDFWEeigMdXKUGRQ;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=224440235.1695042569;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa...
https://adservice.google.com/ddm/fls/z/dc_pre=CKbjytGdtIEDFWEeigMdXKUGRQ;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;ua...

42 B
401 B

139ms
59ms

Image
image/gif

2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKbjytGdtIEDFWEeigMdXKUGRQ;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408

Requested by

Protocol

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CKbjytGdtIEDFWEeigMdXKUGRQ;src=4641735;type=conve0;cat=cored0;ord=1;num=6026073306466;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

dc_pre=CPDnytGdtIEDFZ_tKAUdY7sOCw;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=224440235.1695042569;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;ua...
https://ad.doubleclick.net/activity;dc_pre=CPDnytGdtIEDFZ_tKAUdY7sOCw;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=224440235.1695042569;u3=Date.now().toString();u14=%25qls....
https://adservice.google.com/ddm/fls/z/dc_pre=CPDnytGdtIEDFZ_tKAUdY7sOCw;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45f...

42 B
107 B

142ms
63ms

Image
image/gif

2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPDnytGdtIEDFZ_tKAUdY7sOCw;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408

Requested by

Protocol

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CPDnytGdtIEDFZ_tKAUdY7sOCw;src=9045885;type=conversi;cat=corethan;ord=1;num=4331618686002;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe39d0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect Show response
sgtm.lowermybills.com/g/ 65 B
550 B 231ms
74ms XHR
text/plain 2001:4860:4802:32::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.lowermybills.com/g/collect?v=2&tid=G-WQ7TGZQSWQ&gtm=45je39d0&_p=1103892069&cid=153451100.1695042569&ul=en-us&sr=1600x1200&_fplc=0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=US&sst.ngs=1&_s=1&sid=1695042568&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&richsstsse

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::15 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 google
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
213 B 38ms
37ms XHR
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1103892069&t=pageview&_s=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&ul=en-us&de=UTF-8&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAQABAAAAACAAs~&jid=1482757601&gjid=1315319906&cid=153451100.1695042569&uid=&tid=UA-3849768-74&_gid=599668864.1695042569&_r=1&gtm=457e39d0&z=2133070677

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/1062919768/ 3 KB
2 KB 76ms
76ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1062919768/?random=1695042568799&cv=11&fst=1695042568799&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

f1785f78f9228b21fbc8ed88b7298197e5d0dc651dcb226c6587be6d9f825418

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1708
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 showads.js Show response
ads.anura.io/ 0
351 B 89ms
22ms XHR
application/javascript 18.238.25.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.anura.io/showads.js?736433162395
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.25.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-25-49.cmh68.r.cloudfront.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 16:25:46 GMT
content-encoding: gzip
via: 1.1 7f51b3ed93bc3627f3061df07d24a090.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: CMH68-P5
age: 74622
vary: Accept-Encoding
x-cache: Hit from cloudfront
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: application/javascript; charset=utf-8
x-amz-cf-id: Je2f0x4b9kt2hccqIGu0DQPjWJvRpfxvlKWOhcsfyAIah825FyBFyQ==

GET
H/1.1

200
OK

ibs:dpid=21&dpuuid=214270604643006552279
dpm.demdex.net/ Frame F931
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=31366899561828374250697598167542927278
https://dpm.demdex.net/ibs:dpid=21&dpuuid=214270604643006552279

42 B
940 B

45ms
45ms

Image
image/gif

52.55.2.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=21&dpuuid=214270604643006552279

Requested by

Protocol

HTTP/1.1

Server

52.55.2.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-2-158.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v049-065bf0298.edge-va6.demdex.com 5 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 6v2GAsGPSfk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
via: 1.1 b7a454c5d7e9ad8ba2aca6a02bb25f14.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: CMH68-P3
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dpm.demdex.net/ibs:dpid=21&dpuuid=214270604643006552279
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
x-amz-cf-id: CeKQz_n4Jhs9LOR4OZGYBYHTDLPaNn-BJLrjlOFJf72kKCKwiCeGYQ==
expires: 0

GET
H2 200 s81597375767185 Show response
somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LDQM/ 4 KB
4 KB 43ms
42ms Script
application/x-javascript 63.140.38.113
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LDQM/s81597375767185?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=18%2F8%2F2023%203%3A9%3A28%201%20600&d.&nsid=0&jsonv=1&.d&sdid=140864227B8FD64F-17B1B5AA434C0CBF&mid=31556989266148752570712365094339234662&aamlh=7&ce=UTF-8&ns=quickenloans&pageName=MSQL_LRE_LANDING&g=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&cc=USD&ch=lmb&server=refinance.quickenloans.com&events=event10&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l3=0%3Aundefined%7C1%3Aundefined&v7=monday%7C10%3A00am&c12=D%3Dv8&v12=First%20Visit&v14=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&v17=%2F&c18=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&c19=lmb&c22=%2F&v30=MSQL_LRE_LANDING&c50=Launch%3ALower%20My%20Bills%20-%20Lead%20Forms%20%3A%202023-04-25T12%3A25%3A05Z%20%7C%20AA%3A2.23.0%20%7C%20DD%3Afalse&c53=Desktop&c54=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.5938.88%20Safari%2F537.36&c55=1695042568428&v89=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.5938.88%20Safari%2F537.36&v228=75fb760491a8401c9afbfaf86c7d57bd&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.113 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-113.data.adobedc.net

Software

jag /

Resource Hash

023e93f1a46bc0df4e6f895ae2b81883656abfc0a4201869a30cc35aed81e4d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-aam-tid: dxqE82OeRv0=
date: Mon, 18 Sep 2023 13:09:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 4267
x-xss-protection: 1; mode=block
dcs: dcs-prod-va6-2-v049-01fe8e2de.edge-va6.demdex.com 3 ms
pragma: no-cache
last-modified: Tue, 19 Sep 2023 13:09:28 GMT
server: jag
etag: 3640076198965248000-4617740014281457697
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sun, 17 Sep 2023 13:09:28 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/1062919768/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=1070626598&cv=11&fst=1695042568799&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Fref...
https://www.google.com/pagead/1p-conversion/1062919768/?random=1070626598&cv=11&fst=1695042568799&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.c...

42 B
108 B

49ms
48ms

Image
image/gif

2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1062919768/?random=1070626598&cv=11&fst=1695042568799&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CKG4sQI&pscrd=Ek5DaEVJOE9xZnFBWVF4Zm14X2UySi05Q3JBUklsQUpDSWZhamxsUlB5dExqakNBNE1ZWEprWVZMWDZNOWc2T2pMa0pRcDJIbmRHcVhiNXcaV0NoQUk4T3FmcUFZUXBkanhndS1GcThrZUVpMEEwQ3NKbm5yWWVfb3VKN0RUS2k2QmNZQXNTaWROMVBDeXBvSzJEX2JiRzJQb1dVX2RNYmJzLTVmZUdUMCITCN6Yx9GdtIEDFYaNnwodK7IHeQ&is_vtc=1&ocp_id=CEwIZd70Moab_gSr5J7IBw&cid=CAQSKQBpAlJWYw_1j9r2s6yYCvQKnZB-E1OaJHDdKWWvh6euJ-MVs7hkKHE3&random=3817422041

Requested by

Protocol

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/1062919768/?random=1070626598&cv=11&fst=1695042568799&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CKG4sQI&pscrd=Ek5DaEVJOE9xZnFBWVF4Zm14X2UySi05Q3JBUklsQUpDSWZhamxsUlB5dExqakNBNE1ZWEprWVZMWDZNOWc2T2pMa0pRcDJIbmRHcVhiNXcaV0NoQUk4T3FmcUFZUXBkanhndS1GcThrZUVpMEEwQ3NKbm5yWWVfb3VKN0RUS2k2QmNZQXNTaWROMVBDeXBvSzJEX2JiRzJQb1dVX2RNYmJzLTVmZUdUMCITCN6Yx9GdtIEDFYaNnwodK7IHeQ&is_vtc=1&ocp_id=CEwIZd70Moab_gSr5J7IBw&cid=CAQSKQBpAlJWYw_1j9r2s6yYCvQKnZB-E1OaJHDdKWWvh6euJ-MVs7hkKHE3&random=3817422041
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.com/pagead/1p-user-list/5830051840/ Frame F931
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=809539622

42 B
64 B

94ms
93ms

Image
image/gif

2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=809539622

Protocol

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:28 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=809539622
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEI2XhPfX9S8p_ZLXgPUimSU&google_cver=1
dpm.demdex.net/ Frame F931
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MzEzNjY4OTk1NjE4MjgzNzQyNTA2OTc1OTgxNjc1NDI5MjcyNzg=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEI2XhPfX9S8p_ZLXgPUimSU&google_cver=1?gdpr=0&gdpr_consent=

42 B
940 B

45ms
45ms

Image
image/gif

52.55.2.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEI2XhPfX9S8p_ZLXgPUimSU&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

52.55.2.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-55-2-158.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v049-01fe8e2de.edge-va6.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: JlYtCFGMTLc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEI2XhPfX9S8p_ZLXgPUimSU&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame F931
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESECA5BNGmPROhpcde771Y-LQ&google_cver=1
https://pixel.everesttech.net/1x1

128 B
691 B

37ms
36ms

Image
image/png

54.236.156.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.236.156.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-156-168.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:29 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 18 Sep 2023 13:09:29 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 191 KB
70 KB 63ms
63ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

882a3f5c78a7722361cbee21b43682de7b4810fa157f1ada9fc77542cf22d3ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71724
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ Frame 4289 3 KB
2 KB 152ms
32ms Script
application/javascript 2600:1400:d:5a9::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a9::1931 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: df822e44efc31160c2e2cff9d29435159054bcceb67fa2512c3899f02dfb7557

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

akamai-x-true-ttl: 7200
content-encoding: br
x-cdn: akamai
etag: "d27ea869d7ce22e300e4a4a927526193"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 1473

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
66 KB 88ms
88ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0f3af8f7154ec6ee3f7377c18a65856ce6f9c692623ee3189c5beb7714e959bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67074
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 4289 197 KB
53 KB 90ms
29ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

66e58d37cc4b8168a1bd6678e085b43e939eb138fe608b7faffe3b1ba76b0c7b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 18 Sep 2023 13:09:29 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 53155
x-xss-protection: 0
pragma: public
x-fb-debug: aBA4CgANqS861AySt9eQn7HOvzHpppKAaW0bdKDunZHil+tj0MxHGYcxyP9WfpYnrOl+C02Bgpj30xA74XYPGA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
ads.revjet.com/ Frame 4289 19 KB
8 KB 130ms
34ms Script
application/javascript 72.251.228.33
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 72.251.228.33 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: mantis002-nyj.tokbox.com
Software: nginx /
Resource Hash: 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2022 13:58:36 GMT
server: nginx
etag: W/"6357eb8c-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Mon, 18 Sep 2023 13:19:29 GMT

GET
H2 200 a-06d7.min.js Show response
b-code.liadm.com/ Frame 4289 41 KB
14 KB 139ms
45ms Script
application/javascript 2600:9000:23cb:7200:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23cb:7200:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: f3970329d8784109cfc707112369c71662b9f651512bc9ac146c774fd47a9bd6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 10:42:15 GMT
content-encoding: gzip
via: 1.1 1d2861d9b6c0fd303c8b7539b394c190.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
age: 8834
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: zJgSkIiiZhSaAVnU3fmb2OGIdvugPuUO6bICQysD4sdUmfaIJEf5XA==

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 49 KB
18 KB 66ms
65ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

040cdc6664debf00b44ae5f890f214cf0bd11d2eff9d82e58cdd4ad5f502fe45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18497
x-xss-protection: 0
server: cafe
etag: 8843789211875599262
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 71ms
70ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

acb30644eaa8bd3786aef4a0a0b200008603544df903b4b900609d3a8adfd9ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73805
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1390358/ Frame 4289 64 KB
20 KB 102ms
52ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 67310618993281dd03f8191dd360c87459974b00ce3f65aafb4b70fa402f1832

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-amz-version-id: zuJeAI7XXNmK23vSYFP5hOxre0R7cTPX
content-encoding: gzip
via: 1.1 varnish
date: Mon, 18 Sep 2023 13:09:29 GMT
x-amz-request-id: K16Z76PW4ZYKHZMY
age: 1255
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
fastly-restarts: 1
x-amz-id-2: BephXd3mUOatZ9tOEIa88HDxqWo6YP2UaZPgHi38JnXB6ohwBErW0LAk0JxuQg85oe3eQp9h+jI=
x-served-by: cache-yyz4527-YYZ
content-length: 19528
last-modified: Mon, 18 Sep 2023 12:48:14 GMT
server: AmazonS3
x-timer: S1695042569.213089,VS0,VE31
etag: "9d3cf2917ea67c4acdd5dbbc48292bf2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 5
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 37

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 97ms
97ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dab73b69791e9a455bcbec3f83b4562369c5bbfb5c2ad2505e79e61698cba4ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73624
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 110ms
110ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

881a972d1911be9a60b866a30a922ba57e883987f8a5bd258cbd25d41ffb8325

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73821
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 deviceAtlasLmb.min.js Show response
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame 4289 8 KB
3 KB 201ms
60ms Script
application/javascript 2606:4700::6812:84b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:84b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com
p3p: CP="NON DSP COR LAW CONi TELi OUR SAM IND CNT"
x-xss-protection: 1; mode=block
last-modified: Fri, 21 May 2021 02:42:28 GMT
server: cloudflare
etag: W/"20fc-5c2ce02c32fd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8089d2da2afa4bcd-BUF
expires: Mon, 18 Sep 2023 17:09:29 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 191 KB
70 KB 119ms
119ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-966730890&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bdd596be73744dd088bcf3d4caf82bc5456ba3d49fa67c97fa9839f36dc03bff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71739
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 18 KB
7 KB 105ms
35ms Script
application/javascript 2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:22 GMT
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: JEFDGNXGJK89Z5W2
age: 8
x-amz-server-side-encryption: AES256
x-amz-id-2: 1MZHGiRXsb4yOL1qHaEjnc7/HI02+S3D4CHidyQ9DZnFnnuDUfDJ5tRGIVOeq2HCRbmBmE8MB50oOG5BO6FhBZ7trDk2LYiR
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
server: ATS
etag: "5c6ed25dce803fd84288922b8928409e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 99ms
28ms Script
application/javascript 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
73 KB 127ms
127ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

361c26946b433dea1466c98f82910c9d73d86679f6f7731317c5b46f7aa4484a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74789
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 160ms
159ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

32d3b871795b2f09a385649debf72c7b426d06178584007b4b8c6d48ee9d1489

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73828
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
73 KB 119ms
119ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d0033fdf52f33c2e89e6200c991910bbfc104ce6b72960e1f2ce3053e0cdbc8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74754
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame 4289 38 KB
17 KB 155ms
74ms Script
application/javascript 13.225.63.247
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.247 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-247.ewr53.r.cloudfront.net
Software: CloudFront /
Resource Hash: 28be27d04ce0ebac3fcd2862aa85bd45139b448cfa41647480b6a9f0180289e3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: gzip
via: 1.1 2684a624055735139ca3901fdc6d3742.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: EWR53-C1
x-cache: Miss from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 16452
x-amz-cf-id: BYxH1vYybcvURsRwy8TG4d_W3thHu4Xjfg9Hrn9_0KQxK4KxUTZfcQ==

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/event/ Frame 4289 5 KB
6 KB 155ms
61ms Script
text/javascript 104.77.9.10
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.77.9.10 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-9-10.deploy.static.akamaitechnologies.com
Software: MT3 1031 59fd23a master iad iad-pixel-x9 config_version:"1969" /
Resource Hash: a66c38e5323315afd25fc11ad0be55316cbe19e2dad5e688b56e66c4a6e4f186

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:29 GMT
Server: MT3 1031 59fd23a master iad iad-pixel-x9 config_version:"1969"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: text/javascript
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 5540
Expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H2 200 quickenloans_lander.js Show response
cdn1.decide.dev/tracking/ Frame 4289 737 B
624 B 144ms
33ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.decide.dev/tracking/quickenloans_lander.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: gzip
last-modified: Mon, 29 Mar 2021 18:57:30 GMT
etag: "a28f0deba4086540f82dc5d6b5e47753"
x-hw: 1695042569.cds235.ch4.hn,1695042569.cds097.ch4.c
content-type: application/javascript
cache-control: max-age=3305
accept-ranges: bytes
timing-allow-origin: https://decide.dev
content-length: 406

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ Frame 4289 18 KB
6 KB 36ms
36ms Script
application/javascript 2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:22 GMT
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: JEFDGNXGJK89Z5W2
age: 8
x-amz-server-side-encryption: AES256
x-amz-id-2: 1MZHGiRXsb4yOL1qHaEjnc7/HI02+S3D4CHidyQ9DZnFnnuDUfDJ5tRGIVOeq2HCRbmBmE8MB50oOG5BO6FhBZ7trDk2LYiR
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
server: ATS
etag: "5c6ed25dce803fd84288922b8928409e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
73 KB 154ms
154ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

aa6bc294cac2868a8f212d00d228d67e98b02b88cfe83cdb60b7d3bd73686675

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74754
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 src Show response
c.pmsrv.co/v2/conversion/ Frame 4289 3 KB
4 KB 429ms
292ms Script
text/javascript 2600:9000:2514:1000:a:8e7d:9900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:1000:a:8e7d:9900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash: 3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
via: 1.1 39947baba82573c8d139cba81c505476.cloudfront.net (CloudFront)
x-amzn-remapped-content-length: 3435
x-amz-cf-pop: JFK50-P8
x-amzn-requestid: 525579e6-3f74-4c57-8ce4-038a93fac71f
x-amzn-remapped-connection: close
x-powered-by: Express
x-cache: Miss from cloudfront
x-amz-apigw-id: LdDRjE3WyK4EVKA=
content-length: 3435
pragma: no-cache
etag: W/"d6b-sia6N7ids5ScRDuTaHkjdTsJcfc"
x-amzn-trace-id: Root=1-65084c09-0c0b1f8478d1913518bf1a84;Sampled=0;lineage=c8fdcb33:0
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
x-amzn-remapped-date: Mon, 18 Sep 2023 13:09:29 GMT
x-amz-cf-id: JT38K_45OUlziBIRNa4b2xtBmNGrSf1SGApzosWphfh8uSbw6jPl5Q==
expires: -1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 149ms
149ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fbb94c5679b44ba29904bc98db022e030c1605a29afc040b1a00dfbed27fcc28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73787
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 60 KB
19 KB 50ms
50ms Script
text/javascript 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7579fea8b4d6ea390f1a708a3b08b08911f3df414f650fa850780d0b3211cab7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-Ch-Ua-Platform-Version
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: d216d42c-7152-4065-9a1d-55e129a3587f
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 quickenloans_lander.js Show response
cdn1.lockerdomecdn.com/tracking/ Frame 4289 737 B
777 B 120ms
31ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.lockerdomecdn.com/tracking/quickenloans_lander.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-9515944330e4759323b9.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: gzip
x-amz-version-id: b6Hbc7yn6rhHZ8LkuNIH.XEX.WaaPfs1
last-modified: Mon, 29 Mar 2021 18:57:30 GMT
server: AmazonS3
x-amz-request-id: QD4HBKAPBZKYYCTE
etag: "a28f0deba4086540f82dc5d6b5e47753"
x-hw: 1695042569.cds098.ch4.hn,1695042569.cds254.ch4.c
content-type: application/javascript
cache-control: max-age=3305
accept-ranges: bytes
timing-allow-origin: https://lockerdome.com
content-length: 406
x-amz-id-2: /Tr76cZotX/xJzsnqHncd5VU+RTmL+/djVtHfmftKcVZM/xy1e45jou6dDbVb2AH+00IBgsFwn0=

GET
H/1.1 200
OK iui3
s.amazon-adsystem.com/ Frame 4289 43 B
855 B 50ms
50ms Image
image/gif 52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3D6acaf65c-54d3-788f-2e4f-971d4f6b7886%26type%3D4%26m%3D1&ex-fch=416613&ex-src=https://home.rocketmortgage.com&ex-hargs=v%3D1.0%3Bc%3D584239139431578754%3Bp%3D6ACAF65C-54D3-788F-2E4F-971D4F6B7886

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 18 Sep 2023 13:09:29 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: RSDX6WB2M7ZG8FPW56J7
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 hub Show response
api.pushnami.com/scripts/v1/ Frame 1E3B 2 KB
1 KB 34ms
34ms Document
text/html 18.160.18.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.160.18.24 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-160-18-24.iad12.r.cloudfront.net

Software

Resource Hash

2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 58
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Mon, 18 Sep 2023 13:08:31 GMT
vary: accept-encoding
via: 1.1 a85e1510327226089dfd77f1b1c39ad8.cloudfront.net (CloudFront)
x-amz-cf-id: qoJal0jTBp1gfxBKDKmR3wX2bioNtxYv0_-9QzmIiE0kU7hTBtzWTw==
x-amz-cf-pop: IAD12-P4
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
178 B 58ms
58ms XHR
text/plain 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
content-type: application/json

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8089d2d978614bc3-BUF

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame F931
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEC...
https://pixel.everesttech.net/1x1

128 B
691 B

32ms
32ms

Image
image/png

54.236.156.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.236.156.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-156-168.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:29 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 18 Sep 2023 13:09:29 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 400 response.json Show response
script.anura.io/ 21 B
320 B 1281ms
1194ms XHR
application/json 44.216.88.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/response.json

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

44.216.88.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-216-88-67.compute-1.amazonaws.com

Software

nginx /

Resource Hash

d7cb2c2f08454c0b1f346e0343bbf085b65da2d6b0997b5e12bbea90ed541be6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 102ms
41ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1695042569288&id=t2_1fj2owc9&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=59bee65d-c2e2-49c1-b4af-7e36fb1b9a90&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 4289 0
384 B 43ms
36ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1695042569296&ref=null&cv=20230918-3-RELEASE&tos=2&ssd=1&scd=0&mrir=u&vi=1695042569292
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:29 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 17896
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042569.314969,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 4289 0
574 B 41ms
34ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1695042569299&ref=null&cv=20230918-3-RELEASE&tos=3&ssd=1&scd=0&mrir=u&vi=1695042569292
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:29 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 13695
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042569.314656,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 4289 0
325 B 40ms
35ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1695042569300&ref=null&cv=20230918-3-RELEASE&tos=4&ssd=1&scd=0&mrir=u&vi=1695042569292
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:29 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 13738
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042569.314956,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame F931
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
691 B

30ms
30ms

Image
image/png

54.236.156.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.236.156.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-156-168.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:29 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 18 Sep 2023 13:09:29 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 pd2259 Show response
pix.revjet.com/track/ Frame 4289 46 B
222 B 200ms
40ms Script
text/javascript 15.204.180.50
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd2259?__noscript=false&__cbf=revjet.callbacks.cb1695042569306&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 15.204.180.50 Reston, United States, ASN16276 (OVH, FR),
Reverse DNS: ext.svh244.incmdb.net
Software: /
Resource Hash: be3abf19a71918ed5cce35daf627696175dc3da4299acf7142d7b3f8a29f83fa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 pd3876 Show response
pix.revjet.com/track/ Frame 4289 46 B
223 B 199ms
39ms Script
text/javascript 15.204.180.50
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd3876?__noscript=false&__cbf=revjet.callbacks.cb1695042569307&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 15.204.180.50 Reston, United States, ASN16276 (OVH, FR),
Reverse DNS: ext.svh244.incmdb.net
Software: /
Resource Hash: 6c45201328ea7349692faf8e6eff681eb5f4781e18ac8892647b7998484cae01

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 10182570.json Show response
s.yimg.com/wi/config/ 46 B
678 B 155ms
77ms XHR
application/json 2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10182570.json

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 13:38:51 GMT
x-amz-version-id: vbb4fosRI0di.El0PSNMReciUIJFnPsr
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-request-id: 3Z2A173NNHP0VXVG
age: 84639
x-amz-server-side-encryption: AES256
content-length: 46
x-amz-id-2: SaENhHIoCne/rTbejlQXGi+AbZNjtDo8HM6fTlOu07jThqr6iICnMd0FNWPbrn7SnUwWcCImQYE=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Tue, 02 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Sun, 28 May 2023 10:55:26 GMT
server: ATS
etag: "f31aca15ae5b24f87583e3de167c9828"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes

OPTIONS
H2 204 psp
psp.pushnami.com/api/ Frame 0
0 155ms
71ms Preflight 52.205.43.200
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.205.43.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-43-200.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

access-control-allow-headers: key
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
date: Mon, 18 Sep 2023 13:09:29 GMT
vary: Access-Control-Request-Headers
x-powered-by: Express

POST
H2 200 psp Show response
psp.pushnami.com/api/ 2 B
152 B 52ms
52ms Fetch
text/html 52.205.43.200
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.205.43.200 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-43-200.compute-1.amazonaws.com
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Mon, 18 Sep 2023 13:09:29 GMT
x-powered-by: Express
content-length: 2
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type: text/html; charset=utf-8

GET
H2 200 1736491679707345 Show response
connect.facebook.net/signals/config/ Frame 4289 110 KB
30 KB 31ms
30ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1736491679707345?v=2.9.127&r=stable&domain=refinance.quickenloans.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9483c228080d0daba63a608af4c27d229b1f53beb69d1ef240021386c2f213cc

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 18 Sep 2023 13:09:29 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 30203
x-xss-protection: 0
pragma: public
x-fb-debug: oeMvaHiK4l+61qo9zFirprOF8ycDrkmLSAbf3p2PBE7SVbcRAUzuohGIoXgCHR1ScNkXmmZHcXa4e9XBXJ+Dew==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 10182570.json Show response
s.yimg.com/wi/config/ Frame 4289 46 B
86 B 133ms
84ms XHR
application/json 2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10182570.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 13:38:51 GMT
x-amz-version-id: vbb4fosRI0di.El0PSNMReciUIJFnPsr
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-request-id: 3Z2A173NNHP0VXVG
age: 84639
x-amz-server-side-encryption: AES256
content-length: 46
x-amz-id-2: SaENhHIoCne/rTbejlQXGi+AbZNjtDo8HM6fTlOu07jThqr6iICnMd0FNWPbrn7SnUwWcCImQYE=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Tue, 02 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Sun, 28 May 2023 10:55:26 GMT
server: ATS
etag: "f31aca15ae5b24f87583e3de167c9828"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 main.b4887131.js Show response
s.pinimg.com/ct/lib/ Frame 4289 63 KB
18 KB 36ms
26ms Script
application/javascript 2600:1400:d:5a9::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.b4887131.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a9::1931 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 7dbb99afa2ca46884692f7772146d6f3f7c4f1ba928babc0f490f3e7ba62114e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

akamai-x-true-ttl: 1209600
content-encoding: br
x-cdn: akamai
etag: "aa7df97ef17cd5e7b3b0e69ee5fe57f8"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 18175

GET
H/1.1 200
OK iframe Show response
pixel.mathtag.com/sync/ Frame 2DEE 677 B
1 KB 56ms
46ms Document
text/html 104.77.9.10
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=38f46508-4c09-4d00-ad83-0286dec2ba7e&no_iframe=1&mt_adid=245296&source=mathtag
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.77.9.10 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-9-10.deploy.static.akamaitechnologies.com
Software: MT3 1031 59fd23a master iad iad-pixel-x12 config_version:"1969" /
Resource Hash: 3ef64e4a0001cd55211fff6bd306290f29c7482a6006d070ee21e52484b7ef22

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 677
Content-Type: text/html
Date: Mon, 18 Sep 2023 13:09:29 GMT
Expires: Mon, 18 Sep 2023 13:09:28 GMT
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 1031 59fd23a master iad iad-pixel-x12 config_version:"1969"

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 4289 0
494 B 160ms
118ms Image
image/gif 104.77.9.10
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.77.9.10 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-9-10.deploy.static.akamaitechnologies.com
Software: MT3 1031 59fd23a master iad iad-pixel-x32 config_version:"1969" /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:29 GMT
Server: MT3 1031 59fd23a master iad iad-pixel-x32 config_version:"1969"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 3 KB
1 KB 103ms
103ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1695042569381&cv=11&fst=1695042569381&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&label=EVlnCPzHxqoBEIrJ_MwD&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df578b68a5c3cf474d1c6a66be80a1cc93856e039913ab1aa34a552bff1085d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1497
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 3 KB
1 KB 524ms
524ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1695042569396&cv=11&fst=1695042569396&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42289448ad4c90a7e3cf279252dbe7a47406bd7d984d8fde3481e732ac4c7577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 191 KB
70 KB 100ms
100ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9366657c6ffeb9d3c63d608854c9c2396e199a88cfa96f0346de4bc6a812cd91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71736
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 3 KB
1 KB 134ms
133ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1695042569425&cv=11&fst=1695042569425&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-700319321

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b055210c4ea5f15b47bb9a167b146ce57b90fa63e8208cd6a0437dfce8c0b412

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1425
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame F931
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

33ms
33ms

Image
image/png

54.236.156.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.236.156.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-156-168.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:29 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 18 Sep 2023 13:09:29 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 3 KB
1 KB 876ms
875ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1695042569512&cv=11&fst=1695042569512&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-813495030

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9af496e1a0da9562a2610440dcba94c656687a0739838df5fa0efd0e3f20035c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1425
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 3 KB
1 KB 129ms
129ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1695042569540&cv=11&fst=1695042569540&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8fed8c0b144807dea57d210b28a9a494e5dcdcfd84cea01183962f761e343d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1430
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ Frame 4289 0
185 B 98ms
29ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com&rl=https%3A%2F%2Frefinance.quickenloans.com&if=true&ts=1695042569564&sw=1600&sh=1200&v=2.9.127&r=stable&ec=0&o=28&fbp=fb.1.1695042569561.410482310&pm=1&hrl=5235d2&it=1695042569322&coo=false&cs_cc=1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 18 Sep 2023 13:09:29 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/ 3 KB
1 KB 110ms
110ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/?random=1695042569588&cv=11&fst=1695042569588&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-755089552

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e27d15cfd60dd88155c92f4a08039e556b9c4102b939ddb0228ab2e9943618d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/ 3 KB
1 KB 226ms
226ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/?random=1695042569623&cv=11&fst=1695042569623&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

99313327dc04ba90495735ca4e9a25a27d7fcdc08088c3649069df1d02f18886

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1427
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 3 KB
1 KB 98ms
97ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1695042569653&cv=11&fst=1695042569653&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-857412364

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e8cb28b64b27e0ccd7c484fd4477969a1f96f7d303ae3dad13a2f0a5f04af0c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/ 3 KB
1 KB 80ms
79ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/?random=1695042569679&cv=11&fst=1695042569679&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1243bb1d70f364436d128888099b82555fdeebe91fc0ec85d844b14de7ea826a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1428
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 3 KB
1 KB 163ms
162ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1695042569711&cv=11&fst=1695042569711&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-865435318

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ccc380be2766720f492219d5e3e0731fddef23074c6fe9a47abbb74e23a96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1425
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
247 B 99ms
32ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Mon%2C%2018%20Sep%202023%2013%3A09%3A29%20GMT&n=10&b=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Cadobe

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame 4289 43 B
246 B 98ms
33ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Mon%2C%2018%20Sep%202023%2013%3A09%3A29%20GMT&n=10&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&e=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&enc=UTF-8&yv=1.15.1&isIframe=1

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame 4289 43 B
633 B 96ms
31ms Image
image/gif 76.13.32.146
YAHOO-BF1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&.yp=10182570&f=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&e=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&enc=UTF-8&yv=1.15.1&isIframe=1&et=custom&ec=pg1

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.13.32.146 Lockport, United States, ASN26101 (YAHOO-BF1, US),

Reverse DNS

spdc.pbp.vip.bf1.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Mon, 18 Sep 2023 13:09:29 GMT

GET
H2

200

j Show response
rp4.liadm.com/ Frame 4289
Redirect Chain

https://rp.liadm.com/j?dtstmp=1695042569767&aid=a-06d7&se=e30&duid=ddc3c751f117--01ham6j13qnnc7ed6hc22vcdhr&tna=v2.7.11&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pk...
https://rp4.liadm.com/j?dtstmp=1695042569767&aid=a-06d7&se=e30&duid=ddc3c751f117--01ham6j13qnnc7ed6hc22vcdhr&tna=v2.7.11&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26p...

13 B
553 B

129ms
38ms

XHR
application/json

100.24.159.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1695042569767&aid=a-06d7&se=e30&duid=ddc3c751f117--01ham6j13qnnc7ed6hc22vcdhr&tna=v2.7.11&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&ext_s_ecid=MCMID%7C31556989266148752570712365094339234662&wpn=lc-bundle&i6=MjYwMjpmZmM4OjI6MTA0OjoxNQ%3D%3D&n3pc=true

Requested by

Protocol

Server

100.24.159.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-24-159-94.compute-1.amazonaws.com

Software

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:30 GMT
x-pixel-event-id: 839bac30-7aa5-4f74-8e3f-666d8b63e349
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: DENY
vary: Origin
content-type: application/json
request-time: 0
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: 6eab0819f8657d1a
content-length: 13
x-xss-protection: 1; mode=block

Redirect headers

date: Mon, 18 Sep 2023 13:09:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
vary: Origin
location: https://rp4.liadm.com/j?dtstmp=1695042569767&aid=a-06d7&se=e30&duid=ddc3c751f117--01ham6j13qnnc7ed6hc22vcdhr&tna=v2.7.11&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&ext_s_ecid=MCMID%7C31556989266148752570712365094339234662&wpn=lc-bundle&i6=MjYwMjpmZmM4OjI6MTA0OjoxNQ%3D%3D&n3pc=true
access-control-allow-origin: https://refinance.quickenloans.com
request-time: 0
access-control-allow-credentials: true
trace-id: f963c0ba41e151ed
content-length: 0
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame F931
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

128 B
691 B

31ms
30ms

Image
image/png

54.236.156.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.236.156.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-156-168.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:30 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 18 Sep 2023 13:09:30 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 / Show response
ct.pinterest.com/user/ Frame 4289 569 B
910 B 219ms
59ms XHR
application/json 104.77.220.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&cb=1695042569831&dep=2%2CPAGE_LOAD

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.b4887131.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.247 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

8fc4aa58eba36944f49a93d645f69635e8d5643cde97ac4ab14c025d2a4d70bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:30 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.b4794668.1695042570.19c6676f
x-envoy-upstream-service-time: 0
content-length: 386
x-pinterest-rid: 1137928659579351
pin-unauth: dWlkPU5qWTRaV1V3TkRjdE5Ua3hOQzAwTkdaa0xXRTJNR1V0WW1ZeE5UTmlaakk1WkRGaQ
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: ebb329885d2cf937e4434aa41a5b3d0817051309
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 2DEE 0
494 B 45ms
45ms Image
image/gif 104.77.9.10
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=38f46508-4c09-4d00-ad83-0286dec2ba7e&no_iframe=1&mt_adid=245296&source=mathtag
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.77.9.10 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-9-10.deploy.static.akamaitechnologies.com
Software: MT3 1031 59fd23a master iad iad-pixel-x13 config_version:"1969" /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pixel.mathtag.com/sync/iframe?mt_uuid=38f46508-4c09-4d00-ad83-0286dec2ba7e&no_iframe=1&mt_adid=245296&source=mathtag
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:29 GMT
Server: MT3 1031 59fd23a master iad iad-pixel-x13 config_version:"1969"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Mon, 18 Sep 2023 13:09:28 GMT

GET
H2 200 /
ct.pinterest.com/v3/ Frame 4289 35 B
457 B 178ms
59ms Image
image/gif 104.77.220.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408%22%2C%22ref%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408%22%2C%22if%22%3Atrue%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%22b4887131%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1695042569871

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.247 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.b4794668.1695042570.19c66770
content-type: image/gif
access-control-allow-origin: *
pinterest-version: ebb329885d2cf937e4434aa41a5b3d0817051309
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 3
content-length: 35
x-pinterest-rid: 6884833988323353
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 55ms
55ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1695042569381&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&label=EVlnCPzHxqoBEIrJ_MwD&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&data=event%3Dconversion&fmt=3&is_vtc=1&random=4066157333&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/ 3 KB
1 KB 153ms
153ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/?random=1695042569886&cv=11&fst=1695042569886&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=224440235.1695042569&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aee7d51c64178b9cb49d3b8e3cf88427773330351f50cca58f3eab6d681f4524

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1427
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/700319321/ 42 B
64 B 48ms
48ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/700319321/?random=1695042569425&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1386961078&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/857412364/ 42 B
64 B 48ms
48ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/857412364/?random=1695042569653&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2341038946&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866176763/ 42 B
64 B 48ms
48ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866176763/?random=1695042569679&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2524117580&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:29 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 click Show response
www.lmbahsj2.com/sdk/ 85 B
106 B 77ms
77ms Fetch
application/json 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/sdk/click?effp=a9fdd57c0e89aec24599ddd1986ed831&sec_ch_ua_platform=&sec_ch_ua_platform_version=&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408&oid=9&affid=809&__cc=&async=json
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: bbcdb35bd1f632836976403f31d234f7251fca3820a4bc39a4f7d45b41f29bf8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 google
server: nginx
accept-ch: Sec-Ch-Ua-Platform-Version
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
x-eflow-request-id: 52613eeb-20ed-487e-a17c-55cd78074319
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame F931
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WlFoTUNBQUFCTWFmTEd6WQ&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://pixel.everesttech.net/1x1

128 B
691 B

31ms
31ms

Image
image/png

54.236.156.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.236.156.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-236-156-168.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date: Mon, 18 Sep 2023 13:09:30 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Mon, 18 Sep 2023 13:09:30 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866179376/ 42 B
64 B 43ms
43ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866179376/?random=1695042569540&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2614766046&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/755089552/ 42 B
64 B 46ms
45ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/755089552/?random=1695042569588&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1306977315&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10910338944/ 42 B
64 B 44ms
44ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10910338944/?random=1695042569623&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3717822581&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/865435318/ 42 B
64 B 44ms
44ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865435318/?random=1695042569711&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=909186617&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 47ms
47ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1695042569396&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=120472643&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

v1
ads.yahoo.com/cms/ Frame F931
Redirect Chain

https://cm.everesttech.net/cm/yh
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZQhMCAAABMafLGzY&sigv=1&esig=1~a01c40672aa0aec14338fcb1a79bd7a5a0a26f93

0
47 B

38ms
36ms

Image
text/plain

2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZQhMCAAABMafLGzY&sigv=1&esig=1~a01c40672aa0aec14338fcb1a79bd7a5a0a26f93

Protocol

Server

2001:4998:14:800::1000 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 13:09:30 GMT
strict-transport-security: max-age=31536000
cache-control: no-store
x-content-type-options: nosniff
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=ZQhMCAAABMafLGzY&sigv=1&esig=1~a01c40672aa0aec14338fcb1a79bd7a5a0a26f93
Date: Mon, 18 Sep 2023 13:09:30 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 /
www.google.com/pagead/1p-user-list/848879802/ 42 B
64 B 44ms
44ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848879802/?random=1695042569886&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=612775825&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F931
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WlFoTUNBQUFCTWFmTEd6WQ==

170 B
188 B

60ms
60ms

Image
image/png

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WlFoTUNBQUFCTWFmTEd6WQ==

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-yyz4567-YYZ
pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1695042570.232090,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WlFoTUNBQUFCTWFmTEd6WQ==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F931
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZQhMCAAABMafLGzY&expires=90

42 B
755 B

154ms
36ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZQhMCAAABMafLGzY&expires=90
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 8bab65602db075726861004da5629947
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-yyz4567-YYZ
pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1695042570.277241,VS0,VE0
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=ZQhMCAAABMafLGzY&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame F931
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZQhMCAAABMafLGzY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZQhMCAAABMafLGzY&C=1

43 B
336 B

47ms
46ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZQhMCAAABMafLGzY&C=1
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PQkaa%2Ffr2sy40vqOSTOWW1RUkj8A6HiwI5OtcEsQ31cSiCSSQCd6dvuhgNKP%2FYVMIvTDYxBK6fQT1nfneyvMdidsSyr9qaaGlRpAlLezERklxIahCIggC4jf31JOmQuIv%2BL9wFane3axkw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8089d2e18ed039e1-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DJURD7XoOyJMK9SXi2b5WHV1Ct%2BZ1g%2BDbgd6Xan1yK1mzW1aMEQ9TyrMw6zI5CWVGhuzMCthWCUyOKb%2Fyf%2B5KcUSsb8yNrbdm1ABaWqkvzggvu1zJkxcj5NarI3IDeU1hduZXqYCzvDfSg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=88&external_user_id=ZQhMCAAABMafLGzY&C=1
cache-control: no-cache
cf-ray: 8089d2e14e9839e1-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 200 /
www.google.com/pagead/1p-user-list/813495030/ 42 B
64 B 43ms
42ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/813495030/?random=1695042569512&cv=11&fst=1695042000000&bg=ffffff&guid=ON&async=1&gtm=45be39d0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3D2ece45e0b407474e84341f3f9328c408%26sourceid%3Dlmb-54867-113582-809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3D2ece45e0b407474e84341f3f9328c408&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=717015838&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame F931
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=ZQhMCAAABMafLGzY
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZQhMCAAABMafLGzY

43 B
901 B

41ms
41ms

Image
image/gif

68.67.179.155
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZQhMCAAABMafLGzY

Protocol

Server

68.67.179.155 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
an-x-request-uuid: d0a28aaf-ead2-41b1-9c29-b87a58518dc5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 96.9.246.195; 96.9.246.195; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
an-x-request-uuid: d5432c8c-b9a6-46b3-8198-c77fb6b47acb
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DZQhMCAAABMafLGzY
cache-control: no-store, no-cache, private
x-proxy-origin: 96.9.246.195; 96.9.246.195; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F931
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZQhMCAAABMafLGzY
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=ZQhMCAAABMafLGzY

43 B
180 B

33ms
32ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=ZQhMCAAABMafLGzY
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=ZQhMCAAABMafLGzY
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame F931
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZQhMCAAABMafLGzY

1 B
452 B

92ms
30ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZQhMCAAABMafLGzY
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Mon, 18 Sep 2023 07:21:36 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

x-served-by: cache-yyz4567-YYZ
pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1695042571.681017,VS0,VE0
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZQhMCAAABMafLGzY
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

POST
H2 200 track Show response
trc.pushnami.com/api/push/ 2 B
168 B 130ms
130ms Fetch
text/html 34.193.178.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.178.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-178-107.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
key: 623bac6703b37600138f67a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Mon, 18 Sep 2023 13:09:30 GMT
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
content-length: 2
content-type: text/html; charset=utf-8

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 162ms
80ms Preflight 34.193.178.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.178.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-178-107.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT

GET

partner
sync.search.spotxchange.com/ Frame F931
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZQhMCAAABMafLGzY&img=1

0
0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 4289 0
350 B 33ms
33ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=1552&scd=0&ssd=1&est=1695042569295&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1695042570848&mrir=u&vi=1695042569292&ref=null&cv=20230918-3-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 13582
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v2
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042571.858260,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 4289 0
238 B 33ms
33ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=1553&scd=0&ssd=1&est=1695042569295&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1695042570849&mrir=u&vi=1695042569292&ref=null&cv=20230918-3-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 15819
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042571.859155,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 4289 0
128 B 33ms
33ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=1554&scd=0&ssd=1&est=1695042569295&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1695042570850&mrir=u&vi=1695042569292&ref=null&cv=20230918-3-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 13691
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042571.859661,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2

200

b.php
www.facebook.com/fr/ Frame F931
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZQhMCAAABMafLGzY&t=2592000&o=0

43 B
678 B

48ms
47ms

Image
image/gif

2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZQhMCAAABMafLGzY&t=2592000&o=0

Protocol

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Mon, 18 Sep 2023 06:09:30 PDT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
pragma: public
x-fb-debug: gy6yf6ZFHBB+1A4yUy8qwwb0/w832r0+Y06O+BGjbcfsn2dFIXJd/g5mqgscZAISQSVfvAu/Cy1txk5junkWlQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: image/gif
origin-agent-cluster: ?0
cache-control: public, max-age=0
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Mon, 18 Sep 2023 06:09:30 PDT

Redirect headers

x-served-by: cache-yyz4567-YYZ
pragma: no-cache
date: Mon, 18 Sep 2023 13:09:30 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1695042571.883638,VS0,VE0
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=ZQhMCAAABMafLGzY&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 4289 0
347 B 34ms
34ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=4556&scd=0&ssd=1&est=1695042569295&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1695042573851&mrir=u&vi=1695042569292&ref=null&cv=20230918-3-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:33 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 13502
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042574.862002,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 4289 0
67 B 34ms
33ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=4557&scd=0&ssd=1&est=1695042569295&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1695042573853&mrir=u&vi=1695042569292&ref=null&cv=20230918-3-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:33 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 13441
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042574.863207,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 4289 0
105 B 33ms
33ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=4558&scd=0&ssd=1&est=1695042569295&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1695042573854&mrir=u&vi=1695042569292&ref=null&cv=20230918-3-RELEASE
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 18 Sep 2023 13:09:33 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 13900
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4527-YYZ
pragma: no-cache
server: nginx
x-timer: S1695042574.863836,VS0,VE15
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sync.search.spotxchange.com
URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZQhMCAAABMafLGzY&img=1

Verdicts & Comments Add Verdict or Comment

117 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

68 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 14:52:08	Name: X-AB Value: 0d6e407936704bd380072f5891d28b0e
echo4.bluehornet.com/	1970-01-20 15:00:47	Name: AWSALB Value: +L3J92GUg43iulVRrhRkkEGAOVA25/bYKt4yh1Jk/HN/lnkMe5g8wnNNytrHAGIXZs6lH1Suejvau2TqhkMUawIMdqeJ1Q/KA0qajgwlsXqMoD5LgkYLp8tomskh
www.npvnt7trk.com/	1970-01-20 14:52:30	Name: uniqueClick_79C6G4 Value: 0c0eacc7-6ba2-4b4d-8b38-98cc40d28194:1695042566
www.npvnt7trk.com/	1970-01-20 17:00:18	Name: transaction_id Value: 043633dfaff64f4db59ead26df1bb9d1
www.lmbahsj2.com/	1970-01-20 14:52:08	Name: uniqueClick_FGXLG Value: 1794f58c-dbae-477c-b9a6-d37f7163022e:1695042566
www.lmbahsj2.com/	1970-01-20 17:00:18	Name: transaction_id Value: 2ece45e0b407474e84341f3f9328c408
refinance.quickenloans.com/	1970-01-20 23:36:18	Name: visitorId Value: 73d7f27e-e2d4-4dec-b270-93492c98a4c2
refinance.quickenloans.com/	1970-01-20 15:00:47	Name: contentTarget Value: %7B%22sourceId%22%3A%22lmb-54867-113582-809%22%7D
.quickenloans.com/	1969-12-31 23:59:59	Name: at_check Value: true
refinance.quickenloans.com/	1970-01-20 15:00:47	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiYjk2ZjdiY2MtZGI5ZS01M2VjLWJhMDMtZDZlZjhiNjlmYTQ3IiwidmlzaXRvcklkIjoiNzNkN2YyN2UtZTJkNC00ZGVjLWIyNzAtOTM0OTJjOThhNGMyIiwic2Vzc2lvbklkIjoiZWQ4YTk1ODMtN2E2OC00Njk4LWJiMzMtMmM2MjM1OWY3MTVhIiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiI4MDkiLCJwa2V5MiI6IjIiLCJwa2V5MyI6IjJlY2U0NWUwYjQwNzQ3NGU4NDM0MWYzZjkzMjhjNDA4Iiwic291cmNlSWQiOiJsbWItNTQ4NjctMTEzNTgyLTgwOSIsInNpZCI6IjkiLCJjbXBpZCI6IjkiLCJjcnRpZCI6IiIsIm9pZCI6IjkiLCJhZmZpZCI6IjgwOSIsIl9lZl90cmFuc2FjdGlvbl9pZCI6IjJlY2U0NWUwYjQwNzQ3NGU4NDM0MWYzZjkzMjhjNDA4IiwiYWdlIjpudWxsLCJkZXZpY2UiOm51bGwsImZvcmNlTmFtZXMiOm51bGwsImZvcmNlSXAiOm51bGwsImZvcmNlVGVzdElkcyI6bnVsbCwiaW5xdWlyeUlkIjpudWxsLCJpbnF1aXJ5U2lnbmF0dXJlIjpudWxsLCJpc1Rlc3QiOm51bGwsImxldmVsT2ZFZHVjYXRpb24iOm51bGwsIm1vaWQiOm51bGwsInByb3BlcnR5U3RhdGVDb2RlIjpudWxsLCJyZXNvbHV0aW9uIjoiIiwidHRUcmFjZUlkIjpudWxsLCJwcm92aWRlcklkIjpudWxsLCJxbHMiOm51bGwsInN0aWQiOm51bGwsIm92a2V5IjpudWxsLCJvdnJhdyI6bnVsbCwib3ZtdGMiOm51bGwsIm1vcnRnYWdlQmFsYW5jZVJhbmdlIjpudWxsLCJkYXRlTm93IjoxNjk1MDQyNTY4MDg1LCJyYW5kb21OdW1iZXIiOjcwNTg5LCJtYXJrZXRpbmdPZmZlcklkIjpudWxsLCJ0aW1lT25Gb3JtU3RhcnRUaW1lIjoiMjAyMy0wOS0xOFQxMzowOToyOC4xODZaIiwib3JpZ2luUmVxdWVzdGVkVXJpIjoiaHR0cHM6Ly9yZWZpbmFuY2UucXVpY2tlbmxvYW5zLmNvbSIsInByZXNlbnRhdGlvbk5hbWUiOiIyODcwNTAwX01TUUxfTFJFX0xQXzIwMjMtMDUtMjUiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vcmVmaW5hbmNlLnF1aWNrZW5sb2Fucy5jb20vP3BrZXkxPTgwOSZwa2V5Mj0yJnBrZXkzPTJlY2U0NWUwYjQwNzQ3NGU4NDM0MWYzZjkzMjhjNDA4JnNvdXJjZWlkPWxtYi01NDg2Ny0xMTM1ODItODA5JnNpZD05JmNtcGlkPTkmY3J0aWQ9Jm9pZD05JmFmZmlkPTgwOSZfZWZfdHJhbnNhY3Rpb25faWQ9MmVjZTQ1ZTBiNDA3NDc0ZTg0MzQxZjNmOTMyOGM0MDgiLCJ2ZXJ0aWNhbE5hbWUiOiJNU1FMX0xSRV9MQU5ESU5HIiwicmVmZXJyaW5nVXJpIjoiIiwiZmxvd0lkIjoiTVNRTF9MUkVfTEFORElOR19WRVJUSUNBTF9GTE9XXzEiLCJ0ZXN0SWQiOjIxMjgxNzMsImNsaWVudElwQWRkcmVzcyI6IjI2MDI6ZmZjODoyOjEwNDo6MTUiLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE3LjAuNTkzOC44OCBTYWZhcmkvNTM3LjM2IiwiYm90IjpmYWxzZSwiaWF0IjoxNjk1MDQyNTY4fQ.I27Bmb6qSkugHe6Lq7DsVUb8wJ8yC1ehDEXXGVhRzExBFPr8E1FDGF9QuKrNz0CiJTqUt-MWiszBKqDqrpCq9LfUh8m7MzZihcW95IUCovnuBaFIvGkhX6IwoNL5QAw2BQwASHQGd-_9O_r4Dc9_83kU_pQfqnTk1cQOAvMAbH76qWSBr-cEDj_glBDBm149QnoEAzZNEJ4z21lEcopXQAlelOXjowYG_TgxR1BURuEAPzblplX7_UYD45zoW5qmQsuGd5tnuPPFsxSjHtldiEQ0DEnpViuC-3UgURQlJzlScfe0aATJKIGxCW2pSufvHty33w4yD02O1PTnCuX4OSZyJlTKGjFiqUFDtgJ232Hk5-KmHjTuSblh3ZIUl43ZtuheCOzb_9NyzQiEhi_kLPK0zUytdDb1Du228PJXwo0-rK-ev9Zz01M-k2ubztXBIUBdgv2Pfk6IBQl_Peu8y6OD2j5uySas-OhNObZzQ2lZwKb4leiqyaux-HBoMi1-q2wCT49kebiZggrTX_oHXq4y19LunNxK5_1by0a_2pWS6HyAg_ozSRlBEKi-BbA7b-7Nc-1bL-0IOWAGQiz5OmqG3rUpaf7vdxlJCArYQETNZB-b2GPIUqU3sgfWSSsgChzK0mRbfPgEdng_S-Hv0bXyfbbta20gyoSwloJ_FLoC4VwUcPflUBnIuJhuOn43_ubZbGMCQ0VSul1SKMhZN8d2Kxh4L76ZLt45a6wQrRbsgT5N0AKPEg8pDr40Bg-UGtQ5IDXH8U5G0z0MuWgpQvaKhpyAFylnKkbQzEdej90l8QWUkqgprgK2w5f8E4b25Zmm8L3bGi7qYNc8Vw0h5sPS-fomV3c1leOzDWHwP-ZPgb5U49mwbcINQ09nM-b_iBKlRj8U8g--wuJ7zUt1X0RI6drPRHRcYZrsa85r9FE-6VI8KzYuDvwRChQOm7BcbkLhX1QiHiyv4eAO1_AG6vj4U3O9VQnpWPaZ3k9ok7KLyrA_m0gx9qgdDDGPymgbeAmIoGRKDfMz4x2rIPPREJcSztfU7ZDdBymzsvoQ-YnYEocq4gbDuBvQ6eTDAiB-d4QvLVIRwkmGjp0Dqq7CstfJPKFf2RtqktRd6kr9k2TrfDb2Q3DyggtSJk6iCvVrEvZEb_zptTZcOCmoimymDg4I81wyqKcW3aUmcqT6Yp2XsGMKrP2Y3Xes2JxVlXJeAOtJagA1zh9gjHqRa3jRoD_EaFL4-_fekoqmHHylM4HESiyTDZGcW2w_O3C8a5C07IsvFkW0AS22AfVqg3SYjLOQ2uP0dmaSlqdBXCKzyL9nK_jRC-2xd3iVunO5Olf4uYpcXY9-zyV0xAP7IZhNlw
.everesttech.net/	1970-01-20 23:36:18	Name: everest_g_v2 Value: g_surferid~ZQhMCAAABMafLGzY
.everesttech.net/	1969-12-31 23:59:59	Name: everest_session_v2 Value: ZQhMCAAABMafLGzY
.demdex.net/	1970-01-20 19:09:54	Name: demdex Value: 31366899561828374250697598167542927278
refinance.quickenloans.com/	1970-01-20 14:50:43	Name: _dd_s Value: rum=0&expire=1695043468460
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
.amazon-adsystem.com/	1970-01-20 19:32:56	Name: ad-id Value: A1V61d8vCEQsspTKpkMkjwE
.amazon-adsystem.com/	1970-01-21 00:26:42	Name: ad-privacy Value: 0
.quickenloans.com/	1970-01-20 17:00:18	Name: _gcl_au Value: 1.1.224440235.1695042569
.quickenloans.com/	1970-01-21 00:26:42	Name: s_ecid Value: MCMID%7C31556989266148752570712365094339234662
.quickenloans.com/	1970-01-21 00:26:42	Name: _ga_WQ7TGZQSWQ Value: GS1.1.1695042568.1.0.1695042568.0.0.0
.quickenloans.com/	1970-01-21 00:26:42	Name: _ga Value: GA1.1.153451100.1695042569
.everesttech.net/	1970-01-20 15:35:20	Name: ev_sync_dd Value: 20230918
.quickenloans.com/	1970-01-21 00:26:42	Name: mbox Value: session#75fb760491a8401c9afbfaf86c7d57bd#1695044429\|PC#75fb760491a8401c9afbfaf86c7d57bd.34_0#1758287369
.quickenloans.com/	1970-01-21 00:26:42	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 179643557%7CMCIDTS%7C19619%7CMCMID%7C31556989266148752570712365094339234662%7CMCAAMLH-1695647368%7C7%7CMCAAMB-1695647368%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1695049768s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.5.0
.refinance.quickenloans.com/	1969-12-31 23:59:59	Name: Value: GA1.3.153451100.1695042569
.refinance.quickenloans.com/	1970-01-20 14:52:08	Name: _gid Value: GA1.3.599668864.1695042569
.refinance.quickenloans.com/	1970-01-20 14:50:42	Name: _gat_gtag_UA_3849768_74 Value: 1
.quickenloans.com/	1970-01-21 00:26:42	Name: s_v12 Value: 1695042568893
.quickenloans.com/	1970-01-20 14:50:44	Name: s_v12_s Value: First%20Visit
.quickenloans.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.agkn.com/	1970-01-20 23:36:18	Name: ab Value: 0001%3AUCP8bhA0kgwgAQXDrsApuoHwgBSNdNOH
.dpm.demdex.net/	1970-01-20 19:09:54	Name: dpm Value: 31366899561828374250697598167542927278
.quickenloans.com/	1970-01-20 17:00:18	Name: _rdt_uuid Value: 1695042569287.59bee65d-c2e2-49c1-b4af-7e36fb1b9a90
.mathtag.com/	1970-01-21 00:16:37	Name: uuid Value: 38f46508-4c09-4d00-ad83-0286dec2ba7e
.quickenloans.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .quickenloans.com
.quickenloans.com/	1970-01-21 00:26:42	Name: _lc2_fpi Value: ddc3c751f117--01ham6j13qnnc7ed6hc22vcdhr
.taboola.com/	1970-01-20 23:36:18	Name: t_gid Value: 2113f4cc-f618-4d62-86cc-c24f235670a5-tuctc01d189
.taboola.com/	1970-01-20 23:36:18	Name: t_pt_gid Value: 2113f4cc-f618-4d62-86cc-c24f235670a5-tuctc01d189
.doubleclick.net/	1970-01-21 00:26:42	Name: IDE Value: AHWqTUn0PDMKmw9t8FzQi2ERrK_XkkUV1L1S7BRE2uYLBwaVA7Yo90vbql_IOBxd
.mortgage.quickenloans.com/	1970-01-20 14:50:44	Name: __cf_bm Value: h4TDCYlSGF8ZLdy9nZdY06nO44cC9DE6B5EL98RLOcQ-1695042569-0-ASRkMjebEoRFSVdSjRKo+QLO830x89fS+w6DUPTveSoeDrjptKQomp2RKlQrHe3rnRKdYX3uuAIs4WhGtw3yA60=
.quickenloans.com/	1970-01-21 00:20:29	Name: _scid Value: ea998dc8-f92d-42af-b9bc-56540151bcc0
.quickenloans.com/	1970-01-21 00:20:29	Name: _scid_r Value: ea998dc8-f92d-42af-b9bc-56540151bcc0
.everesttech.net/	1970-01-20 15:35:20	Name: ev_sync_ax Value: 20230918
.revjet.com/	1970-01-21 00:26:42	Name: trx Value: 5238970607628518672
.mathtag.com/	1970-01-20 15:33:54	Name: mt_misc Value: mt_bt:1
.quickenloans.com/	1970-01-20 17:00:18	Name: _fbp Value: fb.1.1695042569561.410482310
.pmsrv.co/	1970-01-20 17:02:06	Name: _pmedia_opt-out Value: 1
.yahoo.com/	1970-01-20 23:36:40	Name: A3 Value: d=AQABBAlMCGUCEJbZb8Z8blPc6Mn2rDjzqZ0FEgEBAQGdCWUSZdxH0iMA_eMAAA&S=AQAAAsm2-QUgXkyMRz8Y840MHx4
.liadm.com/	1970-01-21 00:26:42	Name: lidid Value: 29e5468e-02c9-4f69-b1ed-e8a3fed1fe1d
www.lmbahsj2.com/	1970-01-20 14:52:08	Name: uniqueClick Value: 08a0c81f-cddb-4d11-807b-6f90b5da5b52:1695042569
.quickenloans.com/	1970-01-20 15:33:54	Name: ef_witness Value: 1
.quickenloans.com/	1970-01-20 15:33:54	Name: ef_tid_c_o_9 Value: 2ece45e0b407474e84341f3f9328c408
.quickenloans.com/	1970-01-20 15:33:54	Name: ef_tid_c_a_1 Value: 2ece45e0b407474e84341f3f9328c408
.pinterest.com/	1970-01-20 23:36:18	Name: ar_debug Value: 1
.refinance.quickenloans.com/	1970-01-20 23:36:18	Name: _pin_unauth Value: dWlkPU5qWTRaV1V3TkRjdE5Ua3hOQzAwTkdaa0xXRTJNR1V0WW1ZeE5UTmlaakk1WkRGaQ
.everesttech.net/	1970-01-20 15:35:20	Name: ev_sync_yh Value: 20230918
.rubiconproject.com/	1970-01-20 23:36:18	Name: khaos Value: LMOWKXWW-1E-JF73
.rubiconproject.com/	1970-01-20 23:36:18	Name: audit Value: 1\|yf8SXJZ/8EYAcSa3+MhdcffGAROye1UsPHTunaxTZ+SWLqPAUZ8eGNWh8do2zXrQlZ/0UZ4cLt8wHTRO1/p4iM1d+xr7gW6vRTjahTvbHTGKYiAR5ZjNhoTvR41I0/BDz9qx9MOU4/+tAOTmjEas6/WQzJBJR0DUpRuCy0WrP/0=
.casalemedia.com/	1970-01-20 23:36:18	Name: CMID Value: ZQhMCvjc2GaoXqrfqSATzAAA
.casalemedia.com/	1970-01-20 17:00:18	Name: CMPS Value: 1449
.casalemedia.com/	1970-01-20 17:00:18	Name: CMPRO Value: 1449
.adnxs.com/	1970-01-20 17:00:18	Name: uuid2 Value: 4364257010045724168
.adnxs.com/	1970-01-20 17:00:18	Name: anj Value: dTM7k!M4.FErk#WF']wIg2C$KdpDL$!]tbPl1MwL(!R7qUY#Q]P=Mv^YWJ$pD`eD+@QZs6R1nj:/X%W#.wL5oa9/sZwfzrVAex>oTWBCu(lOfM!x%4o*K$Si
.openx.net/	1970-01-20 23:36:18	Name: i Value: 9afd602b-449e-4316-a2bf-10248d39b10d\|1695042570
.pubmatic.com/	1970-01-20 17:00:18	Name: KRTBCOOKIE_218 Value: 4056-ZQhMCAAABMafLGzY&KRTB&22978-ZQhMCAAABMafLGzY&KRTB&23194-ZQhMCAAABMafLGzY&KRTB&23209-ZQhMCAAABMafLGzY
.pubmatic.com/	1970-01-20 15:33:54	Name: PugT Value: 1695021696
.refinance.quickenloans.com/	1970-01-20 14:50:44	Name: __cf_bm Value: 7A8_p2t56g9JJlaFBFVvl3VBe.csAxar8eVdtKdXbfA-1695042570-0-AU+Vz+dgMwpupaZXRWuOxBHWSgfnHhwK4vJ5Jiwi1Fph0W0lY8HuWGOkcUq3nWMd06T0/nQKFwmndGo2RZV+PuM=
.demdex.net/	1970-01-20 19:09:54	Name: dextp Value: 21-1-1695042568887\|771-1-1695042568994\|1083-1-1695042569100\|1085-1-1695042569201\|1086-1-1695042569304\|1087-1-1695042569452\|1088-1-1695042569827\|19913-1-1695042569964\|83349-1-1695042570064\|144230-1-1695042570165\|144231-1-1695042570267\|144232-1-1695042570367\|144233-1-1695042570469\|144234-1-1695042570570\|144235-1-1695042570671\|144236-1-1695042570772\|144237-1-1695042570873

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://script.anura.io/response.json Message: Failed to load resource: the server responded with a status of 400 ()
network	error	URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=ZQhMCAAABMafLGzY&img=1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
other	error	URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=2ece45e0b407474e84341f3f9328c408&sourceid=lmb-54867-113582-809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=2ece45e0b407474e84341f3f9328c408 Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
ad.doubleclick.net
ads.anura.io
ads.revjet.com
ads.yahoo.com
adservice.google.com
alb.reddit.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cdn1.decide.dev
cdn1.lockerdomecdn.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
content.refinance.quickenloans.com
cs-cdn.deviceatlas.com
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
echo4.bluehornet.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
image2.pubmatic.com
pix.revjet.com
pixel.everesttech.net
pixel.mathtag.com
pixel.rubiconproject.com
pixel1083.everesttech.net
psp.pushnami.com
quicken.demdex.net
quickenloans.tt.omtrdc.net
refinance.quickenloans.com
rp.liadm.com
rp4.liadm.com
s.amazon-adsystem.com
s.pinimg.com
s.yimg.com
sc-static.net
script.anura.io
sgtm.lowermybills.com
somni.quickenloans.com
sp.analytics.yahoo.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
sync-tm.everesttech.net
sync.search.spotxchange.com
trackpixel.refinance.quickenloans.com
trc.pushnami.com
trc.taboola.com
us-u.openx.net
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
www.npvnt7trk.com
www.redditstatic.com
sync.search.spotxchange.com
100.24.159.94
104.18.27.193
104.77.220.247
104.77.9.10
108.139.53.136
13.225.63.247
15.204.180.50
151.101.129.140
151.101.65.44
151.101.66.49
151.139.128.10
172.217.13.162
172.217.13.166
172.217.13.194
18.160.18.24
18.238.25.49
18.239.183.117
2001:4860:4802:32::15
2001:4998:14:800::1000
2600:1400:d:5a9::1931
2600:141b:f000:c0b4::1e80
2600:1f18:730:b120:ec5e:651e:a0cc:77a3
2600:9000:23cb:7200:8:8845:1500:93a1
2600:9000:2514:1000:a:8e7d:9900:93a1
2606:4700::6810:3965
2606:4700::6812:84b
2606:4700::6812:d2b
2607:f8b0:4006:809::200e
2607:f8b0:4006:81c::2004
2607:f8b0:4020:804::2002
2607:f8b0:4020:804::2003
2607:f8b0:4020:804::2008
2607:f8b0:4020:805::2002
2607:f8b0:4020:807::200a
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:83:face:b00c:0:25de
2a04:4e42::396
3.160.22.127
3.18.206.181
34.193.178.107
34.202.55.199
34.36.162.171
34.98.64.218
35.201.76.131
44.216.88.67
52.205.43.200
52.46.143.56
52.54.223.166
52.55.2.158
54.184.143.209
54.236.156.168
54.92.195.210
63.140.38.113
63.140.38.225
68.67.179.155
69.173.151.100
72.251.228.33
76.13.32.146
8.28.7.83
023e93f1a46bc0df4e6f895ae2b81883656abfc0a4201869a30cc35aed81e4d9
040cdc6664debf00b44ae5f890f214cf0bd11d2eff9d82e58cdd4ad5f502fe45
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d
0cff5de0a6dddcb01b664acb7cce79cd85b5a941e7e8f74423c8024e60704005
0dd1971699f19f33219608023cd1f3294e8c0bed22cd575610c85644e5942271
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0f3af8f7154ec6ee3f7377c18a65856ce6f9c692623ee3189c5beb7714e959bc
1243bb1d70f364436d128888099b82555fdeebe91fc0ec85d844b14de7ea826a
1c89cbec675b4ef1f30d210dffc24378ba72c4b7703897d4dd106592b3928953
1ef8b676943da5a052097007d8e7f47d3b3216a4ef8b1f5db32705f187d28c6e
1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532
1fbbdbb0716bc4c289e0aa2c52df10c3e885db82431a089f6ab00b54d4fe5c79
1fc55355e3f94d05691245507674666443d099d7a73913a8d853d0c633d3801c
2677ade12878022f72b418ea075be3a4fd528719383bc9f335af9ee9f9dd53a1
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
28be27d04ce0ebac3fcd2862aa85bd45139b448cfa41647480b6a9f0180289e3
2d16a4f6786e1b33a7c80a049e565cb270bc7bc03fc2a3e34b38199124e4bec4
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
32d3b871795b2f09a385649debf72c7b426d06178584007b4b8c6d48ee9d1489
352dfd9b6f1ce246ae2843a7c8fb82182d8e1449cd722d1572105a99aaff5fb3
361c26946b433dea1466c98f82910c9d73d86679f6f7731317c5b46f7aa4484a
37a8e8357abacc4b3eddfc0933a0c596f3a2b5d3b104e2ebe2816fb4ea40d93a
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
3e2939a707a74a9d84c87364660c4e1c107f4b14586cbc69f6eacea6bcc3b4ae
3ef64e4a0001cd55211fff6bd306290f29c7482a6006d070ee21e52484b7ef22
42289448ad4c90a7e3cf279252dbe7a47406bd7d984d8fde3481e732ac4c7577
4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
4757fa5c80eeaf844fbb9780ee8cc035a8080dfe19d5ab77d470716728d9d992
480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91
48c42e472dd885d66d30bff44848b9c93bf181ba935ac3c9b0072ed1ac5fa05d
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4ccc380be2766720f492219d5e3e0731fddef23074c6fe9a47abbb74e23a96ee
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5db16b87d5d9e56d89df05b4f4c17866db07610de5a82226788be81b1ec55be1
6596ea36bf758c2f1d6dd8d40249ab6dae02d46a4aa02c393d65acb0fab0866f
66e58d37cc4b8168a1bd6678e085b43e939eb138fe608b7faffe3b1ba76b0c7b
67310618993281dd03f8191dd360c87459974b00ce3f65aafb4b70fa402f1832
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c45201328ea7349692faf8e6eff681eb5f4781e18ac8892647b7998484cae01
6e27d15cfd60dd88155c92f4a08039e556b9c4102b939ddb0228ab2e9943618d
7579fea8b4d6ea390f1a708a3b08b08911f3df414f650fa850780d0b3211cab7
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
7a263580491a7b7e9fe90672238ffb3ac54703161066ed30091c28980e02d4bf
7a4f7f6b7b8051a0361a5128495a8137e1d146dbdd6666cb709d628e9492f817
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7dbb99afa2ca46884692f7772146d6f3f7c4f1ba928babc0f490f3e7ba62114e
7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5
83c43bd904966541549600341d72de1ad6e24f4ef8d99f386901242e9b25b5f9
881a972d1911be9a60b866a30a922ba57e883987f8a5bd258cbd25d41ffb8325
882a3f5c78a7722361cbee21b43682de7b4810fa157f1ada9fc77542cf22d3ae
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
8eb072483e96c9baf13945a9ec7a1ee671d075bf6c073c18cefbb09c31e3c7ab
8fc4aa58eba36944f49a93d645f69635e8d5643cde97ac4ab14c025d2a4d70bc
8fed8c0b144807dea57d210b28a9a494e5dcdcfd84cea01183962f761e343d71
9195c01364f9d8605417254814ecfb809833b2807bc45d3164cc0fce6b96ca2b
9366657c6ffeb9d3c63d608854c9c2396e199a88cfa96f0346de4bc6a812cd91
9483c228080d0daba63a608af4c27d229b1f53beb69d1ef240021386c2f213cc
99313327dc04ba90495735ca4e9a25a27d7fcdc08088c3649069df1d02f18886
9af496e1a0da9562a2610440dcba94c656687a0739838df5fa0efd0e3f20035c
a2412cd19e10c14ec852b88cbc88e7168721d2352d5db7420fe76b2ecf35e3ff
a66c38e5323315afd25fc11ad0be55316cbe19e2dad5e688b56e66c4a6e4f186
aa6bc294cac2868a8f212d00d228d67e98b02b88cfe83cdb60b7d3bd73686675
acb30644eaa8bd3786aef4a0a0b200008603544df903b4b900609d3a8adfd9ad
ad7663f9710984dd27935c778f95d5edbf5629cbaf71cc2a08391da2aa3d87a3
aee7d51c64178b9cb49d3b8e3cf88427773330351f50cca58f3eab6d681f4524
b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05
b055210c4ea5f15b47bb9a167b146ce57b90fa63e8208cd6a0437dfce8c0b412
b137a269bf7179847c55069c87d5c118de379ad6e622cfecf477340d639eacaa
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b58109431c3adc92bccc460ac5dc394dc4f0979d24656f7a52503e6c77709d0b
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
bbcdb35bd1f632836976403f31d234f7251fca3820a4bc39a4f7d45b41f29bf8
bdd596be73744dd088bcf3d4caf82bc5456ba3d49fa67c97fa9839f36dc03bff
be3abf19a71918ed5cce35daf627696175dc3da4299acf7142d7b3f8a29f83fa
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c235f21017bcc11fcaa31d7dfd9855aaebcbf5f6d7ee9bf9f2e98a910907c391
d0033fdf52f33c2e89e6200c991910bbfc104ce6b72960e1f2ce3053e0cdbc8a
d2d82c5822b8884cfc04854300efa606c998504aa9da2ad681422e7f3eeec321
d6536ea7ec3e097479827159fd197a7110053263dd9209b3a33d616a2efab54a
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
d6fd1d4b577b900581547964aafb80eb61f0e3700d0dbb42ffe8e2b410f7d4ad
d7cb2c2f08454c0b1f346e0343bbf085b65da2d6b0997b5e12bbea90ed541be6
dab73b69791e9a455bcbec3f83b4562369c5bbfb5c2ad2505e79e61698cba4ee
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df578b68a5c3cf474d1c6a66be80a1cc93856e039913ab1aa34a552bff1085d5
df822e44efc31160c2e2cff9d29435159054bcceb67fa2512c3899f02dfb7557
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
e8cb28b64b27e0ccd7c484fd4477969a1f96f7d303ae3dad13a2f0a5f04af0c5
ead030154a651dbf216d5c043e974bb3f78b640078472f63d4277db7deb1faae
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0
f1785f78f9228b21fbc8ed88b7298197e5d0dc651dcb226c6587be6d9f825418
f2f7fefae346ab308ff32a04c07e32e0660b23dc5c71d3bdfd0738dda553ffc5
f3970329d8784109cfc707112369c71662b9f651512bc9ac146c774fd47a9bd6
fbb94c5679b44ba29904bc98db022e030c1605a29afc040b1a00dfbed27fcc28

refinance.quickenloans.com Open in urlscan Pro 2606:4700::6812:d2b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

156 Requests

83 %HTTPS

34 %IPv6

46 Domains

66 Subdomains

53 IPs

3 Countries

2217 kBTransfer

6240 kBSize

68 Cookies

18 Outgoing links

Page URL History

Redirected requests

156 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:d2b Public Scan

Screenshot
Live screenshot

Full Image

156
Requests

83 %
HTTPS

34 %
IPv6

46
Domains

66
Subdomains

53
IPs

3
Countries

2217 kB
Transfer

6240 kB
Size

68
Cookies

156 HTTP transactions
0 data transactions