www.benefitspro.com Open in urlscan Pro
2606:4700:4400::ac40:9199 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mail.rch1.com/e3t/Ctc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-...
Effective URL:
https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20...
Submission: On September 27 via api (September 27th 2022, 4:27:23 pm UTC) from US — Scanned from DE

Summary HTTP 256 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 57 IPs in 7 countries across 43 domains to perform 256 HTTP transactions. The main IP is 2606:4700:4400::ac40:9199, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.benefitspro.com. The Cisco Umbrella rank of the primary domain is 346312.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 22nd 2022. Valid for: a year.

This is the only time www.benefitspro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:2c40::c7... 2606:2c40::c73c:671d	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1 42	2606:4700:440... 2606:4700:4400::ac40:9199	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	192.226.82.212 192.226.82.212	16524 (METTEL) (METTEL)
1 1	2606:4700:440... 2606:4700:4400::6812:2a67	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2a02:26f0:11a... 2a02:26f0:11a::6867:4851	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:400d:80e::200a	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 13	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
14	184.51.10.56 184.51.10.56	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700:10:... 2606:4700:10::6816:39ae	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:1495	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:80e::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700:10:... 2606:4700:10::ac43:264e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	104.75.88.194 104.75.88.194	16625 (AKAMAI-AS) (AKAMAI-AS)
13	104.18.22.230 104.18.22.230	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.32.99.47 13.32.99.47	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:22b2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:400d:80a::2003	15169 (GOOGLE) (GOOGLE)
1 3	52.210.26.59 52.210.26.59	16509 (AMAZON-02) (AMAZON-02)
2	18.135.121.86 18.135.121.86	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f00... 2a03:2880:f007:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	199.232.16.157 199.232.16.157	54113 (FASTLY) (FASTLY)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:400d:807::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223c:aa00:18:1fcd:351:7bc1	16509 (AMAZON-02) (AMAZON-02)
2 2	142.251.39.34 142.251.39.34	15169 (GOOGLE) (GOOGLE)
2	18.185.150.186 18.185.150.186	16509 (AMAZON-02) (AMAZON-02)
1	18.66.112.103 18.66.112.103	16509 (AMAZON-02) (AMAZON-02)
4	34.111.234.236 34.111.234.236	15169 (GOOGLE) (GOOGLE)
2	3.215.172.219 3.215.172.219	14618 (AMAZON-AES) (AMAZON-AES)
2 2	52.51.170.224 52.51.170.224	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:223... 2600:9000:223f:fc00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
8 16	172.217.18.6 172.217.18.6	15169 (GOOGLE) (GOOGLE)
1	35.201.104.135 35.201.104.135	15169 (GOOGLE) (GOOGLE)
1	192.226.85.63 192.226.85.63	16524 (METTEL) (METTEL)
4	45.133.44.4 45.133.44.4	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.19.103.22 52.19.103.22	16509 (AMAZON-02) (AMAZON-02)
2	15.188.95.229 15.188.95.229	16509 (AMAZON-02) (AMAZON-02)
1 1	34.248.32.199 34.248.32.199	16509 (AMAZON-02) (AMAZON-02)
4	99.83.218.184 99.83.218.184	16509 (AMAZON-02) (AMAZON-02)
4	99.83.154.140 99.83.154.140	16509 (AMAZON-02) (AMAZON-02)
1	34.200.39.142 34.200.39.142	14618 (AMAZON-AES) (AMAZON-AES)
2	18.195.240.254 18.195.240.254	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
24	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
3	45.133.44.3 45.133.44.3	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
4	2a0c:5c81:514... 2a0c:5c81:5142::2	55081 (24SHELLS) (24SHELLS)
20	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
2 7	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:400d:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	18.208.125.13 18.208.125.13	14618 (AMAZON-AES) (AMAZON-AES)
1	52.73.151.3 52.73.151.3	14618 (AMAZON-AES) (AMAZON-AES)
1	35.86.50.147 35.86.50.147	16509 (AMAZON-02) (AMAZON-02)
256	57

2 2606:2c40::c73c:671d (United States) 1 redirects

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

mail.rch1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 2606:4700:4400::ac40:9199 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.benefitspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.benefitspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.226.82.212 (Deer Park, United States) 1 redirects

ASN16524 (METTEL, US)

store.law.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2a67 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

store.benefitspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:11a::6867:4851 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80e::200a (Ireland)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 184.51.10.56 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a184-51-10-56.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:39ae (United States)

ASN13335 (CLOUDFLARENET, US)

users.api.jeeng.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:1495 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80e::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:264e (United States)

ASN13335 (CLOUDFLARENET, US)

telemetries.jeeng.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.75.88.194 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-194.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 104.18.22.230 (None, )

ASN13335 (CLOUDFLARENET, US)

www.dianomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-47.fra60.r.cloudfront.net

s.dpmsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:22b2 (United States)

ASN13335 (CLOUDFLARENET, US)

imageserver.amlaw.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:400d:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.210.26.59 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-26-59.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.135.121.86 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-135-121-86.eu-west-2.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f007:8:face:b00c:0:1 (Vienna, Austria)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.16.157 (Vienna, Austria)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:807::2002 (Ireland)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

aa66ca644bf800eb55046400a2fef300.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:aa00:18:1fcd:351:7bc1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.39.34 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: bud02s38-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.185.150.186 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-150-186.eu-central-1.compute.amazonaws.com

datacloud.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
collect.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-103.fra56.r.cloudfront.net

ak.sail-horizon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.111.234.236 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 236.234.111.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.215.172.219 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-215-172-219.compute-1.amazonaws.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.51.170.224 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-170-224.eu-west-1.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223f:fc00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 172.217.18.6 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.104.135 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 135.104.201.35.bc.googleusercontent.com

vi.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.226.85.63 (Honesdale, United States)

ASN16524 (METTEL, US)

geoip.alm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 45.133.44.4 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

player.mediafuse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
player.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.103.22 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-103-22.eu-west-1.compute.amazonaws.com

alm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.95.229 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

b.law.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.32.199 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-32-199.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 99.83.218.184 (United States)

ASN16509 (AMAZON-02, US)
PTR: a710cf531d4cd2506.awsglobalaccelerator.com

api.sail-track.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 99.83.154.140 (United States)

ASN16509 (AMAZON-02, US)
PTR: aa7557bb34ea5624b.awsglobalaccelerator.com

api.sail-personalize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.200.39.142 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-39-142.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.195.240.254 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-240-254.eu-central-1.compute.amazonaws.com

visitor-service-eu-central-1.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 45.133.44.3 (Philadelphia, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

player.hbmp.mediafuse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.safeservingcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a0c:5c81:5142::2 (London, United Kingdom)

ASN55081 (24SHELLS, US)

ghb.hbmp.mediafuse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ghb.adtelligent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:400d:80e::2002 (Ireland)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.208.125.13 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-208-125-13.compute-1.amazonaws.com

go.alm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.73.151.3 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-151-3.compute-1.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.86.50.147 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-86-50-147.us-west-2.compute.amazonaws.com

a.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	benefitspro.com 2 redirects www.benefitspro.com — Cisco Umbrella Rank: 346312 store.benefitspro.com — Cisco Umbrella Rank: 680343 images.benefitspro.com — Cisco Umbrella Rank: 255956	309 KB
38	googlesyndication.com aa66ca644bf800eb55046400a2fef300.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 142 pagead2.googlesyndication.com — Cisco Umbrella Rank: 105	251 KB
32	doubleclick.net 11 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 180 cm.g.doubleclick.net — Cisco Umbrella Rank: 210 ad.doubleclick.net — Cisco Umbrella Rank: 178 googleads.g.doubleclick.net — Cisco Umbrella Rank: 41	273 KB
20	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 359	434 KB
16	moatads.com z.moatads.com — Cisco Umbrella Rank: 403 mb.moatads.com — Cisco Umbrella Rank: 659 px.moatads.com — Cisco Umbrella Rank: 467 geo.moatads.com — Cisco Umbrella Rank: 668	475 KB
13	dianomi.com www.dianomi.com — Cisco Umbrella Rank: 5488	81 KB
11	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1002	89 KB
10	typekit.net use.typekit.net — Cisco Umbrella Rank: 430 p.typekit.net — Cisco Umbrella Rank: 577	189 KB
8	google.com 2 redirects adservice.google.com — Cisco Umbrella Rank: 75 www.google.com — Cisco Umbrella Rank: 2	1 KB
7	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 293 fonts.googleapis.com — Cisco Umbrella Rank: 40	11 KB
6	ml314.com ml314.com — Cisco Umbrella Rank: 1652 vi.ml314.com — Cisco Umbrella Rank: 27777 in.ml314.com — Cisco Umbrella Rank: 8146	64 KB
6	gstatic.com fonts.gstatic.com	171 KB
5	mediafuse.com player.mediafuse.com — Cisco Umbrella Rank: 46295 player.hbmp.mediafuse.com — Cisco Umbrella Rank: 29250 ghb.hbmp.mediafuse.com — Cisco Umbrella Rank: 42852	133 KB
4	adtelligent.com player.adtelligent.com — Cisco Umbrella Rank: 5896 ghb.adtelligent.com — Cisco Umbrella Rank: 5717	94 KB
4	sail-personalize.com api.sail-personalize.com — Cisco Umbrella Rank: 2703	664 B
4	sail-track.com api.sail-track.com — Cisco Umbrella Rank: 7315	696 B
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 394 www.linkedin.com — Cisco Umbrella Rank: 623 px4.ads.linkedin.com — Cisco Umbrella Rank: 6198	4 KB
4	adsafeprotected.com 2 redirects pixel.adsafeprotected.com — Cisco Umbrella Rank: 616 static.adsafeprotected.com — Cisco Umbrella Rank: 575	1 KB
4	tealiumiq.com datacloud.tealiumiq.com — Cisco Umbrella Rank: 6318 collect.tealiumiq.com — Cisco Umbrella Rank: 2714 visitor-service-eu-central-1.tealiumiq.com — Cisco Umbrella Rank: 47397	3 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 208 alm.demdex.net — Cisco Umbrella Rank: 106917	6 KB
4	law.com 1 redirects store.law.com — Cisco Umbrella Rank: 84369 b.law.com — Cisco Umbrella Rank: 96505	6 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 152	131 KB
3	jeeng.com users.api.jeeng.com — Cisco Umbrella Rank: 23697 telemetries.jeeng.com — Cisco Umbrella Rank: 14009	123 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 209	39 KB
2	safeservingcdn.com p.safeservingcdn.com — Cisco Umbrella Rank: 22087	27 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	222 B
2	alm.com geoip.alm.com — Cisco Umbrella Rank: 102550 go.alm.com	1 KB
2	pardot.com pi.pardot.com — Cisco Umbrella Rank: 3575	5 KB
2	rch1.com 1 redirects mail.rch1.com	5 KB
1	ad.gt a.ad.gt — Cisco Umbrella Rank: 3831	4 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 190	44 KB
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 538	725 B
1	t.co t.co — Cisco Umbrella Rank: 489	376 B
1	chartbeat.net ping.chartbeat.net — Cisco Umbrella Rank: 1220	201 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1036	517 B
1	sail-horizon.com ak.sail-horizon.com — Cisco Umbrella Rank: 2700	44 KB
1	chartbeat.com static.chartbeat.com — Cisco Umbrella Rank: 1317	15 KB
1	google.de adservice.google.de — Cisco Umbrella Rank: 9081	792 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 769	3 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 613	15 KB
1	amlaw.com imageserver.amlaw.com — Cisco Umbrella Rank: 53841	118 KB
1	dpmsrv.com s.dpmsrv.com — Cisco Umbrella Rank: 22471	520 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	53 KB
256	43

	Domain	Requested by
41	www.benefitspro.com	1 redirects mail.rch1.com www.benefitspro.com
24	tpc.googlesyndication.com	ad.doubleclick.net tpc.googlesyndication.com www.benefitspro.com securepubads.g.doubleclick.net cdn.ampproject.org
20	cdn.ampproject.org	securepubads.g.doubleclick.net
16	ad.doubleclick.net	8 redirects www.dianomi.com www.benefitspro.com
13	pagead2.googlesyndication.com	tpc.googlesyndication.com www.benefitspro.com securepubads.g.doubleclick.net
13	www.dianomi.com	www.benefitspro.com www.dianomi.com
12	securepubads.g.doubleclick.net	1 redirects www.benefitspro.com securepubads.g.doubleclick.net tags.tiqcdn.com mail.rch1.com www.googletagservices.com
11	tags.tiqcdn.com	www.benefitspro.com tags.tiqcdn.com
9	px.moatads.com	www.dianomi.com www.benefitspro.com
9	use.typekit.net	www.benefitspro.com use.typekit.net
7	www.google.com	2 redirects www.benefitspro.com securepubads.g.doubleclick.net tpc.googlesyndication.com
6	fonts.gstatic.com	www.benefitspro.com fonts.googleapis.com
6	fonts.googleapis.com	www.benefitspro.com ajax.googleapis.com securepubads.g.doubleclick.net
5	z.moatads.com	www.benefitspro.com ad.doubleclick.net securepubads.g.doubleclick.net
4	api.sail-personalize.com	ak.sail-horizon.com
4	api.sail-track.com	ak.sail-horizon.com
4	ml314.com	tags.tiqcdn.com ml314.com z.moatads.com
3	connect.facebook.net	www.googletagmanager.com connect.facebook.net
3	dpm.demdex.net	1 redirects www.benefitspro.com
3	cdnjs.cloudflare.com	www.benefitspro.com
2	ghb.adtelligent.com	p.safeservingcdn.com
2	googleads.g.doubleclick.net	www.benefitspro.com
2	p.safeservingcdn.com	player.mediafuse.com p.safeservingcdn.com
2	ghb.hbmp.mediafuse.com	player.hbmp.mediafuse.com
2	player.adtelligent.com	player.mediafuse.com p.safeservingcdn.com
2	www.facebook.com	www.benefitspro.com
2	visitor-service-eu-central-1.tealiumiq.com	tags.tiqcdn.com
2	b.law.com	tags.tiqcdn.com www.benefitspro.com
2	px.ads.linkedin.com	2 redirects
2	player.mediafuse.com	www.benefitspro.com
2	static.adsafeprotected.com	www.dianomi.com
2	pixel.adsafeprotected.com	2 redirects
2	pi.pardot.com	tags.tiqcdn.com pi.pardot.com
2	cm.g.doubleclick.net	2 redirects
2	telemetries.jeeng.com	users.api.jeeng.com
2	store.law.com	1 redirects www.benefitspro.com
2	mail.rch1.com	1 redirects
1	a.ad.gt	player.hbmp.mediafuse.com
1	in.ml314.com	ml314.com
1	go.alm.com	pi.pardot.com
1	geo.moatads.com	z.moatads.com
1	www.googletagservices.com	securepubads.g.doubleclick.net
1	player.hbmp.mediafuse.com	player.mediafuse.com
1	analytics.twitter.com	www.benefitspro.com
1	t.co	www.benefitspro.com
1	ping.chartbeat.net	www.benefitspro.com
1	cm.everesttech.net	1 redirects
1	alm.demdex.net	tags.tiqcdn.com
1	px4.ads.linkedin.com	www.benefitspro.com
1	www.linkedin.com	1 redirects
1	geoip.alm.com	cdnjs.cloudflare.com
1	vi.ml314.com	www.benefitspro.com
1	collect.tealiumiq.com	tags.tiqcdn.com
1	ak.sail-horizon.com	tags.tiqcdn.com
1	datacloud.tealiumiq.com	www.benefitspro.com
1	static.chartbeat.com	tags.tiqcdn.com
1	aa66ca644bf800eb55046400a2fef300.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	snap.licdn.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	mb.moatads.com	z.moatads.com
1	imageserver.amlaw.com	www.benefitspro.com
1	s.dpmsrv.com	www.benefitspro.com
1	www.googletagmanager.com	www.benefitspro.com
1	p.typekit.net	use.typekit.net
1	images.benefitspro.com	www.benefitspro.com
1	users.api.jeeng.com	www.benefitspro.com
1	ajax.googleapis.com	www.benefitspro.com
1	store.benefitspro.com	1 redirects
256	70

This site contains links to these domains. Also see Links.

Domain
www.alm.com
www.facebook.com
twitter.com
www.linkedin.com
store.law.com
www.judydiamond.com
benefitsproluminaries.awardsplatform.com
freeerisa.benefitspro.com
www.bprobrokerexpo.com
www.event.benefitspro.com
almreprints.com
benefitspro.tradepub.com

Subject Issuer	Validity	Valid
mail.rch1.com Cloudflare Inc ECC CA-3	`2022-06-15` - `2023-06-15`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-22` - `2023-05-22`	a year	crt.sh
use.typekit.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-09-14` - `2023-10-15`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-11-27` - `2022-11-29`	a year	crt.sh
jeeng.com Cloudflare Inc ECC CA-3	`2022-08-13` - `2023-08-13`	a year	crt.sh
*.law.com Go Daddy Secure Certificate Authority - G2	`2022-02-09` - `2023-03-13`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
dianomi.com Cloudflare Inc ECC CA-3	`2022-05-03` - `2023-05-03`	a year	crt.sh
*.dpmsrv.com Amazon	`2022-04-17` - `2023-05-16`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-05`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-07-07` - `2022-10-05`	3 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2022-05-06` - `2023-06-03`	a year	crt.sh
ak.sail-horizon.com Amazon	`2022-01-06` - `2023-02-02`	a year	crt.sh
ml314.com GTS CA 1D4	`2022-08-20` - `2022-11-18`	3 months	crt.sh
*.tealiumiq.com Amazon	`2022-08-25` - `2023-09-23`	a year	crt.sh
pi.pardot.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-08` - `2022-11-07`	a year	crt.sh
vi.ml314.com GTS CA 1D4	`2022-08-29` - `2022-11-27`	3 months	crt.sh
*.alm.com Go Daddy Secure Certificate Authority - G2	`2021-12-23` - `2023-01-24`	a year	crt.sh
player.mediafuse.com R3	`2022-09-17` - `2022-12-16`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
b.law.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-10` - `2023-10-11`	a year	crt.sh
api.sail-track.com Amazon	`2022-05-25` - `2023-06-22`	a year	crt.sh
api.sail-personalize.com Amazon	`2022-05-25` - `2023-06-23`	a year	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2021-12-01` - `2022-12-30`	a year	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
player.hbmp.mediafuse.com R3	`2022-08-05` - `2022-11-03`	3 months	crt.sh
player.adtelligent.com R3	`2022-09-18` - `2022-12-17`	3 months	crt.sh
ghb.hbmp.mediafuse.com ZeroSSL ECC Domain Secure Site CA	`2022-08-05` - `2022-11-03`	3 months	crt.sh
p.safeservingcdn.com R3	`2022-08-13` - `2022-11-11`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
go.alm.com R3	`2022-09-22` - `2022-12-21`	3 months	crt.sh
ghb.adtelligent.com ZeroSSL ECC Domain Secure Site CA	`2022-08-05` - `2022-11-03`	3 months	crt.sh
*.ml314.com Amazon	`2021-12-17` - `2023-01-14`	a year	crt.sh
*.ad.gt Amazon	`2022-05-10` - `2023-06-08`	a year	crt.sh

This page contains 18 frames:

Primary Page: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Frame ID: 814A9CADF484EAEECE82E7007858A136
Requests: 133 HTTP requests in this frame

Frame: https://www.dianomi.com/smart_benefitspro.epl?id=3426&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
Frame ID: 1E062395A90946C9C7780536ED4A4527
Requests: 10 HTTP requests in this frame

Frame: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
Frame ID: E22DD034005F82C933BBF00F17D157E8
Requests: 17 HTTP requests in this frame

Frame: https://aa66ca644bf800eb55046400a2fef300.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 5F0B76D66979C138DF15863272C35CB3
Requests: 1 HTTP requests in this frame

Frame: https://www.benefitspro.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=75159b08cdfa9034
Frame ID: AE160948A39DCE95EE13D30797FD705F
Requests: 3 HTTP requests in this frame

Frame: https://alm.demdex.net/dest5.html?d_nsid=0
Frame ID: 2DC6413C64912376ACFAA8FC73F2BEE0
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B7D7249F87D335ACCE30785920D1CA17
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C2919576CC76A282A5197DA36119B8FB
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 33125789E5848FABB95F4D6DAEA868B7
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A8A4F0BE6D802DA68FAC5EFD3E4A380D
Requests: 3 HTTP requests in this frame

Frame: https://p.safeservingcdn.com/prebidlink/19262/j.html?i=11598
Frame ID: DADD3E44145542CC96B2AFEA7043A62F
Requests: 5 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs
Frame ID: B7B1AF29D5A42053875209392602ADB8
Requests: 15 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs
Frame ID: ED4E7181431489E9CC564BD642B58E01
Requests: 17 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs
Frame ID: 7AA3220CB82371B203DD4AF85411CB14
Requests: 15 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs
Frame ID: 96612380F173E5394648503315F3C39B
Requests: 17 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVcCkDAEDNFixzoHTyX2pHt2jVtZrGhiacI9AeHME5jqjUgLLXgTQ0pirnP2PS2LoH-GlIg4ryadzs18_tJQQ8mlvs3ggmvhgCK9vpXQ04MyLzZI45BsR6JWtwVZxs0AkJH7kGfVfVBiCl4LWE-6qF7Ux2S-_SBwXQwu8LUJtsUIzh7c_QN_zvK3rEMTFUmzuYowq02ZlDoERu5ac-YhBJBK2KKBd84cHQ-w7iCpKYjXyG1z9jS7Pkr4nFMc_R-HHA9dpzeOTgwroI89mklTEOXhYr8uRMJQYA_t_igW6HVCltM3vLIib3X8Ds4UHo1-nkJN83bYKQUt6Ky4ZEfubQo4glQBPT&sai=AMfl-YRpHWHXUBrFcEjjY9wNixR8oieJVQyvwqVSd3GvpLH3JuascuqN8ASuJmgg57PbOSsiDAoyxm58BrupBxMhuQS4JnSELdM4ggg_3EiutmeF_KEBvNcGZiqvp0x4EP4of2c&sig=Cg0ArKJSzG4raoSK_SHIEAE&uach_m=[UACH]&adurl=
Frame ID: B14C738CA1ADF7054FCC6BFD53342C2C
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 2921F920CDC33656F8F17EF989459542
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4C00B51CCD3433F060360055ED1E0453
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

401(k) truth bomb: Missing participants are bad, but 401(k) cashouts are worse | BenefitsPRO

Page URL History Show full URLs

https://mail.rch1.com/e3t/Ctc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-... Page URL
https://mail.rch1.com/events/public/v1/encoded/track/tc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8... HTTP 307
https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=... HTTP 302
https://store.law.com/Registration/Login.aspx?mode=silent&refDomain=store.benefitspro.com&source=h... HTTP 302
http://store.benefitspro.com/Registration/Login.aspx?mode=token&ucid=a969d66b-4175-4b67-9659-1fcd5518b19a... HTTP 302
https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Chartbeat (Analytics) Expand

Overall confidence: 100%
Detected patterns

chartbeat\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+use\.typekit\.(?:net|com)

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

underscore.*\.js(?:\?ver=([\d.]+))?

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

256
Requests

93 %
HTTPS

48 %
IPv6

43
Domains

70
Subdomains

57
IPs

7
Countries

3215 kB
Transfer

8205 kB
Size

59
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://www.alm.com/privacy-policy-new/#section5
Title: Click

Search URL Search Domain Scan URL

URL: https://www.facebook.com/BenefitsPro

Search URL Search Domain Scan URL

URL: https://twitter.com/Benefits_Pro

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/benefitspro/

Search URL Search Domain Scan URL

URL: https://store.law.com/Registration/Login.aspx?promoCode=BPRO:LIMITED&refDomain=store.benefitspro.com&source=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email
Title: Sign In

Search URL Search Domain Scan URL

URL: https://store.law.com/registration/default.aspx?promoCode=BPRO:LIMITED&refDomain=store.benefitspro.com&source=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email
Title: Register

Search URL Search Domain Scan URL

URL: https://www.judydiamond.com/bpro/health/?utm_source=BPro&utm_medium=nav&utm_campaign=BProReaders
Title: Leads

Search URL Search Domain Scan URL

URL: https://www.judydiamond.com/bpro/retirement/?utm_source=BPro&utm_medium=nav&utm_campaign=BProReaders
Title: Leads

Search URL Search Domain Scan URL

URL: https://benefitsproluminaries.awardsplatform.com/
Title: Event Site

Search URL Search Domain Scan URL

URL: https://freeerisa.benefitspro.com/
Title: FreeERISA

Search URL Search Domain Scan URL

URL: https://www.bprobrokerexpo.com/ehome/index.php?eventid=247060&
Title: BenefitsPRO Broker Expo

Search URL Search Domain Scan URL

URL: https://www.alm.com/terms-of-use-summit/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.alm.com/privacy-summit/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.alm.com/

Search URL Search Domain Scan URL

URL: https://www.event.benefitspro.com/bprobrokerexpo
Title: BROKER EXPO

Search URL Search Domain Scan URL

URL: https://almreprints.com/about-reprints/#permissions

Search URL Search Domain Scan URL

URL: https://store.law.com/registration/default.aspx?promoCode=BPRO:limited&refDomain=store.benefitspro.com&source=https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email
Title: Register Now

Search URL Search Domain Scan URL

URL: https://store.law.com/registration/login.aspx?promoCode=BPRO&refDomain=store.benefitspro.com&source=https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email
Title: Sign In Now

Search URL Search Domain Scan URL

URL: https://almreprints.com/?utm_source=website&utm_medium=reprintmodule&utm_campaign=B2B_reprints_general&utm_term=bpro

Search URL Search Domain Scan URL

URL: https://benefitspro.tradepub.com/free/w_defa3200/prgm.cgi

Search URL Search Domain Scan URL

URL: https://benefitspro.tradepub.com/free/w_alib11/prgm.cgi

Search URL Search Domain Scan URL

URL: https://benefitspro.tradepub.com/free/w_defa3168/prgm.cgi

Search URL Search Domain Scan URL

URL: https://store.law.com/registration/default.aspx?promoCode=BPRO:LIMITED&source=https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email

Search URL Search Domain Scan URL

URL: https://store.law.com/registration/login.aspx?promoCode=BPRO:LIMITED&source=https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email
Title: Sign In Now

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mail.rch1.com/e3t/Ctc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-bCW5fWL9p10s0jZW6p_xmD4CFqHMW1syMPm28BJvjW3rFsSW8_0stVW2r0S_21PlM7TW32Pz4075BVpZW2_XGTf3tlBHBW5xKWR61Kdz8vW3H7RZ-91hR8wW46pRb-36z2jyW4fD_zy7nvHYRN1PhwMp1MVkRW6frtx67v_s9zW7xcn6z7c7vYMW5Dt69R1-VKQ3W202Lhp7m6N7wW6qj7Rf2PlBB-W9kZ7tC6vTnJhW1CDBDl635mWVW5tRnRn3bQy53W2RhZbf8BTnQhW2TF8hb4JZdCKW41W9pX2B4KV3W6Fvphp1BvbgMW84LBZC6J-NjBW4zS4xL3CTMSVW6nvQjN3hyyBZ34sT1 Page URL
https://mail.rch1.com/events/public/v1/encoded/track/tc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-bCW5fWL9p10s0jZW6p_xmD4CFqHMW1syMPm28BJvjW3rFsSW8_0stVW2r0S_21PlM7TW32Pz4075BVpZW2_XGTf3tlBHBW5xKWR61Kdz8vW3H7RZ-91hR8wW46pRb-36z2jyW4fD_zy7nvHYRN1PhwMp1MVkRW6frtx67v_s9zW7xcn6z7c7vYMW5Dt69R1-VKQ3W202Lhp7m6N7wW6qj7Rf2PlBB-W9kZ7tC6vTnJhW1CDBDl635mWVW5tRnRn3bQy53W2RhZbf8BTnQhW2TF8hb4JZdCKW41W9pX2B4KV3W6Fvphp1BvbgMW84LBZC6J-NjBW4zS4xL3CTMSVW6nvQjN3hyyBZ34sT1?_ud=6602b383-2eef-44f7-9160-39c9d03ea37f&_jss=1&_fl=8&_pl=3&_hc=4&_lg=en-US,en&_plt=Win32&_scr=1600,1200 HTTP 307
https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email HTTP 302
https://store.law.com/Registration/Login.aspx?mode=silent&refDomain=store.benefitspro.com&source=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713 HTTP 302
http://store.benefitspro.com/Registration/Login.aspx?mode=token&ucid=a969d66b-4175-4b67-9659-1fcd5518b19a&source=https%3a%2f%2fwww.benefitspro.com%2f2018%2f07%2f26%2f401k-truth-bomb-missing-participants-are-bad-but-4%2f%3futm_campaign%3dCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3demail%26_hsmi%3d227288517%26_hsenc%3dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3d227288517%26utm_source%3dhs_email%26slreturn%3d20220827122713&debug=lawDomainIPWithRefRedirectAnon HTTP 302
https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12

https://securepubads.g.doubleclick.net/tag/js/gpt.js?2022-09-27-12 HTTP 301
https://securepubads.g.doubleclick.net/tag/js/gpt.js

Request Chain 67

https://dpm.demdex.net/id?d_visid_ver=3.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=96C4370453295E4C0A490D44%40AdobeOrg&d_nsid=0&ts=1664296035898 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=96C4370453295E4C0A490D44%40AdobeOrg&d_nsid=0&ts=1664296035898

Request Chain 87

https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm&tealium_vid=01837fc6262f0017beb4e9e9d0a103074015806c00b08&tealium_account=alm&tealium_profile=main HTTP 302
https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm=&tealium_vid=01837fc6262f0017beb4e9e9d0a103074015806c00b08&tealium_account=alm&tealium_profile=main&google_tc= HTTP 302
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=01837fc6262f0017beb4e9e9d0a103074015806c00b08&tealium_account=alm&tealium_profile=main&google_gid=CAESEGX5Ico2odpc7n7l0t6_zwc&google_cver=1

Request Chain 100

https://pixel.adsafeprotected.com/rfw/st/1133784/65726462/skeleton.gif HTTP 302
https://static.adsafeprotected.com/skeleton.gif

Request Chain 101

https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_pre=CMv5p_CxtfoCFVyW_QcdUYEC1w;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=

Request Chain 102

https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325825;dc_trk_aid=538276453;dc_trk_cid=178207315;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325825;dc_pre=CID7p_CxtfoCFTPyuwgdtYsCjQ;dc_trk_aid=538276453;dc_trk_cid=178207315;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=

Request Chain 105

https://pixel.adsafeprotected.com/rfw/st/1133784/65726462/skeleton.gif HTTP 302
https://static.adsafeprotected.com/skeleton.gif

Request Chain 106

https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_pre=CJndqPCxtfoCFbSW_QcdrZEP5g;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=

Request Chain 107

https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325822;dc_trk_aid=538276447;dc_trk_cid=178299482;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325822;dc_pre=CNX_p_CxtfoCFTfKuwgdp90KSw;dc_trk_aid=538276447;dc_trk_cid=178299482;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=

Request Chain 117

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=232066&time=1664296036189&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D232066%26time%3D1664296036189%26url%3Dhttps%253A%252F%252Fwww.benefitspro.com%252F2018%252F07%252F26%252F401k-truth-bomb-missing-participants-are-bad-but-4%252F%253Futm_campaign%253DCashout%252520Leakage%252520Email%252520Blast%2526utm_medium%253Demail%2526_hsmi%253D227288517%2526_hsenc%253Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%2526utm_content%253D227288517%2526utm_source%253Dhs_email%2526slreturn%253D20220827122713%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=232066&time=1664296036189&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=232066&time=1664296036189&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&liSync=true&e_ipv6=AQLTbPgHNycyHAAAAYN_xip9CDqKFeJjbKsVbg3XgaTqrUc8ZEov5MBklZmgQFP_NtEBDxI

Request Chain 120

https://cm.everesttech.net/cm/dd?d_uuid=26753440018087468940501124730123369998 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzMkZAAAAHpbswOJ

Request Chain 167

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=572512606;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CP7U1vCxtfoCFd3Puwgdv68Jnw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=572512606;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=

Request Chain 181

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=802021301;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CNi-2PCxtfoCFY7ddwod1ZQJOg;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=802021301;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=

Request Chain 195

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2468228528;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CPbp2fCxtfoCFUCe_QcdKoQImA;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2468228528;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=

Request Chain 210

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=1404473137;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CNrJ2vCxtfoCFbGC_QcdDK8B-Q;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=1404473137;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=

Request Chain 233

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 238

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

256 HTTP transactions
12 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-bCW5fWL9p10s0jZW6p_xmD4CFqHMW1syMPm28BJvjW3rFsSW8_0stVW2r0S_21PlM7TW32Pz4075BVpZW2_XGTf3tlBHBW5xKWR61Kdz8vW3H7RZ-91hR8wW46pR...
mail.rch1.com/e3t/Ctc/48+113/c2-l504/ 10 KB
4 KB 406ms
227ms Document
text/html 2606:2c40::c73c:671d
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://mail.rch1.com/e3t/Ctc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-bCW5fWL9p10s0jZW6p_xmD4CFqHMW1syMPm28BJvjW3rFsSW8_0stVW2r0S_21PlM7TW32Pz4075BVpZW2_XGTf3tlBHBW5xKWR61Kdz8vW3H7RZ-91hR8wW46pRb-36z2jyW4fD_zy7nvHYRN1PhwMp1MVkRW6frtx67v_s9zW7xcn6z7c7vYMW5Dt69R1-VKQ3W202Lhp7m6N7wW6qj7Rf2PlBB-W9kZ7tC6vTnJhW1CDBDl635mWVW5tRnRn3bQy53W2RhZbf8BTnQhW2TF8hb4JZdCKW41W9pX2B4KV3W6Fvphp1BvbgMW84LBZC6J-NjBW4zS4xL3CTMSVW6nvQjN3hyyBZ34sT1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:2c40::c73c:671d , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=3628800

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: false
cf-cache-status: MISS
cf-ray: 75159affad5f910d-FRA
content-encoding: br
content-type: text/html;charset=utf-8
date: Tue, 27 Sep 2022 16:27:13 GMT
last-modified: Tue, 27 Sep 2022 16:27:13 GMT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
referrer-policy: no-referrer
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GhKRx1mGObUw43NfpdQKcslYi%2FlcCgzM9EYy9gzIN7u62xn%2Bgy9WiqqaJ8iucvFTYLX3MbG%2B6TqMlQcw6HHhB5EG6IptU7eT7V2000pZKHoacQ1JbNuahQGerT4swPrrJhZ%2BgB9rzi8d7tw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=3628800
vary: Accept-Encoding
x-hs-https-only: worker
x-hubspot-correlation-id: 337c5f04-97df-46e3-b2ad-77918d920100
x-robots-tag: none

GET
H2

200

Primary Request / Show response
www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/
Redirect Chain

https://mail.rch1.com/events/public/v1/encoded/track/tc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-bCW5fWL9p10s0jZW6p_xmD4CFqHMW1syMPm28BJvjW3rFsSW8_0st...
https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM...
https://store.law.com/Registration/Login.aspx?mode=silent&refDomain=store.benefitspro.com&source=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-bu...
http://store.benefitspro.com/Registration/Login.aspx?mode=token&ucid=a969d66b-4175-4b67-9659-1fcd5518b19a&source=https%3a%2f%2fwww.benefitspro.com%2f2018%2f07%2f26%2f401k-truth-bomb-missing-partici...
https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM...

67 KB
15 KB

225ms
225ms

Document
text/html

2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713

Requested by

Host: mail.rch1.com
URL: https://mail.rch1.com/e3t/Ctc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-bCW5fWL9p10s0jZW6p_xmD4CFqHMW1syMPm28BJvjW3rFsSW8_0stVW2r0S_21PlM7TW32Pz4075BVpZW2_XGTf3tlBHBW5xKWR61Kdz8vW3H7RZ-91hR8wW46pRb-36z2jyW4fD_zy7nvHYRN1PhwMp1MVkRW6frtx67v_s9zW7xcn6z7c7vYMW5Dt69R1-VKQ3W202Lhp7m6N7wW6qj7Rf2PlBB-W9kZ7tC6vTnJhW1CDBDl635mWVW5tRnRn3bQy53W2RhZbf8BTnQhW2TF8hb4JZdCKW41W9pX2B4KV3W6Fvphp1BvbgMW84LBZC6J-NjBW4zS4xL3CTMSVW6nvQjN3hyyBZ34sT1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a328c21fadc1b4b4353c004aa511351033cbf4e6b80314ba95fda8c2657c9d19

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://mail.rch1.com/e3t/Ctc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-bCW5fWL9p10s0jZW6p_xmD4CFqHMW1syMPm28BJvjW3rFsSW8_0stVW2r0S_21PlM7TW32Pz4075BVpZW2_XGTf3tlBHBW5xKWR61Kdz8vW3H7RZ-91hR8wW46pRb-36z2jyW4fD_zy7nvHYRN1PhwMp1MVkRW6frtx67v_s9zW7xcn6z7c7vYMW5Dt69R1-VKQ3W202Lhp7m6N7wW6qj7Rf2PlBB-W9kZ7tC6vTnJhW1CDBDl635mWVW5tRnRn3bQy53W2RhZbf8BTnQhW2TF8hb4JZdCKW41W9pX2B4KV3W6Fvphp1BvbgMW84LBZC6J-NjBW4zS4xL3CTMSVW6nvQjN3hyyBZ34sT1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
backend: templates_newlaw_director
cf-cache-status: DYNAMIC
cf-ray: 75159b08cdfa9034-FRA
content-encoding: br
content-language: de-DE
content-type: text/html;charset=utf-8
date: Tue, 27 Sep 2022 16:27:14 GMT
server: cloudflare
vary: accept-encoding
x-cache: MISS
x-frame-options: SAMEORIGIN
x-vnode: 27

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 75159b071a9290a0-FRA
Cache-Control: private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Date: Tue, 27 Sep 2022 16:27:14 GMT
Location: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Referrer-Policy: origin-when-cross-origin
Server: cloudflare
Transfer-Encoding: chunked
X-AspNet-Version: 4.0.30319
X-Powered-By: Server #1
X-Robots-Tag: noindex, nofollow noindex, nofollow

GET
H2 200 fa-icons-lib.min.css
www.benefitspro.com/assets/build/css/ 4 KB
1 KB 57ms
55ms Stylesheet
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/build/css/fa-icons-lib.min.css

Requested by

Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62a1f9d4a70121359493d87cfb029bf3202ba37f0dfdf85bf98a4dc3a64c7335

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:14 GMT
content-encoding: br
cf-cache-status: HIT
age: 13387
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"4085-1663793866000"
vary: accept-encoding
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a39059034-FRA
x-vnode: 21
expires: Tue, 27 Sep 2022 20:27:14 GMT

GET
H2 200 markets-lite.min.css
www.benefitspro.com/assets/master-template/css/release/ 221 KB
32 KB 56ms
53ms Stylesheet
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/css/release/markets-lite.min.css?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a9aa397a58f4c3850dae4677e23131d94e41c8e2fda04f5b4cd87747b6ea2ed

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:14 GMT
content-encoding: br
cf-cache-status: HIT
age: 360
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"226096-1663793866000"
vary: accept-encoding
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a39089034-FRA
x-vnode: 21
expires: Tue, 27 Sep 2022 20:27:14 GMT

GET
H2 200 bootstrap-master-template.min.css
www.benefitspro.com/assets/master-template/css/release/ 105 KB
18 KB 57ms
55ms Stylesheet
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/css/release/bootstrap-master-template.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e4b10bddcd2040b7e0c34a9f5680a64e0ee44c8e00259dfaa60ba1739effb88

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:14 GMT
content-encoding: br
cf-cache-status: HIT
age: 13387
x-cache: HIT 3
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"107730-1663793866000"
vary: accept-encoding
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a390b9034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:14 GMT

GET
H2 200 article.min.css
www.benefitspro.com/assets/master-template/css/release/ 28 KB
6 KB 400ms
397ms Stylesheet
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/css/release/article.min.css?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a86d39730d3798075d6bedace543e73f10b66cd2461a649a6c7dcabbe945c99

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"28304-1663793866000"
vary: accept-encoding
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a390d9034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 falcon-ui.css
www.benefitspro.com/assets/css/ 771 B
403 B 402ms
400ms Stylesheet
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/css/falcon-ui.css?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d848076aad575c2b1b4840797552f3fe1535c58154453c09d3f7b742b522c14f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: MISS
ntcoent-length: 771
x-cache: HIT 25
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"771-1663793866000"
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a390f9034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 qkq4rhw.css
use.typekit.net/ 6 KB
1 KB 295ms
189ms Stylesheet
text/css 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/qkq4rhw.css?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

5a553da7ecb0174521c8c80f6b8d97a001481235b5a97cb0c270fc9ffe59a747

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
server: nginx
date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 906

GET
H2 200 pagination.css
www.benefitspro.com/assets/master-template/css/plc/ 3 KB
877 B 60ms
58ms Stylesheet
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/css/plc/pagination.css?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

659982ff5dc4222a830703646062215bbd21a2fb13e4cc2833461e7718ce2565

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:14 GMT
content-encoding: br
vary: accept-encoding
cf-cache-status: HIT
age: 361
cf-polished: origSize=4295
x-cache: HIT 1
backend: templates_newlaw_director
cf-bgj: minify
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
etag: W/"4295-1663793866000"
x-frame-options: SAMEORIGIN
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a392b9034-FRA
x-vnode: 21
expires: Tue, 27 Sep 2022 20:27:14 GMT

GET
H2 200 broker-innovation-lab.css
www.benefitspro.com/assets/master-template/css/plc/pages/ 2 KB
762 B 412ms
410ms Stylesheet
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/css/plc/pages/broker-innovation-lab.css?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6e4f2361d88da42b9bf37a0155cf6bae4389dbfb64b5887373381ee16f13836

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 25
backend: templates_newlaw_director
cteonnt-length: 1739
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"1739-1663793866000"
vary: Accept-Encoding
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a392c9034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1.6.26/ 13 KB
6 KB 112ms
30ms Script
text/javascript 2a00:1450:400d:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 04:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 216850
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 25 Sep 2023 04:13:05 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/ 87 KB
28 KB 182ms
70ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1307084
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27958
timing-allow-origin: *
last-modified: Mon, 04 May 2020 23:01:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb09ed3-15d84"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uV67%2FOqp2L68%2FHrDZA1TMFLs7btw2kTQ3bWjHcma3t%2BBqfZNb16X%2FrdFC2HHVrv%2F5Zz0gne8GG2m6atPma5tfGpObVUlV2jJszksQJ0R1ziFDKyY9zDJVuEuRVrAF53jCtERryLTuAnoIDOhA867XbDZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 75159b0b28bb5b9e-FRA
expires: Sun, 17 Sep 2023 16:27:15 GMT

GET
H2 200 jquery-migrate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.1/ 11 KB
4 KB 83ms
74ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.3.1/jquery-migrate.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89bf8cdea73ce776d6b81d03837bc7f04af5e3946b839a3c0bfbf3094ad3f7be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 18546041
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3592
timing-allow-origin: *
last-modified: Thu, 25 Jun 2020 01:22:57 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5ef3fc71-2b0b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8cXu4eU9R4ifArKPvpC1ybyIXtrGOkkecr8RGyNu0l1fxa%2FoS1F9wSUsvwFRw6aCQGJF6sfMr2UWDOgHHTPncN%2BEA%2FgFtCaCBSeSKJWL%2FFPQvkNe2Ld34X8DdZ%2Bk%2FkplkvDY0v9l38ttBifBvWew8vHp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 75159b0eef2a5b9e-FRA
expires: Sun, 17 Sep 2023 16:27:15 GMT

GET
H2

200

gpt.js Show response
securepubads.g.doubleclick.net/tag/js/
Redirect Chain

https://securepubads.g.doubleclick.net/tag/js/gpt.js?2022-09-27-12
https://securepubads.g.doubleclick.net/tag/js/gpt.js

80 KB
28 KB

28ms
28ms

Script
text/javascript

2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e6725acd3b6b64558610f04824916460d5e26b028d757bbb013be3bf9a013a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27787
x-xss-protection: 0
server: sffe
etag: "1346 / 407 of 1000 / last-modified: 1664277095"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 27 Sep 2022 16:27:15 GMT

Redirect headers

date: Tue, 27 Sep 2022 16:01:36 GMT
x-content-type-options: nosniff
server: sffe
age: 1539
content-type: text/html; charset=UTF-8
location: https://securepubads.g.doubleclick.net/tag/js/gpt.js
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
expires: Tue, 27 Sep 2022 16:31:36 GMT

GET
H2 200 bombora-rtvi.js Show response
www.benefitspro.com/assets/master-template/js/ 1001 B
701 B 418ms
409ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/bombora-rtvi.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

866e71a2b55fed66fc8ef10d5bab0716a5e31ea4d129f233321503dd04c31bdb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 25
backend: templates_newlaw_director
cteonnt-length: 1001
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"1001-1663793868000"
vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0e9a119034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 benefitspro.prebid.js Show response
www.benefitspro.com/assets/master-template/js/prebid/ 2 KB
783 B 460ms
450ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/prebid/benefitspro.prebid.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2d192c4ee2e44a7a8bf37c10896fac2c8ad41624f0c0f02afa356736b63af97f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
ntcoent-length: 1697
x-cache: HIT 21
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"1697-1663793868000"
vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eaa169034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 moatheader.js Show response
z.moatads.com/almheader466656885399/ 218 KB
77 KB 240ms
42ms Script
application/x-javascript 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/almheader466656885399/moatheader.js
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 6bb1b5fd0cb586f7c2922717b4247e513c65a7dc866aea813ef3a274e669503d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 17:49:35 GMT
server: AmazonS3
x-amz-request-id: F9QPKPVJYDX253KV
etag: "d9473d256424cababb27425e3244c18d"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=50053
accept-ranges: bytes
content-length: 78363
x-amz-id-2: ulfXQ+bLWBnM43tBhsvBResuoNCZ0buc3qWfgH5ZN0TyNnpXrmmsTqg8QFJKzvkJeRfAxpzDZg8=

GET
H2 200 lazyloadXT.min.js Show response
www.benefitspro.com/assets/master-template/js/release/ 3 KB
2 KB 53ms
44ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/release/lazyloadXT.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df690f011f9fd617ca22376522eef3c1a90c33cf3f8f10f5dfb4751ac26a202b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: HIT
age: 13382
x-cache: HIT 3
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"2937-1663793868000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eaa179034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 master-article-functions.js Show response
www.benefitspro.com/assets/master-template/js/ 14 KB
3 KB 426ms
417ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/master-article-functions.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a34377483ff3aa917edd6efc5adef60b169de3b576b2dce9627b22f0392059b7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"14150-1663793868000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eaa199034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 article-share-tools.js Show response
www.benefitspro.com/assets/master-template/js/ 11 KB
2 KB 421ms
412ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/article-share-tools.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e35cef0b65277dfb6604bec11e6e65e6bab5bb16b16f5a4612795da3e20ff718

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"11152-1663793868000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eaa1a9034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 jquery.stickit.min.js Show response
www.benefitspro.com/assets/master-template/js/release/ 10 KB
3 KB 57ms
49ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/release/jquery.stickit.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aff5614a231508d127ef71ee9cfeb2a3d24a42ae8aff6dd09305a822b480f1b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: HIT
age: 13382
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"9949-1663793868000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eaa1d9034-FRA
x-vnode: 145
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 hide-article-image.js Show response
www.benefitspro.com/assets/sites/sbm/js/ 731 B
461 B 414ms
413ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/sites/sbm/js/hide-article-image.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4fb2954bc2129533ffd10d39909549ad56a10907252158460e91642a8066221

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: MISS
ntcoent-length: 731
x-cache: HIT 24
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"731-1663793868000"
vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a392d9034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 gtm.js Show response
www.benefitspro.com/assets/master-template/js/ 341 B
311 B 408ms
407ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/gtm.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6ab91cf3c1ce9246885f3bfaac69706096cd170b60b6fd5bee1bd7b441806fb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: MISS
ntcoent-length: 341
x-cache: HIT 25
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"341-1663793868000"
vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a392e9034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 / Show response
users.api.jeeng.com/users/domains/0O25x655EL/sdk/ 374 KB
123 KB 210ms
157ms Script
text/javascript 2606:4700:10::6816:39ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://users.api.jeeng.com/users/domains/0O25x655EL/sdk/?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:39ae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

6c1d8bd967ed66a65e2faaccba7797dc2a104c8a55183ab0b6aa0a5d47b746cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
etag: W/"5d8a9-W1bGsvQBujGGBcWOqjD647yshe4"
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
strict-transport-security: max-age=15724800; includeSubDomains
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=3600
cf-ray: 75159b0a8aa6bb89-FRA

GET
H2 200 broker-innovation-lab.js Show response
www.benefitspro.com/assets/master-template/js/ 3 KB
951 B 56ms
56ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/broker-innovation-lab.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d07e8a81e67c0fa6399678409e4c4c5c2ca450f0ed95de9fde52226accf485e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:14 GMT
content-encoding: br
cf-cache-status: HIT
age: 361
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"3223-1663793868000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0a39309034-FRA
x-vnode: 21
expires: Tue, 27 Sep 2022 20:27:14 GMT

GET
H2 200 nav-icon-mini-burger-white.png
www.benefitspro.com/assets/master-template/images/market-images/ 58 B
339 B 56ms
48ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/market-images/nav-icon-mini-burger-white.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9dde752a0a83f77379ff94d7560a636796ff3bd448d4d0c54965795f356858d8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13382
cf-polished: origFmt=png, origSize=2855
x-cache: HIT 3
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
content-disposition: inline; filename="nav-icon-mini-burger-white.webp"
content-length: 58
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"2855-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eaa1e9034-FRA
x-vnode: 145
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 nav-icon-search-white.png
www.benefitspro.com/assets/master-template/images/market-images/ 362 B
557 B 70ms
62ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/market-images/nav-icon-search-white.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd05d9d820c56ab5c2e2da93da473cd02013b8fff06c92aec1ca00f35808b572

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13382
cf-polished: origFmt=png, origSize=3368
x-cache: HIT 2
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
content-disposition: inline; filename="nav-icon-search-white.webp"
content-length: 362
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"3368-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eaa1f9034-FRA
x-vnode: 21
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 social-fb-white.png
www.benefitspro.com/assets/master-template/images/market-images/ 166 B
312 B 58ms
51ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/market-images/social-fb-white.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3599c62e7f19c9428aa0622e6eae0cd2726d6569f4a1349045cba7da5a12768

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13382
cf-polished: origFmt=png, origSize=1222
x-cache: HIT 2
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
content-disposition: inline; filename="social-fb-white.webp"
content-length: 166
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"1222-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eaa229034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 social-tw-white.png
www.benefitspro.com/assets/master-template/images/market-images/ 354 B
523 B 77ms
70ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/market-images/social-tw-white.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd3d957f38ee564d0cf89af1cdf6ce46dbe0c228bfb65bd4720445db5fefcf9f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13381
cf-polished: origFmt=png, origSize=1583
x-cache: HIT 2
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
content-disposition: inline; filename="social-tw-white.webp"
content-length: 354
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"1583-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eaa239034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 social-li-white.png
www.benefitspro.com/assets/master-template/images/market-images/ 256 B
401 B 100ms
93ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/market-images/social-li-white.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9398dd93c612d77b9e0bcfe449becc1a5269af74409cbab1ae485c49d5bf3b9b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13382
cf-polished: origFmt=png, origSize=1413
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
content-disposition: inline; filename="social-li-white.webp"
content-length: 256
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"1413-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eba4e9034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 nav-icon-sign-in.png
www.benefitspro.com/assets/master-template/images/ 236 B
510 B 82ms
75ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/nav-icon-sign-in.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1be06778698a2eb16ae1c7152d7256350580f4a21fc43c5ef4218407135b0896

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13381
cf-polished: origFmt=png, origSize=1322
x-cache: MISS
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
content-disposition: inline; filename="nav-icon-sign-in.webp"
content-length: 236
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"1322-1663793868000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eba4f9034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 ALM_BenefitsPro_white.png
www.benefitspro.com/assets/master-template/images/market-images/ 2 KB
2 KB 67ms
60ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/market-images/ALM_BenefitsPro_white.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4377bb1002fddeb2c271f9fb55b9ec1eca9d385aa5906d30cbdb1bb858c950e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13386
cf-polished: origFmt=png, origSize=3344
x-cache: HIT 3
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
content-disposition: inline; filename="ALM_BenefitsPro_white.webp"
content-length: 1544
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"3344-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eba529034-FRA
x-vnode: 145
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 reprints-permission.png
www.benefitspro.com/assets/master-template/images/ 378 B
538 B 80ms
74ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/reprints-permission.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04bcbf22aed03a8ea72525562e6a2c181a6781c856bf5208f4399a98cf54f02f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13387
cf-polished: origFmt=png, origSize=2435
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
content-disposition: inline; filename="reprints-permission.webp"
content-length: 378
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"2435-1663793868000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eba549034-FRA
x-vnode: 145
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 tom-hawkins-july-26-next-job-3.jpg
images.benefitspro.com/contrib/content/uploads/sites/412/2018/07/ 49 KB
49 KB 629ms
610ms Image
image/jpeg 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.benefitspro.com/contrib/content/uploads/sites/412/2018/07/tom-hawkins-july-26-next-job-3.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3fff52cc9de72fca07dd6bd4704e1294eca19f13a7514e35814ebbb555c4047

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
vary: Accept-Encoding
cf-cache-status: MISS
x-cache: MISS
backend: contribsreimg_prod_director
content-length: 49954
last-modified: Wed, 05 Sep 2018 23:26:29 GMT
server: cloudflare
etag: "516061-c322-575281aa49b1e"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 75159b0eba689034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 styles.css
www.benefitspro.com/assets/multishared/css/ 15 KB
3 KB 407ms
407ms Stylesheet
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/multishared/css/styles.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8db8ec3d4d6ad571f545cf51a31f642b123471ba744388f3cbd2c60b0afa4ee7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: REVALIDATED
cf-polished: origSize=17400
x-cache: HIT 1
backend: templates_newlaw_director
cf-bgj: minify
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"17400-1663793868000"
vary: accept-encoding
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0d7ff19034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 common.min.js Show response
www.benefitspro.com/assets/master-template/js/release/ 53 KB
14 KB 432ms
425ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/release/common.min.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6bd36ce04facff41ab5b774dfea1f83253f21d8dbff16037c6f310f07607a787

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"54571-1663793868000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eba569034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H/1.1 200
OK overlayForm.js Show response
store.law.com/Registration/js/ 14 KB
4 KB 305ms
100ms Script
application/javascript 192.226.82.212
METTEL

General

Check archive.org

Show headers Download Go to

Full URL: https://store.law.com/Registration/js/overlayForm.js
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.226.82.212 Deer Park, United States, ASN16524 (METTEL, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / Server #2
Resource Hash: 30de911f70fbfdee70d5159b61cab8149251740e97dcbded177b534ceec6284a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 16:27:12 GMT
Content-Encoding: gzip
Referrer-Policy: origin-when-cross-origin
ClientProtocol: https
Last-Modified: Fri, 23 Sep 2022 20:58:01 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: Server #2
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public,max-age=900
Accept-Ranges: bytes
Content-Length: 3647
ETag: "8092a22a8fcfd81:0"

GET
H2 200 tealium.js Show response
www.benefitspro.com/assets/master-template/js/ 4 KB
1 KB 432ms
426ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/tealium.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c2a4e30e5f3f4d4b6816d0b64b4906d588f2139ad1182fc97bdf4e60afedc3d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"4601-1663793868000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eba599034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 jquery.touchSwipe.js Show response
www.benefitspro.com/assets/js/core/ 66 KB
16 KB 424ms
418ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/js/core/jquery.touchSwipe.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c874c9a3e2757790076e34bd49db931eb7484e6347877192f649429cf3f6e3e6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"67916-1663793866000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eba5b9034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 underscore-min.js Show response
cdnjs.cloudflare.com/ajax/libs/underscore.js/1.11.0/ 18 KB
7 KB 77ms
72ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/underscore.js/1.11.0/underscore-min.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d62f9c89984ad059d574ae6b64c9134628041695c09290643e2d53238638bdda

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 10876931
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6463
timing-allow-origin: *
last-modified: Fri, 28 Aug 2020 22:36:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f4986fd-48b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=irng9lcwJdHvxDxDlBUaAroCocu2dzm5V%2BuE8gWsUf6RCrSCXgZ1cfELVY%2FPtiJbyuwMgJQmCyykxsMaCDOHC0v2iQclVwe9YtVwi5kTAxh%2BiPSpqwumeTgMt0tOBpp5%2BrryTR6eXO7XFBVp3VE1RRNm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 75159b0eef325b9e-FRA
expires: Sun, 17 Sep 2023 16:27:15 GMT

GET
H2 200 jquery.history.js Show response
www.benefitspro.com/assets/js/core/ 21 KB
7 KB 424ms
420ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/js/core/jquery.history.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6b6d81cfbd49fe1bd0236efeaa240acafdc559910819197df94983926f84d22

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"21571-1663793866000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eba5d9034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 sponsorships.js Show response
www.benefitspro.com/assets/multishared/js/ 1 KB
587 B 434ms
430ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/multishared/js/sponsorships.js?2022-09-27-12

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04a185d67f6ead753be77d3ed23364e4bd28e21168628df5a8ea26f0a1f54de8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
cf-cache-status: MISS
ntcoent-length: 1454
x-cache: HIT 25
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"1454-1663793868000"
vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eba619034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 bootstrap-master.min.js Show response
www.benefitspro.com/assets/master-template/js/release/ 25 KB
7 KB 72ms
67ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/js/release/bootstrap-master.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c25aad21e410b837b04e08e1bb2f54ef9887585cd46a894c8fc00e8e2dcb45a1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: HIT
age: 13380
x-cache: HIT 2
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:48 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"25286-1663793868000"
vary: accept-encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eba649034-FRA
x-vnode: 27
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 moatheader.js
z.moatads.com/almheader466656885399/ 0
77 KB 265ms
67ms Other
application/x-javascript 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/almheader466656885399/moatheader.js
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 17:49:35 GMT
server: AmazonS3
x-amz-request-id: F9QPKPVJYDX253KV
etag: "d9473d256424cababb27425e3244c18d"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=50053
accept-ranges: bytes
content-length: 78363
x-amz-id-2: ulfXQ+bLWBnM43tBhsvBResuoNCZ0buc3qWfgH5ZN0TyNnpXrmmsTqg8QFJKzvkJeRfAxpzDZg8=

GET
H2 200 qkq4rhw.css
use.typekit.net/ 0
1 KB 54ms
46ms Other
text/css 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/qkq4rhw.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
server: nginx
date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 906

GET
H2 200 bootstrap-master-template.min.css
www.benefitspro.com/assets/master-template/css/release/ 0
18 KB 75ms
66ms Other
text/css 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/css/release/bootstrap-master-template.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
cf-cache-status: HIT
age: 13388
x-cache: HIT 3
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"107730-1663793866000"
vary: accept-encoding
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 75159b0eba669034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:15 GMT

GET
H2 200 p.css
p.typekit.net/ 5 B
195 B 229ms
52ms Stylesheet
text/css 2a02:26f0:3500:16::215:1495
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=qkq4rhw&ht=tk&f=139.169.175.5474.25136.14541.14546.14548&a=702529&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://use.typekit.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:15 GMT
last-modified: Sat, 16 Oct 2021 08:18:43 GMT
server: nginx
etag: "616a8ae3-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 css Show response
fonts.googleapis.com/ 3 KB
1 KB 75ms
28ms Fetch
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cd9216308f7433d319f912cfc029861f0176f0d0af13c57338d291f757fb01de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:23:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 27 Sep 2022 16:27:15 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Sep 2022 16:27:15 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 145 KB
53 KB 254ms
61ms Script
application/javascript 2a00:1450:400d:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WTGV4RW

Requested by

Host: www.benefitspro.com
URL: https://www.benefitspro.com/assets/master-template/js/gtm.js?2022-09-27-12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

44627ca08835c910fc06544ca0c8e6fa716a5ccca48399837a8cc2a484a28861

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53462
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:04:54 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 27 Sep 2022 16:27:15 GMT

POST
H2 200 user_visited_page Show response
telemetries.jeeng.com/api/events/ 15 B
124 B 161ms
161ms XHR
application/json 2606:4700:10::ac43:264e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://telemetries.jeeng.com/api/events/user_visited_page

Requested by

Host: users.api.jeeng.com
URL: https://users.api.jeeng.com/users/domains/0O25x655EL/sdk/?2022-09-27-12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:264e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.benefitspro.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-type: application/json

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
etag: W/"f-v/Y1JusChTxrQUzPtNAKycooOTA"
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
strict-transport-security: max-age=15724800; includeSubDomains
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cf-ray: 75159b0fe9396945-FRA
content-length: 15

OPTIONS
H2 204 user_visited_page
telemetries.jeeng.com/api/events/ Frame 0
0 219ms
162ms Preflight 2606:4700:10::ac43:264e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://telemetries.jeeng.com/api/events/user_visited_page

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:264e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.benefitspro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 75159b0edf116945-FRA
date: Tue, 27 Sep 2022 16:27:15 GMT
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains
vary: Access-Control-Request-Headers
x-powered-by: Express

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 121 KB
33 KB 259ms
66ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9b10871e0ed40a6467305847c09ef8549757ff13707f168d2ca3025659baa5ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Mon, 26 Sep 2022 21:11:33 GMT
server: AkamaiNetStorage
etag: "a19cf3cbee9112d1cb9cb8487ef16a55:1664226693.560943"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 33532
expires: Tue, 27 Sep 2022 16:32:15 GMT

GET
H2 200 l
use.typekit.net/af/827015/000000000000000000011c3b/27/ 18 KB
18 KB 108ms
27ms Font
application/font-woff2 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/827015/000000000000000000011c3b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 0b96e2d8daef004fa73380c29b23a4c7f9c790c75a1c9f538859de1fcfbae895

Request headers

Referer: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
server: nginx
etag: "fa20d38ca87af1153085d9146b698f2bb93b7223"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 18468

GET
H2 200 l
use.typekit.net/af/a3eee8/00000000000000003b9b093c/27/ 33 KB
33 KB 137ms
57ms Font
application/font-woff2 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/a3eee8/00000000000000003b9b093c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n8&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: cd983ac133b21cb30a726eb5b49fff32eaadd7f79165c677fc52e2efcac5ff41

Request headers

Referer: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
server: nginx
etag: "0373618e2db17cca6330e4b11556968310f08eb7"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 33856

GET
H2 200 l
use.typekit.net/af/4838bd/00000000000000003b9b0934/27/ 32 KB
32 KB 113ms
32ms Font
application/font-woff2 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/4838bd/00000000000000003b9b0934/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b99ce50d05750058143cb93936075ad5107f9a3e5b03f2d4872c0ebe753a9f7

Request headers

Referer: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
server: nginx
etag: "852dacc5cd2685c187708b882b28635465e17bd0"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 32688

GET
H2 200 l
use.typekit.net/af/71f83c/00000000000000003b9b093b/27/ 33 KB
33 KB 109ms
29ms Font
application/font-woff2 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/71f83c/00000000000000003b9b093b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: a2b997da567762896061490c3c08e506b2e5b936978560fc12251dd245140b32

Request headers

Referer: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
server: nginx
etag: "a0f35f91fdc2ca0a90c8288c08c20681c1aecfcf"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 33660

GET
H2 200 l
use.typekit.net/af/2553b3/000000000000000000011c34/27/ 19 KB
19 KB 144ms
80ms Font
application/font-woff2 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/2553b3/000000000000000000011c34/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: d0a76ec36613caaf91abaf681db7c469c02d7941647eb683409cdd21b7b1169e

Request headers

Referer: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
server: nginx
etag: "5cf72d8979177145b3e27e04c6afd6f60bee7a35"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 19288

GET
H2 200 l
use.typekit.net/af/437c3d/00000000000000003b9b0932/27/ 32 KB
32 KB 145ms
82ms Font
application/font-woff2 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/437c3d/00000000000000003b9b0932/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 582f1b5d33e54e95557255c97d79a90d3fda73d7b2b105695446fe643eb737cc

Request headers

Referer: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
server: nginx
etag: "474f8294a654ddd4e855cc66b1bb647cd40bfa9b"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 32384

GET
H2 200 l
use.typekit.net/af/1ade3e/000000000000000000011c39/27/ 19 KB
19 KB 136ms
85ms Font
application/font-woff2 2a02:26f0:11a::6867:4851
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/1ade3e/000000000000000000011c39/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4851 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: fda987a7db536b15976cb373bfcf7fb437f76ce9fd6cab676d58ede1e8c046cf

Request headers

Referer: https://use.typekit.net/qkq4rhw.css?2022-09-27-12
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
server: nginx
etag: "70dc2d1e85f8b46c0851a31b57494c0bdb743209"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 19412

GET
H2 200 fontawesome-webfont.woff2
www.benefitspro.com/assets/master-template/fonts/ 75 KB
76 KB 43ms
43ms Font
font/woff2 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitspro.com/assets/master-template/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: www.benefitspro.com
URL: https://www.benefitspro.com/assets/build/css/fa-icons-lib.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.benefitspro.com/assets/build/css/fa-icons-lib.min.css
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 168501
x-cache: MISS
backend: templates_newlaw_director
content-length: 77160
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
etag: W/"77160-1663793866000"
x-frame-options: SAMEORIGIN
content-type: font/woff2;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b0eca859034-FRA
x-vnode: 145
expires: Tue, 04 Oct 2022 16:27:15 GMT

GET
H3 200 pubads_impl_2022092001.js Show response
securepubads.g.doubleclick.net/gpt/ 378 KB
128 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js?2022-09-27-12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47395347833919b1b83bb90b7487da0d9213502fb8f18af28230b9c4a199affa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 07:08:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33508
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131075
x-xss-protection: 0
last-modified: Tue, 20 Sep 2022 08:35:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 27 Sep 2023 07:08:47 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 122 B
127 B 62ms
28ms XHR
application/json 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.benefitspro.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js?2022-09-27-12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63c54e1a7365643d41619441accc66105de41c9820a3a041cc115bf1b71a91d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102
x-xss-protection: 0
expires: Tue, 27 Sep 2022 16:27:15 GMT

GET
H2 200 smart_benefitspro.epl Show response
www.dianomi.com/ Frame 1E06 9 KB
3 KB 173ms
119ms Document
text/html 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/smart_benefitspro.epl?id=3426&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e45722ddb7174f1a972804b4d1c6478989b42fcd5007461cbea87b30bca3e9c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitspro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache,no-store,private
cf-cache-status: DYNAMIC
cf-h2-pushed: </img/a/pss/1972/61.css>
cf-ray: 75159b106a0392ba-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 27 Sep 2022 16:27:16 GMT
expires: now
link: </img/a/pss/1972/61.css>;rel=preload;as=style
pragma: no-cache
server: cloudflare
strict-transport-security: max-age=2592000
vary: X-FORWARDED-PROTO
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 smart_benefitspro.epl Show response
www.dianomi.com/ Frame E22D 11 KB
3 KB 148ms
96ms Document
text/html 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

835ac542d299d08372d37230b5d648d57463e77bc2fa3f9bee611abea9646ff7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitspro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: no-cache,no-store,private
cf-cache-status: DYNAMIC
cf-h2-pushed: </img/a/pss/2232/12.css>
cf-ray: 75159b106a0592ba-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 27 Sep 2022 16:27:15 GMT
expires: now
link: </img/a/pss/2232/12.css>;rel=preload;as=style
pragma: no-cache
server: cloudflare
strict-transport-security: max-age=2592000
vary: X-FORWARDED-PROTO
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK dpm_ff1eb8bd6cb17940ab78c0eeecf66268772f2061.min.js Show response
s.dpmsrv.com/ 0
520 B 110ms
17ms Script
application/x-javascript 13.32.99.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.dpmsrv.com/dpm_ff1eb8bd6cb17940ab78c0eeecf66268772f2061.min.js
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-47.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 10:43:35 GMT
Content-Encoding: gzip
Last-Modified: Fri, 23 Sep 2022 20:10:09 GMT
Server: AmazonS3
Age: 20621
ETag: "4a4dd3598707603b3f76a2378a4504aa"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 7fd88bab22735486702d23ba4e028d86.cloudfront.net (CloudFront)
Connection: keep-alive
X-Amz-Cf-Pop: FRA60-P3
Accept-Ranges: bytes
Content-Length: 20
X-Amz-Cf-Id: 1HkNRUiqEMPaX2yLHdyA9WOITpVBf0uuOubnuCA7lZJD4On4X9fiNQ==

GET
H2 200 ALM-21-422103%20Regulated%20Static%20Modules_BPRO_300x250.jpg
imageserver.amlaw.com/images/ 118 KB
118 KB 213ms
71ms Image
image/jpeg 2606:4700:4400::6812:22b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imageserver.amlaw.com/images/ALM-21-422103%20Regulated%20Static%20Modules_BPRO_300x250.jpg
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:22b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2544b35317df6156ed8dd3cec802785526182131888e0b2274667c4aef1dd4c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
cf-cache-status: HIT
last-modified: Mon, 09 May 2022 12:27:07 GMT
server: cloudflare
age: 5815
etag: "809fd518a063d81:0"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
cf-bgj: h2pri
accept-ranges: bytes
cf-ray: 75159b114d0391ea-FRA
content-length: 120819
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v34/ 16 KB
17 KB 114ms
30ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitspro.com/
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 18:53:44 GMT
x-content-type-options: nosniff
age: 77611
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:14:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Sep 2023 18:53:44 GMT

GET
H2 200 utag.119.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 10 KB
3 KB 21ms
20ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.119.js?utv=ut4.39.202208251756
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4d06bad352253c257e71e3f33c77726263394c5fd650cf671e9aab4055aa11e8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Thu, 25 Aug 2022 17:56:11 GMT
server: AkamaiNetStorage
etag: "6410fdc5a84c59f7da8817e594f92b8b:1661450171.429193"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3230
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=96C4370453295E4C0A490D44%40AdobeOrg&d_nsid=0&ts=1664296035898
https://dpm.demdex.net/id/rd?d_visid_ver=3.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=96C4370453295E4C0A490D44%40AdobeOrg&d_nsid=0&ts=1664296035898

362 B
1 KB

46ms
45ms

XHR
application/json

52.210.26.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=96C4370453295E4C0A490D44%40AdobeOrg&d_nsid=0&ts=1664296035898

Requested by

Protocol

HTTP/1.1

Server

52.210.26.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-210-26-59.eu-west-1.compute.amazonaws.com

Software

Resource Hash

81c4cbefa26738bb911ba5b534beff1abaadb10ba99df0ada0da3b12d1e37249

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v043-0bc21ffe9.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: M8Q3igMaQYw=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.benefitspro.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 304
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v043-0b1a3ee26.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.benefitspro.com
X-TID: e9vvjCD7S3E=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=96C4370453295E4C0A490D44%40AdobeOrg&d_nsid=0&ts=1664296035898
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 utag.26.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 3 KB
2 KB 26ms
24ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.26.js?utv=ut4.39.202103192340
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5a02d8eef54e76a16a95b2325079d0f55222cecc927a60bac1de8e2a8c0257af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Fri, 19 Mar 2021 23:40:46 GMT
server: AkamaiNetStorage
etag: "7c0950e22ed37b8b60ace798f4912a07:1616197246.557629"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1525
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H2 200 utag.78.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 111 KB
35 KB 35ms
34ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.78.js?utv=ut4.39.202209142209
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9fc52b69d2882e0acffb922952c4143ba451645879bdb7df3419a4df65946494

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Wed, 14 Sep 2022 22:09:53 GMT
server: AkamaiNetStorage
etag: "a14aca1760922a2618ef5cc4be73fbcb:1663193393.275283"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 35379
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H2 200 utag.32.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 3 KB
2 KB 29ms
27ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.32.js?utv=ut4.39.201909121652
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 999b37529edf4d7b34cf4bdcd937594e893a1d3add9811102f7818936b8d4293

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Mon, 22 Jun 2020 21:26:56 GMT
server: AkamaiNetStorage
etag: "fb390697366796015697c0162fac7588:1592861216.366485"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1448
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H2 200 utag.115.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 13 KB
4 KB 30ms
29ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.115.js?utv=ut4.39.202006181642
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0adce7288d8695bd58abcf6c721fc5b33f1f1ffba1cd69477e4a93bea0c767e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Mon, 22 Jun 2020 21:26:53 GMT
server: AkamaiNetStorage
etag: "965f1682763e76a92cd993fa62bb8feb:1592861213.319632"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3422
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H2 200 utag.116.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 13 KB
4 KB 34ms
33ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.116.js?utv=ut4.39.202006181642
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 10f63eeedd48638d7707b27efcf4982dbaa287241cc35b1a893fec1a9d8ffda0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Mon, 22 Jun 2020 21:26:50 GMT
server: AkamaiNetStorage
etag: "0c36e0bf1ac75d734731c85b9eb62809:1592861210.402313"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 3424
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H2 200 utag.101.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 13 KB
4 KB 41ms
40ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.101.js?utv=ut4.39.201911221657
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 300908cbcb84903590648db1851fcb3c493af3aaab47d4109e0a9f8394e06fd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Mon, 22 Jun 2020 21:26:53 GMT
server: AkamaiNetStorage
etag: "d92cbafa99067935fba25cba6e9bcb91:1592861213.763276"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 4339
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H2 200 utag.112.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 2 KB
1 KB 41ms
41ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.112.js?utv=ut4.39.202208041434
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 93a22a0e7b076844df8bbc2d01d9d50b6f46412cb41ccd7fbf053467778dedab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Tue, 19 May 2020 21:59:32 GMT
server: AkamaiNetStorage
etag: "237667acf6557ccb2652f9af3e9f82a8:1589925572.725309"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1014
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H2 200 utag.127.js Show response
tags.tiqcdn.com/utag/alm/main/prod/ 2 KB
1 KB 43ms
42ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.127.js?utv=ut4.39.202209142209
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: bb8efee9807c0bc0f5f1f9e550d07ef797eaf6dab36eeee50df57e3ece7802bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:15 GMT
content-encoding: gzip
last-modified: Wed, 14 Sep 2022 22:09:52 GMT
server: AkamaiNetStorage
etag: "1cebcabe3bf89e46a8b846418752ce92:1663193392.310285"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1041
expires: Wed, 12 Oct 2022 16:27:15 GMT

GET
H2 200 v2 Show response
mb.moatads.com/yi/ 214 B
388 B 218ms
64ms Script
text/html 18.135.121.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3MIJy%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vldfgUevl2QD4YpW6R34RpvnDsHp3lN2bOJbBer2APsOGgL%2F6PC5WmU2F3MRrrFWS1qZ&rs=1-21y3bVjbGrWLAw%3D%3D&sc=1&os=1-cA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&pcode=almheader466656885399&rx=110598660422&callback=MoatNadoAllJsonpRequest_70913711
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/almheader466656885399/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.135.121.86 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-135-121-86.eu-west-2.compute.amazonaws.com
Software: Microsoft-IIS/6.0 /
Resource Hash: 10805a6cf60990b0d11d410fc39683e48f6027b361d5171cf9595c7552b72ffe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
cache-control: max-age=900
server: Microsoft-IIS/6.0
timing-allow-origin: *
etag: "cbac1938c091bb908c9d7e3801305e7628921bca"
content-length: 214
content-type: text/html; charset=UTF-8

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 101 KB
27 KB 99ms
29ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WTGV4RW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26840
x-xss-protection: 0
pragma: public
x-fb-debug: IJjGEzcEpajp4zj9Zt1+RAuhl6QKDiJLfiDVOLD1J23JYmneL84Fsi3DWn2m0BGWc+q1OO1dVg3yd/FjtWKKPg==
x-fb-trip-id: 720026100
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 27 Sep 2022 16:27:16 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 222ms
31ms Script
application/javascript 199.232.16.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WTGV4RW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.16.157 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
last-modified: Tue, 30 Aug 2022 15:04:19 GMT
etag: "d4de8398858246712016031c834bb061+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 15317
x-served-by: cache-iad-kcgs7200171-IAD, cache-vie6374-VIE

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 85ms
16ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WTGV4RW
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=36965
accept-ranges: bytes
content-length: 3063

GET
H2 200 12.css
www.dianomi.com/img/a/pss/2232/ Frame E22D 2 KB
938 B 3ms
0ms Stylesheet
text/css 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/img/a/pss/2232/12.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b2c4cddc369e8c521eabe08f086ec6a2b8a7ad0360036348ff01c9b16775b8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 417783
cf-polished: origSize=2446
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Tue, 23 Aug 2022 09:04:38 GMT
server: cloudflare
strict-transport-security: max-age=2592000
content-type: text/css; charset=ISO-8859-1
access-control-allow-origin: *
expires: Fri, 28 Oct 2022 02:27:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
cf-ray: 75159b10eb4292ba-FRA
cf-bgj: minify

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 39ms
37ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.119.js?utv=ut4.39.202208251756

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75732e13ba7ccb55a10f0bda7c3cbf5725f5c913f8d0803523eb92a168e22b31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27794
x-xss-protection: 0
server: sffe
etag: "1346 / 211 of 1000 / last-modified: 1664277239"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 72ms
28ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.benefitspro.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 149ms
55ms Script
application/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.benefitspro.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 306 KB
39 KB 766ms
765ms XHR
text/plain 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4324995110256866&correlator=319155893844735&eid=31069838%2C31061165&output=ldjh&gdfp_req=1&vrg=2022092001&ptt=17&impl=fifs&iu_parts=21665826759%2Cbenefitspro%2Carticledisplay&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C300x250%7C300x600%2C300x250%7C300x600%2C729x90%2C1x1%2C1400x320%2C640x480%7C728x600%7C2x2%2C2x2%2C2x2%2C1090x95%2C150x31%2C300x400%2C150x31%2C150x31&ifi=1&adks=2275472651%2C1369844696%2C2179173841%2C2634616852%2C1800867209%2C2728112424%2C1233262042%2C1574706651%2C433812887%2C433812886%2C2725038876%2C2550983570%2C2556169707%2C3089739809%2C2705206928&sfv=1-0-38&ists=512&fsapi=false&prev_scp=position%3Dtop%7Cposition%3Dtop1%7Cposition%3Dmiddle%7Cposition%3Dmiddle1%7Cposition%3Dfooter%7Cposition%3Dinterstitial%7Cposition%3Dsuper_hero%7Cposition%3Dscroll%7Cposition%3Dnative_single1%7Cposition%3Dnative_single2%7Cposition%3Des_pushdown%7Cposition%3Des_logo_pushdown%7Cposition%3Des_rr_module%7Cposition%3Des_logo_rr%7Cposition%3Des_sponsorship_logo&cust_params=m_data%3Dwaiting%26m_safety%3Dwaiting%26m_categories%3Dwaiting%26m_mv%3Dwaiting%26m_gv%3Dwaiting%26source%3DBPRO%26id%3Dhef45jlgfk%26topic%3Dretirement%252Cnews%252Cdefinedcontribution%26page_number%3D1%26paywall%3Dtrue%26articletype%3Dblog&sc=1&cookie_enabled=1&abxe=1&dt=1664296036068&lmt=1664296036&dlt=1664296034895&idt=921&adxs=215%2C215%2C1069%2C1069%2C0%2C0%2C100%2C-9%2C290%2C290%2C255%2C260%2C1069%2C1069%2C215&adys=163%2C2119%2C905%2C935%2C0%2C0%2C0%2C-9%2C2395%2C2795%2C133%2C133%2C935%2C935%2C193&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C1%7C0%7C0%7C0%7C0%7C0%7C-1%7C2%7C3%7C0%7C0%7C0%7C0%7C0&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&frm=20&vis=1&psz=1170x60%7C1170x60%7C300x0%7C300x0%7C1600x6120%7C1600x6120%7C1600x0%7C0x-1%7C717x0%7C717x0%7C1600x6120%7C1600x6120%7C300x0%7C300x0%7C1170x251&msz=1170x0%7C1170x0%7C300x0%7C300x0%7C1600x0%7C1600x0%7C1600x0%7C0x-1%7C717x0%7C717x0%7C1600x0%7C1080x0%7C300x0%7C300x0%7C1170x0&fws=0%2C0%2C0%2C0%2C0%2C0%2C0%2C2%2C0%2C0%2C0%2C0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&ga_vid=456445793.1664296036&ga_sid=1664296036&ga_hid=793514776&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e85633178fa1dfc5ed1506b0a48709ab9a277b84d55de98ad7dc27d96a7ac38a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40330
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,6114379848,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,-1,138405151451,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.benefitspro.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
aa66ca644bf800eb55046400a2fef300.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5F0B 6 KB
4 KB 200ms
25ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://aa66ca644bf800eb55046400a2fef300.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitspro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 27 Sep 2022 16:27:16 GMT
expires: Wed, 27 Sep 2023 16:27:16 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 37 KB
15 KB 102ms
19ms Script
application/x-javascript 2600:9000:223c:aa00:18:1fcd:351:7bc1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.26.js?utv=ut4.39.202103192340
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:aa00:18:1fcd:351:7bc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 300706e57de1a7af148bd670379c4b39bb36dda8160e42d92747a3139af37816

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 14:38:22 GMT
content-encoding: gzip
last-modified: Wed, 20 Jul 2022 00:50:34 GMT
server: nginx
age: 6534
etag: W/"62d7515a-933f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
cache-control: max-age=7200
cross-origin-resource-policy: cross-origin
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: GckrMRYc0F_37VWyPxzDZ9AcIJytbolxVtdoCiCy7kgy6YYiGJGI5g==
expires: Tue, 27 Sep 2022 16:38:22 GMT

GET
H2

200

i.gif
datacloud.tealiumiq.com/vdata/
Redirect Chain

https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm&tealium_vid=01837fc6262f0017beb4e9e9d0a103074015806c00b08&tealium_account=alm&tealium_profile=main
https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm=&tealium_vid=01837fc6262f0017beb4e9e9d0a103074015806c00b08&tealium_account=alm&tealium_profile=main&goog...
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=01837fc6262f0017beb4e9e9d0a103074015806c00b08&tealium_account=alm&tealium_profile=main&google_gid=CAESEGX5Ico2odpc7n...

43 B
967 B

55ms
32ms

Image
image/gif

18.185.150.186
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=01837fc6262f0017beb4e9e9d0a103074015806c00b08&tealium_account=alm&tealium_profile=main&google_gid=CAESEGX5Ico2odpc7n7l0t6_zwc&google_cver=1
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Server: 18.185.150.186 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-150-186.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-serverid: uconnect_i-052b32fe1485a3cea
x-did: 01837fc6262f0017beb4e9e9d0a103074015806c00b08
x-tid: 01837fc6262f0017beb4e9e9d0a103074015806c00b08
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: alm:main:2:vdata
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
x-region: eu-central-1
content-type: image/gif
x-ulver: b0f40a8afca5e49acee901e7a2d5fa49565f3e17-SNAPSHOT
content-length: 43
x-uuid: 4ef9bb23-00cc-4dde-9ea0-86ad1a799720
expires: Tue, 27 Sep 2022 16:27:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=01837fc6262f0017beb4e9e9d0a103074015806c00b08&tealium_account=alm&tealium_profile=main&google_gid=CAESEGX5Ico2odpc7n7l0t6_zwc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 437
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 spm.v1.min.js Show response
ak.sail-horizon.com/spm/ 124 KB
44 KB 83ms
21ms Script
application/javascript 18.66.112.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.115.js?utv=ut4.39.202006181642
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-103.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a8236998816487aa6623e3626d7cd50f395e3deee0732c33b150bec3cb81f9a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:18:31 GMT
content-encoding: gzip
last-modified: Thu, 15 Sep 2022 23:20:31 GMT
server: AmazonS3
age: 526
etag: W/"97dd801dd26ae0172c7875245d92f506"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 ee6745944298a5956e13c939ebdcf8f2.cloudfront.net (CloudFront)
cache-control: max-age=600; must-revalidate
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: Mp93nuPxKN87bHxhf2bjzF91MO7iZgMepAKFK7WlAI4DnDCYt_Bj0w==

GET
H2 200 tag.aspx Show response
ml314.com/ 31 KB
32 KB 303ms
17ms Script
application/javascript 34.111.234.236
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?278
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 27d7b573de36acef9ddbf975de05251f5219d2e4b8424288aae62aa57d5a6396

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:05:52 GMT
age: 1284
x-guploader-uploadid: ADPycdv7MWtqGYu-3DAUQ715kViV4TDdDhqnh7WjhVTY51ahJGeedz4O6dIkiWA8AXY97RHgVqUN-hgSKAnKEt9pqNRQjw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32025
last-modified: Tue, 09 Aug 2022 21:49:07 GMT
server: UploadServer
cache-control: public,max-age=3600
etag: "fe36d3317b1b052708eb2260e253aa63"
x-goog-hash: crc32c=BjH7bw==, md5=/jbTMXsbBScI6yJg4lOqYw==
x-goog-generation: 1660081747697868
cache-id: FRA-fa985ced
x-cache-hit: hit
x-goog-stored-content-length: 32025
accept-ranges: bytes
content-type: application/javascript

POST
H2 200 i.gif Show response
collect.tealiumiq.com/alm/main/2/ 43 B
752 B 102ms
31ms XHR
image/gif 18.185.150.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collect.tealiumiq.com/alm/main/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.101.js?utv=ut4.39.201911221657
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.150.186 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-150-186.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://www.benefitspro.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryEy3zzbcMMqeG0NmG

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
vary: Origin
x-serverid: uconnect_i-006eb8e1a392a0398
x-tid: 01837fc6262f0017beb4e9e9d0a103074015806c00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: alm:main:2:datacloud
x-region: eu-central-1
content-length: 43
pragma: no-cache
x-did: 01837fc6262f0017beb4e9e9d0a103074015806c00b08
content-type: image/gif
access-control-allow-origin: https://www.benefitspro.com
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-ulver: b0f40a8afca5e49acee901e7a2d5fa49565f3e17-SNAPSHOT
x-uuid: 5ff55b14-91ab-4f6f-90f4-e84ad1e2c819
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 351ms
110ms Script
application/javascript 3.215.172.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-172-219.compute-1.amazonaws.com
Software: PardotServer /
Resource Hash: 3b91e6a4b14493d67f9660e6d4a2e27c1eea54d97ccb7c30acf3b89998b3be99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
X-Pardot-Route: 16b0ab393667a33fe86adedc3141e88c
last-modified: Tue, 27 Sep 2022 05:21:23 GMT
Server: PardotServer
etag: "1547-gzip"
vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
cache-control: max-age=63072000
Connection: keep-alive
accept-ranges: bytes
Content-Length: 1946
expires: Thu, 26 Sep 2024 16:27:16 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
216 B 51ms
51ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=alm/main/202209262111&cb=1664296036118
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:16 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Tue, 27 Sep 2022 16:37:16 GMT

GET
H2 200 viewability11.js Show response
www.dianomi.com/js/ Frame E22D 8 KB
3 KB 69ms
69ms Script
application/javascript 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/js/viewability11.js

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c868ea5adf14b93b7db936b4a5aa1400cdcf744baaf01faf1ecc402f2775dbfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 30
cf-polished: origSize=12434
last-modified: Tue, 20 Sep 2022 08:36:20 GMT
strict-transport-security: max-age=2592000
x-xss-protection: 1; mode=block
cf-bgj: minify
server: cloudflare
etag: W/"3092-5e917b8f8de5c"
vary: X-FORWARDED-PROTO, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=120
access-control-allow-credentials: true
cf-ray: 75159b11cd8992ba-FRA
expires: Tue, 27 Sep 2022 16:29:16 GMT

GET
H2 200 VfG99MCoyKoAAGpDgiIAAAAI.png
www.dianomi.com/img/uploads/ Frame E22D 1 KB
1 KB 55ms
52ms Image
image/webp 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/img/uploads/VfG99MCoyKoAAGpDgiIAAAAI.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

70503c92bcbb8105d95ec4de2012f23098c3383586e95323e4b3384b56af4beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 676459
cf-polished: origFmt=png, origSize=3940
content-disposition: inline; filename="VfG99MCoyKoAAGpDgiIAAAAI.webp"
strict-transport-security: max-age=2592000
content-length: 1164
x-xss-protection: 1; mode=block
last-modified: Thu, 06 Aug 2020 16:33:27 GMT
server: cloudflare
etag: "f64-5ac380c3ca3c0"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 28 Oct 2022 02:27:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b11fde792ba-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 263x200.jpg
www.dianomi.com/img/a/sav2/267151/4/ Frame E22D 18 KB
18 KB 82ms
79ms Image
image/jpeg 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/img/a/sav2/267151/4/263x200.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5c88c41788ede7b85e5e87e5b8e086d79fbe6ff67ea3c74ffba76835bba466a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: degrade=85, origSize=29612, status=webp_bigger
strict-transport-security: max-age=2592000
content-length: 18456
x-xss-protection: 1; mode=block
last-modified: Tue, 30 Aug 2022 08:49:06 GMT
server: cloudflare
etag: "73ac-5e77173f2f68d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
expires: Fri, 28 Oct 2022 02:27:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b11fdeb92ba-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 263x200.jpg
www.dianomi.com/img/a/sav2/243543/4/ Frame E22D 13 KB
13 KB 72ms
69ms Image
image/webp 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/img/a/sav2/243543/4/263x200.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc27706dd92ab740e0277d6af91b0add4e7fe8628607594085b41a763ff1e466

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 98069
cf-polished: qual=85, origFmt=jpeg, origSize=50435
content-disposition: inline; filename="263x200.webp"
strict-transport-security: max-age=2592000
content-length: 13096
x-xss-protection: 1; mode=block
last-modified: Sun, 24 Jul 2022 08:21:18 GMT
server: cloudflare
etag: "c503-5e488c0679861"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 28 Oct 2022 02:27:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b11fdf292ba-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 263x200.jpg
www.dianomi.com/img/a/sav2/131880/9/ Frame E22D 15 KB
15 KB 67ms
65ms Image
image/jpeg 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/img/a/sav2/131880/9/263x200.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ffb50d904db44b3985dc1b402000ee05d09a5df0b83e3cf9296ca30286807714

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 89951
cf-polished: degrade=85, origSize=24450, status=webp_bigger
strict-transport-security: max-age=2592000
content-length: 15120
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Aug 2022 17:17:44 GMT
server: cloudflare
etag: "5f82-5e65eed3a9fef"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
expires: Fri, 28 Oct 2022 02:27:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b11fdf592ba-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 263x200.jpg
www.dianomi.com/img/a/sav2/270381/2/ Frame E22D 9 KB
9 KB 57ms
54ms Image
image/webp 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/img/a/sav2/270381/2/263x200.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00670f0a62630d8ff7db4a0625c290372edaf14aeb32c0f91266ef8dfefb9c7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 19007
cf-polished: qual=85, origFmt=jpeg, origSize=40491
content-disposition: inline; filename="263x200.webp"
strict-transport-security: max-age=2592000
content-length: 9234
x-xss-protection: 1; mode=block
last-modified: Wed, 21 Sep 2022 13:49:45 GMT
server: cloudflare
etag: "9e2b-5e93037ae40b2"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 28 Oct 2022 02:27:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b11fdf992ba-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 263x200.jpg
www.dianomi.com/img/a/sav2/269147/7/ Frame E22D 11 KB
11 KB 61ms
59ms Image
image/jpeg 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/img/a/sav2/269147/7/263x200.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d95fd234da61a7dd771d7c8ae4eb877ee599ea56235575851aca171b9608cb7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 525708
cf-polished: degrade=85, origSize=17940, status=webp_bigger
vary: Accept-Encoding
x-xss-protection: 1; mode=block
last-modified: Wed, 21 Sep 2022 13:58:41 GMT
server: cloudflare
strict-transport-security: max-age=2592000
content-type: image/jpeg
access-control-allow-origin: *
expires: Tue, 04 Oct 2022 16:27:16 GMT
cache-control: public, max-age=604800
access-control-allow-credentials: true
cf-ray: 75159b11fe0192ba-FRA
cf-bgj: imgq:85,h2pri

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame E22D
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1133784/65726462/skeleton.gif
https://static.adsafeprotected.com/skeleton.gif

43 B
482 B

65ms
17ms

Image
image/gif

2600:9000:223f:fc00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif
Requested by: Host: www.dianomi.com
URL: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
Protocol: H2
Server: 2600:9000:223f:fc00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 25 Jun 2022 14:52:58 GMT
via: 1.1 7be6cb2d0156b563b6b1c8f2595ddd52.cloudfront.net (CloudFront)
age: 8127258
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: MfmOpaM5-rxACTrzR2vW2xuua9fzUuoj0PXeQ-AxUF7iZXoDPTtd5w==

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-server-name: app15.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif
cache-control: no-cache
content-length: 0
server: nginx

GET
H3

200

B28277029.346023471;dc_pre=CMv5p_CxtfoCFVyW_QcdUYEC1w;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent... Show response
ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/ Frame E22D
Redirect Chain

https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;g...
https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_pre=CMv5p_CxtfoCFVyW_QcdUYEC1w;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for...

15 KB
11 KB

101ms
67ms

Script
text/javascript

172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_pre=CMv5p_CxtfoCFVyW_QcdUYEC1w;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?

Requested by

Protocol

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f6.1e100.net

Software

cafe /

Resource Hash

7666b06b5069d4ff364b52c8b78fd0ac7b02f86c1503292d5af8ade288249d1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11293
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_pre=CMv5p_CxtfoCFVyW_QcdUYEC1w;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

B27452628.346325825;dc_pre=CID7p_CxtfoCFTPyuwgdtYsCjQ;dc_trk_aid=538276453;dc_trk_cid=178207315;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent... Show response
ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/ Frame E22D
Redirect Chain

https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325825;dc_trk_aid=538276453;dc_trk_cid=178207315;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;g...
https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325825;dc_pre=CID7p_CxtfoCFTPyuwgdtYsCjQ;dc_trk_aid=538276453;dc_trk_cid=178207315;ord=1664296035;dc_lat=;dc_rdid=;tag_for...

18 KB
13 KB

95ms
60ms

Script
text/javascript

172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325825;dc_pre=CID7p_CxtfoCFTPyuwgdtYsCjQ;dc_trk_aid=538276453;dc_trk_cid=178207315;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?

Requested by

Protocol

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f6.1e100.net

Software

cafe /

Resource Hash

e3ff4085e5a0b672837450c65e5b0c42fa7407d5095dc2c6f59a221c8942302f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12823
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325825;dc_pre=CID7p_CxtfoCFTPyuwgdtYsCjQ;dc_trk_aid=538276453;dc_trk_cid=178207315;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 61.css
www.dianomi.com/img/a/pss/1972/ Frame 1E06 2 KB
972 B 0ms
0ms Stylesheet
text/css 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/img/a/pss/1972/61.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b72ea1062b7bb84439787a3341bbd692b4074493f1e618d3780cad3271c22494

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3426&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 421798
cf-polished: origSize=2947
strict-transport-security: max-age=2592000
x-xss-protection: 1; mode=block
last-modified: Wed, 27 Jul 2022 15:58:23 GMT
server: cloudflare
etag: W/"b83-5e4cb7c9d8b58"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
expires: Fri, 28 Oct 2022 02:27:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
cf-ray: 75159b110b9392ba-FRA
cf-bgj: minify

GET
H2 200 viewability11.js Show response
www.dianomi.com/js/ Frame 1E06 8 KB
3 KB 56ms
54ms Script
application/javascript 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/js/viewability11.js

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/smart_benefitspro.epl?id=3426&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c868ea5adf14b93b7db936b4a5aa1400cdcf744baaf01faf1ecc402f2775dbfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3426&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 30
cf-polished: origSize=12434
last-modified: Tue, 20 Sep 2022 08:36:20 GMT
strict-transport-security: max-age=2592000
x-xss-protection: 1; mode=block
cf-bgj: minify
server: cloudflare
etag: W/"3092-5e917b8f8de5c"
vary: X-FORWARDED-PROTO, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=120
access-control-allow-credentials: true
cf-ray: 75159b11fdf092ba-FRA
expires: Tue, 27 Sep 2022 16:29:16 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 1E06
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1133784/65726462/skeleton.gif
https://static.adsafeprotected.com/skeleton.gif

43 B
481 B

66ms
18ms

Image
image/gif

2600:9000:223f:fc00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif
Requested by: Host: www.dianomi.com
URL: https://www.dianomi.com/smart_benefitspro.epl?id=3426&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
Protocol: H2
Server: 2600:9000:223f:fc00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 25 Jun 2022 14:52:58 GMT
via: 1.1 7be6cb2d0156b563b6b1c8f2595ddd52.cloudfront.net (CloudFront)
age: 8127258
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: J6-RfIkQhZthafnsDVSN41TS08sCHjtbIFtLf39yHZ8rzwTzzPamjQ==

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-server-name: app14.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif
cache-control: no-cache
content-length: 0
server: nginx

GET
H3

200

B28277029.346023471;dc_pre=CJndqPCxtfoCFbSW_QcdrZEP5g;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent... Show response
ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/ Frame 1E06
Redirect Chain

https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;g...
https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_pre=CJndqPCxtfoCFbSW_QcdrZEP5g;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for...

15 KB
11 KB

77ms
48ms

Script
text/javascript

172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_pre=CJndqPCxtfoCFbSW_QcdrZEP5g;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?

Requested by

Protocol

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f6.1e100.net

Software

cafe /

Resource Hash

bfa7bbadab025152b98292c2a09edf2525533d79c6371d44d69fde48ec7773de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11250
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_pre=CJndqPCxtfoCFbSW_QcdrZEP5g;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

B27452628.346325822;dc_pre=CNX_p_CxtfoCFTfKuwgdp90KSw;dc_trk_aid=538276447;dc_trk_cid=178299482;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent... Show response
ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/ Frame 1E06
Redirect Chain

https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325822;dc_trk_aid=538276447;dc_trk_cid=178299482;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;g...
https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325822;dc_pre=CNX_p_CxtfoCFTfKuwgdp90KSw;dc_trk_aid=538276447;dc_trk_cid=178299482;ord=1664296035;dc_lat=;dc_rdid=;tag_for...

18 KB
13 KB

98ms
66ms

Script
text/javascript

172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325822;dc_pre=CNX_p_CxtfoCFTfKuwgdp90KSw;dc_trk_aid=538276447;dc_trk_cid=178299482;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?

Requested by

Protocol

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f6.1e100.net

Software

cafe /

Resource Hash

5de5e170b84a68fa9f0245e82c53b8a8566a228585e3299eabac2379459060a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13013
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325822;dc_pre=CNX_p_CxtfoCFTfKuwgdp90KSw;dc_trk_aid=538276447;dc_trk_cid=178299482;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ 8 KB
712 B 64ms
28ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,700&subset=latin

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7a695d75ed5265fb2f07d7f73e41ffe4acea9b5c5f6573294038d5ef560a0086

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:25:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 27 Sep 2022 16:27:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H2 200 invisible.js Show response
www.benefitspro.com/cdn-cgi/challenge-platform/h/g/scripts/cb/ Frame AE16 41 KB
14 KB 26ms
25ms Script
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitspro.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=75159b08cdfa9034
Requested by: Host: mail.rch1.com
URL: https://mail.rch1.com/e3t/Ctc/48+113/c2-l504/VWLghQ2J07cMW4QH2Nv93Gw_jW8kTzPf4QsBhCN3mxJ7h3q3phV1-WJV7CgYzZW8Hpfc97wT-bCW5fWL9p10s0jZW6p_xmD4CFqHMW1syMPm28BJvjW3rFsSW8_0stVW2r0S_21PlM7TW32Pz4075BVpZW2_XGTf3tlBHBW5xKWR61Kdz8vW3H7RZ-91hR8wW46pRb-36z2jyW4fD_zy7nvHYRN1PhwMp1MVkRW6frtx67v_s9zW7xcn6z7c7vYMW5Dt69R1-VKQ3W202Lhp7m6N7wW6qj7Rf2PlBB-W9kZ7tC6vTnJhW1CDBDl635mWVW5tRnRn3bQy53W2RhZbf8BTnQhW2TF8hb4JZdCKW41W9pX2B4KV3W6Fvphp1BvbgMW84LBZC6J-NjBW4zS4xL3CTMSVW6nvQjN3hyyBZ34sT1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e30806436b2b0815faeb6b71f1739f57a53edc401d1170185801359530a5a65

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 75159b1209019034-FRA

GET
H2 200 get Show response
vi.ml314.com/ 264 B
388 B 88ms
36ms Script
application/javascript 35.201.104.135
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://vi.ml314.com/get?eid=80951&tk=GfRuA1kFT83xUQHkDF2f342bL3qo62byam2QEUWYmUPbh03d&fp=

Requested by

Host: www.benefitspro.com
URL: https://www.benefitspro.com/assets/master-template/js/bombora-rtvi.js?2022-09-27-12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.104.135 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

135.104.201.35.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

9dffbd45ce48bf5e8eeb90b3d8567f8270f217c174de81fe3693d6dcdbaa1588

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=2592000
via: 1.1 google
server: Google Frontend
date: Tue, 27 Sep 2022 16:27:16 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: private,max-age=86400
content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK / Show response
geoip.alm.com/json/ 184 B
453 B 423ms
110ms XHR
application/json 192.226.85.63
METTEL

General

Check archive.org

Show headers Download Go to

Full URL: https://geoip.alm.com/json/
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 192.226.85.63 Honesdale, United States, ASN16524 (METTEL, US),
Reverse DNS
Software: /
Resource Hash: 1fb24161c35dc226c53499352c66a31214c21320ac654dcebe15e0bfc6c8d370

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.benefitspro.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.benefitspro.com
Date: Tue, 27 Sep 2022 16:27:16 GMT
Access-Control-Allow-Credentials: true
X-Database-Date: Sat, 24 Sep 2022 08:05:02 GMT
Content-Length: 184
Vary: Origin
Content-Type: application/json

GET
H2 200 hb_302826_14703.js Show response
player.mediafuse.com/prebidlink/462304/ 312 KB
96 KB 182ms
18ms Script
application/javascript 45.133.44.4
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.mediafuse.com/prebidlink/462304/hb_302826_14703.js
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/assets/master-template/js/prebid/benefitspro.prebid.js?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.4 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1308a0343bcbd5d5884604cac2081ad65b01676b88b629cc32ddf187e795e4ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
last-modified: Tue, 13 Sep 2022 21:23:06 GMT
server: nginx
etag: W/"6320f4ba-4e130"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800
expires: Thu, 29 Sep 2022 16:27:16 GMT

GET
H2 200 wrapper_hb_302826_14703.js Show response
player.mediafuse.com/prebidlink/462304/ 2 KB
1 KB 223ms
59ms Script
application/javascript 45.133.44.4
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.mediafuse.com/prebidlink/462304/wrapper_hb_302826_14703.js
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/assets/master-template/js/prebid/benefitspro.prebid.js?2022-09-27-12
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.4 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: adedde7f7b41ccb00053be543804ebd24a479d4b57329ea8a3590c14d3f569eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
last-modified: Fri, 23 Sep 2022 18:05:38 GMT
server: nginx
etag: W/"632df572-6e8"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800
expires: Thu, 29 Sep 2022 16:27:16 GMT

GET
H3 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 62ms
29ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.84

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b9d52f002201be697fbc0ebf4bdcc61d6c01d0bb1359213e62c67e21850047

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 20715
x-xss-protection: 0
pragma: public
x-fb-debug: gwXapWOt4XPo5JsXkFqRKRWTOHqydw2RRU2EB3l8sFfWv2dV8RRK4CrB4F/DOV6gc+bgxbyLzKXcOfB54Bd78Q==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 27 Sep 2022 16:27:16 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 499911897232848 Show response
connect.facebook.net/signals/config/ 292 KB
84 KB 222ms
189ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/499911897232848?v=2.9.84&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

344242d12af607f2e9967ff04eb21789036bb15901876e16f4ca3ab437f2918f

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: 4FLAVsjnehYtBhW+3USHfGlyT40ImPKL4zKV1ePT3crdmcIMDG3+ggUPRyvPEUyRPM6RJ/1X3Sd0GV1XGXtnKQ==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 27 Sep 2022 16:27:16 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=232066&time=1664296036189&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_cam...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D232066%26time%3D1664296036189%26url%3Dhttps%253A%252F%252Fwww.benefitspro.com%252...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=232066&time=1664296036189&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_cam...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=232066&time=1664296036189&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_ca...

0
266 B

274ms
163ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=232066&time=1664296036189&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&liSync=true&e_ipv6=AQLTbPgHNycyHAAAAYN_xip9CDqKFeJjbKsVbg3XgaTqrUc8ZEov5MBklZmgQFP_NtEBDxI
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:17 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 4ADA3CFC8E0C463E8810BC28334AEE5D Ref B: FRAEDGE1314 Ref C: 2022-09-27T16:27:17Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXpqx4aXHI6bXRL3IYV0w==
x-li-fabric: prod-lva1

Redirect headers

date: Tue, 27 Sep 2022 16:27:17 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: C3EB111C9EB64615B9788C395CCC9518 Ref B: FRAEDGE1309 Ref C: 2022-09-27T16:27:16Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=232066&time=1664296036189&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&liSync=true&e_ipv6=AQLTbPgHNycyHAAAAYN_xip9CDqKFeJjbKsVbg3XgaTqrUc8ZEov5MBklZmgQFP_NtEBDxI
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXpqx4Vz7m3mAiojiQTnw==

GET
H/1.1 200
OK dest5.html Show response
alm.demdex.net/ Frame 2DC6 7 KB
3 KB 239ms
58ms Document
text/html 52.19.103.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://alm.demdex.net/dest5.html?d_nsid=0

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.19.103.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-19-103-22.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.benefitspro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-2-v043-0351fab3a.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: gSIhop4sSP0=
content-encoding: gzip
date: Tue, 27 Sep 2022 16:27:16 GMT
last-modified: Mon, 26 Sep 2022 14:06:08 GMT
vary: accept-encoding

GET
H2 200 id Show response
b.law.com/ 48 B
459 B 331ms
26ms XHR
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.law.com/id?d_visid_ver=3.3.0&d_fieldgroup=A&mcorgid=96C4370453295E4C0A490D44%40AdobeOrg&mid=31256028685216173580627335461199589454&ts=1664296036198

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

8ac56a77fa125a4c6576925c1263c6c17076eb7a07e3280dc3fe0781fe1a2289

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitspro.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
server: jag
vary: Origin
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.benefitspro.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YzMkZAAAAHpbswOJ
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=26753440018087468940501124730123369998
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzMkZAAAAHpbswOJ

42 B
942 B

43ms
43ms

Image
image/gif

52.210.26.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzMkZAAAAHpbswOJ

Requested by

Protocol

HTTP/1.1

Server

52.210.26.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-210-26-59.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v043-096918f46.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: O+fnvJ4xQnA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzMkZAAAAHpbswOJ
Date: Tue, 27 Sep 2022 16:27:16 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

OPTIONS
H2 200 pageview
api.sail-track.com/v1/track/event/ Frame 0
0 340ms
112ms Preflight
text/plain 99.83.218.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-track.com/v1/track/event/pageview
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.218.184 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a710cf531d4cd2506.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-lib-version
Access-Control-Request-Method: POST
Origin: https://www.benefitspro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://www.benefitspro.com
access-control-max-age: 1800
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Tue, 27 Sep 2022 16:27:16 GMT

POST
H2 202 pageview Show response
api.sail-track.com/v1/track/event/ 120 B
348 B 109ms
106ms Fetch
application/json 99.83.218.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-track.com/v1/track/event/pageview
Requested by: Host: ak.sail-horizon.com
URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.218.184 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a710cf531d4cd2506.awsglobalaccelerator.com
Software: /
Resource Hash: c11dd239decc5aabc20c4d2e655c6bd40d9cb1d8c64e15d3c69a525e2fc94a00

Request headers

Accept: application/json
Referer: https://www.benefitspro.com/
X-Lib-Version: v1.0.1
Authorization: Bearer bbe35466469593b785eef4ab32700018
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
allowedorigins: *
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
allowedheaders: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
content-length: 120
allowedmethods: GET,OPTIONS

GET
H2 200 initialize Show response
api.sail-personalize.com/v1/personalize/ 91 B
332 B 114ms
111ms Fetch
application/json 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/initialize?pageviews=1&isMobile=0&page=utm_campaign%3DCashout%20Leakage%20Email%20Blast&page=utm_medium%3Demail&page=_hsmi%3D227288517&page=_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&page=utm_content%3D227288517&page=utm_source%3Dhs_email&page=slreturn%3D20220827122713
Requested by: Host: ak.sail-horizon.com
URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash: e1da4cb13c17887992e744ef305c0a018b16d96a568701918fd589d279de04a3

Request headers

x-lib-version: v1.0.1
accept-language: de-DE,de;q=0.9
authorization: Bearer bbe35466469593b785eef4ab32700018
content-type: application/json
accept: application/json
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-referring-url: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
allowedorigins: *
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
allowedheaders: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
content-length: 91
allowedmethods: GET,OPTIONS

OPTIONS
H2 200 initialize
api.sail-personalize.com/v1/personalize/ Frame 0
0 340ms
111ms Preflight
text/plain 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/initialize?pageviews=1&isMobile=0&page=utm_campaign%3DCashout%20Leakage%20Email%20Blast&page=utm_medium%3Demail&page=_hsmi%3D227288517&page=_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&page=utm_content%3D227288517&page=utm_source%3Dhs_email&page=slreturn%3D20220827122713
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-lib-version,x-referring-url
Access-Control-Request-Method: GET
Origin: https://www.benefitspro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version,X-Referring-URL
access-control-allow-methods: OPTIONS,GET,POST,PUT,DELETE
access-control-allow-origin: https://www.benefitspro.com
access-control-max-age: 1800
allow: HEAD,GET,OPTIONS
content-length: 18
content-type: text/plain
date: Tue, 27 Sep 2022 16:27:16 GMT

OPTIONS
H2 200 pageview
api.sail-track.com/v1/track/event/ Frame 0
0 320ms
111ms Preflight
text/plain 99.83.218.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-track.com/v1/track/event/pageview
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.218.184 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a710cf531d4cd2506.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-lib-version
Access-Control-Request-Method: POST
Origin: https://www.benefitspro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://www.benefitspro.com
access-control-max-age: 1800
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Tue, 27 Sep 2022 16:27:16 GMT

POST
H2 202 pageview Show response
api.sail-track.com/v1/track/event/ 120 B
348 B 109ms
106ms Fetch
application/json 99.83.218.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-track.com/v1/track/event/pageview
Requested by: Host: ak.sail-horizon.com
URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.218.184 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a710cf531d4cd2506.awsglobalaccelerator.com
Software: /
Resource Hash: fba4888caca4f8a5ca041a427025b229b0da593c3d478a3b4a51effef5963aae

Request headers

Accept: application/json
Referer: https://www.benefitspro.com/
X-Lib-Version: v1.0.1
Authorization: Bearer 2ade0f4fc48d975844a60d5bcb4e9650
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
allowedorigins: *
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
allowedheaders: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
content-length: 120
allowedmethods: GET,OPTIONS

GET
H2 200 initialize Show response
api.sail-personalize.com/v1/personalize/ 91 B
332 B 114ms
111ms Fetch
application/json 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/initialize?pageviews=2&isMobile=0&page=utm_campaign%3DCashout%20Leakage%20Email%20Blast&page=utm_medium%3Demail&page=_hsmi%3D227288517&page=_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&page=utm_content%3D227288517&page=utm_source%3Dhs_email&page=slreturn%3D20220827122713
Requested by: Host: ak.sail-horizon.com
URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash: ab9b0ceb64dafe908478125fc1e61e975f0945e2b1ae99f0163baba84f789b3b

Request headers

x-lib-version: v1.0.1
accept-language: de-DE,de;q=0.9
authorization: Bearer 2ade0f4fc48d975844a60d5bcb4e9650
content-type: application/json
accept: application/json
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
x-referring-url: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
allowedorigins: *
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
allowedheaders: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
content-length: 91
allowedmethods: GET,OPTIONS

OPTIONS
H2 200 initialize
api.sail-personalize.com/v1/personalize/ Frame 0
0 320ms
112ms Preflight
text/plain 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/initialize?pageviews=2&isMobile=0&page=utm_campaign%3DCashout%20Leakage%20Email%20Blast&page=utm_medium%3Demail&page=_hsmi%3D227288517&page=_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&page=utm_content%3D227288517&page=utm_source%3Dhs_email&page=slreturn%3D20220827122713
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-lib-version,x-referring-url
Access-Control-Request-Method: GET
Origin: https://www.benefitspro.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version,X-Referring-URL
access-control-allow-methods: OPTIONS,GET,POST,PUT,DELETE
access-control-allow-origin: https://www.benefitspro.com
access-control-max-age: 1800
allow: HEAD,GET,OPTIONS
content-length: 18
content-type: text/plain
date: Tue, 27 Sep 2022 16:27:16 GMT

GET
H3 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 44 KB
44 KB 94ms
33ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,700&subset=latin

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 18:50:55 GMT
x-content-type-options: nosniff
age: 77781
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44856
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:20:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Sep 2023 18:50:55 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
201 B 341ms
110ms Image
image/gif 34.200.39.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=benefitspro.com&p=%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F&u=CxmG4wCoKYLcDXngDe&d=benefitspro.com&g=46802&g0=%7C%7C&g1=Tom%20Hawkins&n=1&f=00001&c=0&x=0&m=0&y=4409&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=2873&_c=Cashout%20Leakage%20Email%20Blast&_m=email&_x=hs_email&_y=227288517&t=CdPNFQDs2i8VBLzoTDNMet5DYmdU9&V=136&i=401(k)%20truth%20bomb%3A%20Missing%20participants%20are%20bad%2C%20but%20401(k)%20cashouts%20are%20worse%20%7C%20BenefitsPRO&tz=0&sn=1&sv=BRoLjNC2jurR3ztrqDo0KxC1JJ1_&sd=1&im=066b2e73&_
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.39.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-39-142.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 01837fc6262f0017beb4e9e9d0a103074015806c00b08 Show response
visitor-service-eu-central-1.tealiumiq.com/alm/main/ 27 B
244 B 67ms
17ms Script
application/javascript 18.195.240.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor-service-eu-central-1.tealiumiq.com/alm/main/01837fc6262f0017beb4e9e9d0a103074015806c00b08?callback=utag.ut%5B%22writevamain%22%5D&rnd=1664296036297

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.195.240.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-195-240-254.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e036d4c0bab9dcd3d8ed9d625c2cdd24f4d0474f1a4232f0e7c9471aaf0cf470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-version: b0f40a8afca5e49acee901e7a2d5fa49565f3e17-SNAPSHOT
date: Tue, 27 Sep 2022 16:27:16 GMT
x-region: eu-central-1
content-length: 27
strict-transport-security: max-age=31536000; includeSubdomains
x-nodeid: i-051bdf54b60671ee9
content-type: application/javascript; charset=utf-8

GET
H2 200 pica.js
www.benefitspro.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame AE16 21 KB
7 KB 23ms
22ms Other
application/javascript 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitspro.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b14b41bd4ca0bc20bec20a6a2b845e6c162fd541b4c576d329bdba5f747bca08

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 75159b12eaa89034-FRA

GET
H2 200 adsct
t.co/1/i/ 43 B
376 B 171ms
127ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=20dded91-bf91-4a64-8a55-e832ce6eef2f&integration=gtm-base&p_id=Twitter&p_user_id=0&pl_id=beb15a4f-a307-45d8-ab2e-0704214743ed&tw_document_href=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&tw_iframe_status=0&txn_id=l5y2p&type=javascript&version=2.3.27

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-response-time: 111
date: Tue, 27 Sep 2022 16:27:16 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
x-transaction-id: a3d934f424edb40e
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 23d7efae46c491fca290e626ae28171cb3b850b79fc86675768bc282ecba556e
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
725 B 271ms
124ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=20dded91-bf91-4a64-8a55-e832ce6eef2f&integration=gtm-base&p_id=Twitter&p_user_id=0&pl_id=beb15a4f-a307-45d8-ab2e-0704214743ed&tw_document_href=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&tw_iframe_status=0&txn_id=l5y2p&type=javascript&version=2.3.27

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-response-time: 106
date: Tue, 27 Sep 2022 16:27:16 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
x-transaction-id: 0600c329ae06279c
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: de76638623c04344e7b7e27030535242fdcf345c9b489cc4aec62e3abf336dfa
content-length: 43

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1E06 41 KB
15 KB 66ms
16ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/trackimpj/N10077.160898DIANOMI/B28277029.346023471;dc_trk_aid=537428811;dc_trk_cid=176282481;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 21:58:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66520
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Sep 2023 21:58:36 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/ptarmiganmediadcm677757797954/ Frame 1E06 305 KB
105 KB 31ms
30ms Script
application/x-javascript 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/ptarmiganmediadcm677757797954/moatad.js
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325822;dc_trk_aid=538276447;dc_trk_cid=178299482;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1d6e66eb994a8253ca0a8a6a200fd07b4786cdd906c40db17830103fcc095005

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 18:30:39 GMT
server: AmazonS3
x-amz-request-id: 1TFXCDFEPA9T97N4
etag: "da60a53cc263f66447ac0d8165ad33a2"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=36644
accept-ranges: bytes
content-length: 106654
x-amz-id-2: LEGVSWiMg11WmrI/5c1h8tHxGzQlp10NEt3hEmOAoitSu8lsTpsv5iG0m5lHOPcLNOVceZj79tA=

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E22D 41 KB
15 KB 40ms
19ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 26 Sep 2022 21:58:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66520
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Sep 2023 21:58:36 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/ptarmiganmediadcm677757797954/ Frame E22D 305 KB
105 KB 58ms
57ms Script
application/x-javascript 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/ptarmiganmediadcm677757797954/moatad.js
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/trackimpj/N6540.160898.DIANOMI/B27452628.346325825;dc_trk_aid=538276453;dc_trk_cid=178207315;ord=1664296035;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ltd=?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1d6e66eb994a8253ca0a8a6a200fd07b4786cdd906c40db17830103fcc095005

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 18:30:39 GMT
server: AmazonS3
x-amz-request-id: 1TFXCDFEPA9T97N4
etag: "da60a53cc263f66447ac0d8165ad33a2"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=36644
accept-ranges: bytes
content-length: 106654
x-amz-id-2: LEGVSWiMg11WmrI/5c1h8tHxGzQlp10NEt3hEmOAoitSu8lsTpsv5iG0m5lHOPcLNOVceZj79tA=

GET
H2 200 hbw_master_302826_14703.js Show response
player.hbmp.mediafuse.com/prebidlink/x462304/ 100 KB
35 KB 96ms
30ms Script
application/javascript 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.hbmp.mediafuse.com/prebidlink/x462304/hbw_master_302826_14703.js
Requested by: Host: player.mediafuse.com
URL: https://player.mediafuse.com/prebidlink/462304/wrapper_hb_302826_14703.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: 03e1225b90e549f09a646fb67b309a4d9e4681dc7ffaba5b5c48f41bff9f4e9b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: gzip
last-modified: Fri, 23 Sep 2022 18:05:38 GMT
server: nginx
etag: W/"632df572-19033"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800
expires: Thu, 29 Sep 2022 16:27:16 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B7D7 22 KB
8 KB 51ms
15ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.dianomi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32009
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 27 Sep 2022 07:33:47 GMT
expires: Wed, 27 Sep 2023 07:33:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C291 22 KB
8 KB 51ms
18ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.dianomi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32009
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 27 Sep 2022 07:33:47 GMT
expires: Wed, 27 Sep 2023 07:33:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 utsync.ashx Show response
ml314.com/ 62 B
81 B 336ms
88ms Script
application/javascript 34.111.234.236
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=80951&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&pv=1664296036473_lwmvykh5x&bl=en-us&cb=1019934&return=&ht=&d=&dc=&si=1664296036473_lwmvykh5x&cid=Retirement%7CNews%7CDefined%20Contribution&s=1600x1200&rp=&v=2.5.2.2
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?278
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62
expires: 0

GET
H2 200 /
www.facebook.com/tr/ 0
204 B 61ms
17ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=499911897232848&ev=PageView&dl=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&rl=&if=false&ts=1664296036487&sw=1600&sh=1200&v=2.9.84&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=30&fbp=fb.1.1664296036485.1881697625&it=1664296036187&coo=false&tm=1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Tue, 27 Sep 2022 16:27:16 GMT
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H2 200 pixel.gif
px.moatads.com/ Frame 1E06 43 B
267 B 48ms
35ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PTARMIGANMEDIA1&hp=1&ra=1&pxm=7&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.benefitspro.com&lp=https%3A%2F%2Fwww.benefitspro.com&t=1664296036493&de=934429551803&m=0&ar=220b545db30-clean&iw=afc65d6&q=2&cb=0&ym=0&cu=1664296036493&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=27452628%3A1405503%3A346325822%3A178299482&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F&id=0&ii=3&bd=benefitspro.com&bo=benefitspro.com&zMoatOrigSlicer1=1405503&zMoatOrigSlicer2=346325822&gw=ptarmiganmediadcm677757797954&fd=1&it=500&ti=0&ih=2&pe=0%3A-%3A-%3A0%3A539&fs=200409&na=381310165&cs=0
Requested by: Host: www.dianomi.com
URL: https://www.dianomi.com/smart_benefitspro.epl?id=3426&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:16 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3312 22 KB
8 KB 18ms
17ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.dianomi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32009
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 27 Sep 2022 07:33:47 GMT
expires: Wed, 27 Sep 2023 07:33:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A8A4 22 KB
8 KB 18ms
17ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.dianomi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 32009
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 27 Sep 2022 07:33:47 GMT
expires: Wed, 27 Sep 2023 07:33:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 75159b08cdfa9034 Show response
www.benefitspro.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame AE16 2 B
313 B 48ms
48ms XHR
text/plain 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitspro.com/cdn-cgi/challenge-platform/h/g/cv/result/75159b08cdfa9034
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/cdn-cgi/challenge-platform/h/g/scripts/cb/invisible.js?cb=75159b08cdfa9034
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
content-encoding: br
server: cloudflare
cf-ray: 75159b15ffe89034-FRA
content-type: text/plain; charset=UTF-8

GET
H2 200 s17998275824604
b.law.com/b/ss/almbpro,almglobal/1/JS-1.6/ 43 B
201 B 27ms
26ms Image
image/gif 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.law.com/b/ss/almbpro,almglobal/1/JS-1.6/s17998275824604?AQB=1&ndh=1&pf=1&t=27%2F8%2F2022%2016%3A27%3A16%202%200&mid=31256028685216173580627335461199589454&aamlh=6&vmt=4D013A4B&vmf=alm.102.122.2o7.net&ce=iso-8859-1&ns=alm&pageName=bpro%3Ajump%3Ahef45jlgfk&g=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGa&cc=USD&ch=bpro%3Ajump%3Ablog&server=bpro&v0=email%3Ahs_email%3ACashout%20Leakage%20Email%20Blast%3A227288517&events=event4%2Cevent1%2Cevent3&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=welcomewall&v1=D%3Dc1&l1=D%3Dc73&c11=hef45jlgfk&v11=D%3Dc11&c12=401%28k%29%20truth%20bomb%3A%20Missing%20participants%20are%20bad%2C%20but%20401%28k%29%20cashouts%20are%20worse&v12=D%3Dc12&c13=internal%20contributor&v13=D%3Dc13&c14=Tom%20Hawkins&v14=D%3Dc14&c15=BPRO&v15=D%3Dc15&c16=registered&v16=D%3Dc16&v24=bpro&c30=article&v30=D%3Dc30&c31=false&v31=false&c33=jump%3Aregistered&v33=D%3Dc33&c40=21&c41=12%3A00pm&v41=D%3Dc41&c42=tuesday&v42=D%3Dc42&c50=412-68327&v50=412-68327&c51=401%28k%29%20truth%20bomb%3A%20Missing%20participants%20are%20bad%2C%20but%20401%28k%29%20cashouts%20are%20worse&v51=D%3Dc51&c60=false&v60=false&c61=2018-07-26&v61=D%3Dc61&c62=32&v62=32&c67=DENYREFERERNOTALLOWED&v67=D%3Dc67&c70=D%3Dv0&v70=D%3Dv0&c73=Retirement%7CNews%7CDefined%20Contribution&v73=D%3Dc73&c75=news&v75=news&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&-g=hVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&AQE=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Sep 2022 16:27:16 GMT
server: jag
etag: 3574048523385733120-4619761697357822109
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 26 Sep 2022 16:27:16 GMT

GET
H/1.1 200
OK analytics Show response
pi.pardot.com/ 1 KB
2 KB 301ms
300ms Script
text/javascript 3.215.172.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1300&account_id=998701&title=401(k)%20truth%20bomb%3A%20Missing%20participants%20are%20bad%2C%20but%20401(k)%20cashouts%20are%20worse%20%7C%20BenefitsPRO&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&referrer=&utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&utm_source=hs_email&utm_content=227288517

Requested by

Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-215-172-219.compute-1.amazonaws.com

Software

PardotServer /

Resource Hash

cdd8e0a30a99d13b654e9e5bd236cf4c8423d13f3a5917da3e46cdacb199af76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 27 Sep 2022 16:27:17 GMT
content-encoding: gzip
X-Pardot-Route: 9b06e8e2308c32c7bf9ba8adfb7be2e1
x-pardot-rsp: 0/0/1
vary: Accept-Encoding,User-Agent
Connection: keep-alive
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains
Content-Type: text/javascript; charset=utf-8
Content-Length: 531
Server: PardotServer
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame E22D 43 B
267 B 27ms
26ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=PTARMIGANMEDIA1&hp=1&ra=1&pxm=7&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Fwww.benefitspro.com&lp=https%3A%2F%2Fwww.benefitspro.com&t=1664296036817&de=239682608401&m=0&ar=220b545db30-clean&iw=afc65d6&q=2&cb=0&ym=0&cu=1664296036817&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=27452628%3A1405503%3A346325825%3A178207315&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F&id=0&ii=3&bd=benefitspro.com&bo=benefitspro.com&zMoatOrigSlicer1=1405503&zMoatOrigSlicer2=346325825&gw=ptarmiganmediadcm677757797954&fd=1&it=500&ti=0&ih=2&pe=0%3A-%3A-%3A0%3A538&fs=200409&na=699534648&cs=0
Requested by: Host: www.dianomi.com
URL: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:16 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H2 200 menu-close-btn.png
www.benefitspro.com/assets/master-template/images/ 268 B
547 B 52ms
51ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/menu-close-btn.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc76428cad5c36631113a653d30ef85dbcfe672934b13630f4fdd2c1f1403f58

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 13379
cf-polished: origFmt=png, origSize=3321
x-cache: HIT 1
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
content-disposition: inline; filename="menu-close-btn.webp"
content-length: 268
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"3321-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b1689029034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:16 GMT

GET
H2 200 config.json Show response
player.adtelligent.com/exchange_rates/279934/ 8 KB
4 KB 128ms
16ms XHR
application/json 45.133.44.4
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtelligent.com/exchange_rates/279934/config.json?cb=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
Requested by: Host: player.mediafuse.com
URL: https://player.mediafuse.com/prebidlink/462304/hb_302826_14703.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.4 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: e63a692c6e4153e3611cca55f723b3396b0170c0a114e1a01beefe24a846e96e

Request headers

Referer: https://www.benefitspro.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 27 Sep 2022 16:27:17 GMT
content-encoding: gzip
last-modified: Tue, 27 Sep 2022 12:01:06 GMT
server: nginx
etag: W/"6332e602-21fe"
content-type: application/json
access-control-allow-origin: https://www.benefitspro.com
expires: Thu, 29 Sep 2022 16:27:17 GMT
cache-control: max-age=172800
x-proxy-cache: HIT

GET
H2 200 Ufe3LcCoyKoAADivRIsAAAAC.png
www.dianomi.com/img/uploads/ Frame 1E06 1 KB
1 KB 59ms
58ms Image
image/webp 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/img/uploads/Ufe3LcCoyKoAADivRIsAAAAC.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b77f08b1a04c909c48a7f0f3b3e300f0e6f6abe667a19c513fedf67c19fa2a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/smart_benefitspro.epl?id=3426&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 418756
cf-polished: origFmt=png, origSize=2126
content-disposition: inline; filename="Ufe3LcCoyKoAADivRIsAAAAC.webp"
strict-transport-security: max-age=2592000
content-length: 1026
x-xss-protection: 1; mode=block
last-modified: Thu, 13 Aug 2020 14:28:40 GMT
server: cloudflare
etag: "84e-5acc31eddb600"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
expires: Fri, 28 Oct 2022 02:27:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b16e9c092ba-FRA
cf-bgj: imgq:85,h2pri

GET
H/1.1 200
OK / Show response
ghb.hbmp.mediafuse.com/geo/ 153 B
428 B 440ms
26ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.hbmp.mediafuse.com/geo/
Requested by: Host: player.hbmp.mediafuse.com
URL: https://player.hbmp.mediafuse.com/prebidlink/x462304/hbw_master_302826_14703.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 6c00f268685b8a576d1307fab673f36330a258b36d1d4afb50232c01ca2a388f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 16:27:16 GMT
Server: Adtelligent
Content-Type: application/json
Access-Control-Allow-Origin: https://www.benefitspro.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 153

GET
H/1.1 200
OK tracking Show response
ghb.hbmp.mediafuse.com/adunit/ 43 B
439 B 440ms
27ms XHR
image/gif 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.hbmp.mediafuse.com/adunit/tracking?event=11&type=0&client_id=302826&site_id=14703&pbjsv=v6.25.1-c&full_page_url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&adid=kew0tr.c9&features=81952&utm_source=hs_email&utm_medium=email&vpbv=N087&tte=763&lifecycle_tte=3519
Requested by: Host: player.hbmp.mediafuse.com
URL: https://player.hbmp.mediafuse.com/prebidlink/x462304/hbw_master_302826_14703.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 16:27:16 GMT
Server: Adtelligent
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.benefitspro.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 43

GET
H2 200 j.html Show response
p.safeservingcdn.com/prebidlink/19262/ Frame DADD 1 KB
888 B 122ms
16ms Document
text/html 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://p.safeservingcdn.com/prebidlink/19262/j.html?i=11598
Requested by: Host: player.mediafuse.com
URL: https://player.mediafuse.com/prebidlink/462304/hb_302826_14703.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: d35b5fd65497ae8d66b6e52bbad869c48bf379174ab0175f10e5d760741cbdcd

Request headers

Referer: https://www.benefitspro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=172800
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 27 Sep 2022 16:27:17 GMT
etag: W/"620bee41-43d"
expires: Thu, 29 Sep 2022 16:27:17 GMT
last-modified: Tue, 15 Feb 2022 18:17:37 GMT
server: nginx

GET
H2 200 pixel.gif
px.moatads.com/ Frame E22D 43 B
267 B 27ms
27ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&ra=1&pxm=7&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fwww.dianomi.com%2Fimg%2Fa%2Fsav2%2F267151%2F4%2F263x200.jpg&i=PTARMIGANMEDIA1&ol=1078484734&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3MIJy%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-IhpMhkIJ33QxUrdGk7NYu%2BFfHV3eib89DkRB2436S0SxzRtAIyeo1MnKlpdMQlJdIBr9&rs=1-Z9pXKgt%2BRfoJWg%3D%3D&sc=1&os=1-3w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1180&qe=300&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&h=177&w=220&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F&id=0&ii=3&f=1&j=https%3A%2F%2Fwww.benefitspro.com&lp=https%3A%2F%2Fwww.benefitspro.com&t=1664296036817&de=239682608401&cu=1664296036817&m=40&ar=220b545db30-clean&iw=afc65d6&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=300&le=1&gm=1&io=1&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A-%3A-%3A0%3A538&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=26&cd=0&ah=26&am=0&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A3000sec%3Acumulative&cl=0&at=0&d=27452628%3A1405503%3A346325825%3A178207315&bd=benefitspro.com&bo=benefitspro.com&gw=ptarmiganmediadcm677757797954&zMoatOrigSlicer1=1405503&zMoatOrigSlicer2=346325825&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=2&tc=0&fs=200409&na=1511466801&cs=0
Requested by: Host: www.dianomi.com
URL: https://www.dianomi.com/smart_benefitspro.epl?id=3424&url=https%3A//www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:16 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012209072154000/ Frame B7B1 220 KB
61 KB 74ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab720224c1548ed676ca1a6e9f2ecbb3d92fe43ab4e573de9246e48f440a4636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61518
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b9e6b1d3ca7cc68d"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame B7B1 14 KB
5 KB 126ms
70ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efff01c62418d6f4467c02e31f8c01ec7c4459e9310654f6dcbc30120a385209

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5208
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "dcaf3864e0ab6b08"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame B7B1 94 KB
28 KB 127ms
72ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

527d0808216e24ce838e14ffd686947cd4a8719fd9562a21412ed08c8ac14614

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 85727
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28888
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 16:38:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "95b4b320f7966d1a"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 16:38:30 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame B7B1 5 KB
2 KB 133ms
78ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

607150d742ffb67d983e9bd23ab87e0d436f68776c67898c57db306319840cb5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1908
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5561dff7c028bd87"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame B7B1 40 KB
13 KB 132ms
77ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd22c52347ad42343ca4c6fa76a783715312f1f4a35e97f937611a5b26aa2354

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12958
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "00747b471d2f1a24"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame B7B1 8 KB
894 B 27ms
27ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

74017d97a0876e72ef09a14ea0b3ad49a744811c726e7b05e305d4a6e3e07612

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 14:53:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 27 Sep 2022 16:27:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame B7B1 2 KB
2 KB 16ms
15ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23758
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame B7B1 295 B
319 B 16ms
15ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23758
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B7B1 0
0 66ms
24ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTqx32MGXBezbUdHX1Tk9Xqma2hPk-XiLqVZC8HVaFK72Le7UM9j3IIjyx11JhogiJ3r3dM
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H3

200

B25164142.293005026;dc_pre=CP7U1vCxtfoCFd3Puwgdv68Jnw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=572512606;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=
ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/ Frame B7B1
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=572512606;dc_lat=;dc_rdid=;tag_for_child_directed_treatment...
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CP7U1vCxtfoCFd3Puwgdv68Jnw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=572512606;dc_lat=;dc_rdid...

43 B
64 B

41ms
39ms

Image
image/gif

172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CP7U1vCxtfoCFd3Puwgdv68Jnw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=572512606;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?

Requested by

Protocol

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f6.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CP7U1vCxtfoCFd3Puwgdv68Jnw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=572512606;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame B7B1 0
0 60ms
59ms Image
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CkZXBZCQzY43aC8qs9u8P9bqdsAGauLWYbPHJppbYDNrZHhABIJv07WtgleKQgqAHoAGU1u7VA8gBAeACAKgDAaoExwNP0Od0ffFP7CZlD94Sm187pr6xfPpDXwMX6-NOAG1UGCG5_X_dfhtONhtuG7DBwcuufGb5rTv3X_vXxeW1owyRGWAdXwMCzsysw1Svj-DhlmwHsi4rlAV3J6LBBTcs4KFOcsFFgdq4XtsxmtR52uedO4keStyKtpeRp3NgsGgOT4eHlZQDfqYz_-x9WKW_T5iZcNg0KAY-yVLMf8pwNd5Zwhj225jy_xstbbfQWntCUPYd6cyl2IBmjS7hJ1o-18X8MotuMMpiSIoaszsQ0ZJBvEIpUdRss1VGRAhogkmYE4ICoSJn63Y1C4AosCYsrGsFyYJoC3O1EcSBbYCWX7TYDwFgzr1E6XWSW7JjU5LzNHZb-Xr4-w9q0u33brrEh7Hsbh2oInh44mMZS8IAz5ER6PK6wj1YuNoPA-oKV9tzC2HYahicCPt-WReArgn589FZCwtl82BVQvhs9PFGOzYW88KTd-5ydXYiqC5t2H4h3a6lj_1GBSegce7OjJCTzQhi1pEe2yMzbVUNfA02tyrmDAGTkhnGCUtu3ubAdxsI_tijj4H6Ig2zuWw-9YH9C-APfaNOclWk_8GHypSQ7W-JZyejR_edosAExKPgu7oD4AQBkgUECAQYAZIFBAgFGASAB9SpkSqoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBDE7j3SCBIIiOGAcBABGB0yA-uCAToCgECACgPICwHYEwyIFALQFQGYFgGAFwGyFx4KHAgAEhRwdWItMTI2MTk5MjQ0NDgwMzg3NRiPymo&sigh=rggMwUDIQoU&uach_m=[UACH]&template_id=5020
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame B7B1 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a663467e111fd2237a1bc5255e8d702b099f29cb553ecab24efe98cbf898b5d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame B7B1 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c3da4325cff4886cf47c4508feb32e8741976f7e17ef057114d155d6eb2cb9d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
267 B 26ms
26ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ALM_HEADER1&hp=1&zMoatAdUnit1=benefitspro&zMoatAdUnit2=articledisplay&wf=1&ra=3&pxm=1&sgs=3&vb=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1664296035905&de=810182671123&rx=110598660422&m=0&ar=220b545db30-clean&iw=54a36c0&q=1&cb=0&cu=1664296035905&ll=2&lm=0&ln=0&em=0&en=0&d=4525440395%3A2480285401%3A5003105952%3A138270398105&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&id=1&ii=4&bo=benefitspro&bd=articledisplay&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=almheader466656885399&fd=1&it=500&pe=1%3A2204%3A2204%3A0%3A2458&fs=200409&na=665271249&cs=0
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:16 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012209072154000/ Frame ED4E 220 KB
60 KB 61ms
35ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab720224c1548ed676ca1a6e9f2ecbb3d92fe43ab4e573de9246e48f440a4636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61518
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b9e6b1d3ca7cc68d"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame ED4E 14 KB
5 KB 78ms
77ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efff01c62418d6f4467c02e31f8c01ec7c4459e9310654f6dcbc30120a385209

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5208
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "dcaf3864e0ab6b08"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame ED4E 94 KB
28 KB 82ms
81ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

527d0808216e24ce838e14ffd686947cd4a8719fd9562a21412ed08c8ac14614

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 85727
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28888
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 16:38:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "95b4b320f7966d1a"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 16:38:30 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame ED4E 5 KB
2 KB 85ms
85ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

607150d742ffb67d983e9bd23ab87e0d436f68776c67898c57db306319840cb5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1908
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5561dff7c028bd87"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame ED4E 40 KB
13 KB 86ms
86ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd22c52347ad42343ca4c6fa76a783715312f1f4a35e97f937611a5b26aa2354

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12958
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "00747b471d2f1a24"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame ED4E 8 KB
895 B 29ms
28ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 14:54:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 27 Sep 2022 16:27:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Sep 2022 16:27:16 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame ED4E 2 KB
2 KB 16ms
15ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23758
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame ED4E 295 B
319 B 16ms
16ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23758
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame ED4E 0
0 38ms
25ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTtLXh9ksZyzy8_mZ70T0kwNpqK6R6XsUqRJQxnLKpgcQ8YVQb38wfFNQQLLlT3Kh0Am_4w
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H3

200

B25164142.293005026;dc_pre=CNi-2PCxtfoCFY7ddwod1ZQJOg;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=802021301;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=
ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/ Frame ED4E
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=802021301;dc_lat=;dc_rdid=;tag_for_child_directed_treatment...
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CNi-2PCxtfoCFY7ddwod1ZQJOg;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=802021301;dc_lat=;dc_rdid...

43 B
64 B

38ms
38ms

Image
image/gif

172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CNi-2PCxtfoCFY7ddwod1ZQJOg;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=802021301;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?

Requested by

Protocol

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f6.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CNi-2PCxtfoCFY7ddwod1ZQJOg;dc_trk_aid=486104933;dc_trk_cid=142460235;ord=802021301;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame ED4E 0
0 63ms
63ms Image
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CEyfHZCQzY4vaC8qs9u8P9bqdsAGauLWYbMmPp5bYDNrZHhABIJv07WtgleKQgqAHoAGU1u7VA8gBCeACAKgDAcgDCqoExANP0LXeXe7OjYn2KA2FwF4ju0jzTBU-XXliFGL9Md-QSHcO8Ybr19853eIMJyq_ypDqFNM_J18KeVBK445Tj1hJ6o-h8FH5E2s4XH3jwVI1gPA5-TE6ut56dVqY8oYrQiAAUHRgVLlWOeUILije3DgCS_yEPgqknGIR_OGexnJe-jm9-j6LANIjKAkhQYJX1N37PYS8Cetf7vEUZDKJn35_YoKdIOoc4cgcNzEzl-f3tY1BatFYr1lJFqhcZkXL-yp65TQqPQnOwXiXOVE9wFhu_vNz62tM5nw35wt8vS4jWLQR-HlIiPEWOoi4ZrhNWmj_T7mnaQ1b10yDd6LIXD9S59glIfpUFVpiU5TqBYbYcADrp6cko6dJZ8j42drR74r9aictaOqpYetZErKf4CPIBSyevbx9UMyWO9jYK7vivG9nqlSUD5rl4ejbWvGJYL_OIHl07tew3-hX0rI1i3f65tVns1hVs9AeSrBs98xUV9kGVzHBbe0Qx1I0qFuQd91Taee8McNY2VbxfM92e2EqEGzx5TlCJzsdwvKK5IWnLPNywZjvVNeJPoKOwWaWgz288FWG14DZjw2YPAr2xqRExndJdMAExKPgu7oD4AQBkgUECAQYAZIFBAgFGASgBi6AB9SpkSqoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBCH2GnSCBIIiOGAcBABGB0yA-uCAToCgECACgPICwHYEwyIFALQFQGYFgGAFwGyFx4KHAgAEhRwdWItMTI2MTk5MjQ0NDgwMzg3NRiPymo&sigh=Eq1Wjvr7C6c&uach_m=[UACH]&template_id=5000
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/7675176525192851844/ Frame ED4E 18 KB
18 KB 16ms
16ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7675176525192851844/downsize_200k_v1?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29348abc23c216c553b4e83c0dfa24a90dc78488492247ffdc344bf9cf31eccc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 23:47:26 GMT
x-content-type-options: nosniff
age: 491990
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18525
x-xss-protection: 0
last-modified: Tue, 18 Aug 2020 18:57:06 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 21 Sep 2023 23:47:26 GMT

GET
DATA 200
OK truncated
/ Frame ED4E 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame ED4E 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame ED4E 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edbb5500bfb83c3a7fbc17bcaf6c7ea20e6ea057963bdcc5885725e3126bed2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012209072154000/ Frame 7AA3 220 KB
60 KB 51ms
45ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab720224c1548ed676ca1a6e9f2ecbb3d92fe43ab4e573de9246e48f440a4636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61518
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b9e6b1d3ca7cc68d"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame 7AA3 14 KB
5 KB 87ms
86ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efff01c62418d6f4467c02e31f8c01ec7c4459e9310654f6dcbc30120a385209

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5208
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "dcaf3864e0ab6b08"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame 7AA3 94 KB
28 KB 87ms
87ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

527d0808216e24ce838e14ffd686947cd4a8719fd9562a21412ed08c8ac14614

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 85727
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28888
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 16:38:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "95b4b320f7966d1a"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 16:38:30 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame 7AA3 5 KB
2 KB 89ms
88ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

607150d742ffb67d983e9bd23ab87e0d436f68776c67898c57db306319840cb5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1908
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5561dff7c028bd87"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame 7AA3 40 KB
13 KB 90ms
89ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd22c52347ad42343ca4c6fa76a783715312f1f4a35e97f937611a5b26aa2354

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12958
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "00747b471d2f1a24"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 7AA3 8 KB
895 B 28ms
27ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 14:57:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 27 Sep 2022 16:27:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Sep 2022 16:27:17 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7AA3 2 KB
2 KB 18ms
15ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23759
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7AA3 295 B
319 B 18ms
16ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23759
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H3

200

B25164142.293005026;dc_pre=CPbp2fCxtfoCFUCe_QcdKoQImA;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2468228528;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=
ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/ Frame 7AA3
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2468228528;dc_lat=;dc_rdid=;tag_for_child_directed_treatmen...
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CPbp2fCxtfoCFUCe_QcdKoQImA;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2468228528;dc_lat=;dc_rdi...

43 B
64 B

47ms
47ms

Image
image/gif

172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CPbp2fCxtfoCFUCe_QcdKoQImA;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2468228528;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?

Requested by

Protocol

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f6.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CPbp2fCxtfoCFUCe_QcdKoQImA;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2468228528;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7AA3 0
0 63ms
61ms Image
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CsjHQZCQzY4zaC8qs9u8P9bqdsAGauLWYbPHJppbYDNrZHhABIJv07WtgleKQgqAHoAGU1u7VA8gBCeACAKgDAcgDCqoExwNP0IXTgBm9LnJ839C3MCPm7RI2Y71haqQlegA8pMyfd5coZWrVmpbnsZUNwVKR1Njv8gcAaNsac4MiXPi_aTe3ocZXhZerh2IRagb7Zjsgw7Hbc7biwn0PC39R25CCFDOLOgLUAkhRP8brm178vkEjBw2LuJm2db-CmXkmXIPpyExst_sk3KHub0oAc77lZoE57Mi3jvnY4c0Lxc9rPSipV92tyMN7AKuzqs31wfJb2O9zM40z_6QIHuI7DIvUrOhvOFlKohjdaS5nIaH3GnJEIFzwQsd6_FaKVET6lzOAm9BaXLIzhUSDg3GCqShEmpYJ0jc8OXN4qpPbKHk6BUj9NCrVbfY3bG9tQgAlhnc8-LumH81DalkMiWEdqvtFliPydSLeL8PUPhoX0P5kXxeVPYmiaa4yy6l6r6cEQzMWFh8aQCMg2gPUgC1cm5XI8GFdhRn41bVVFyuIk5ToIoET5HbZjZViQGoQ995mVyptMbte77YqkA62JmFXEWG4VwVeClOw8EYP8Rp57Zoqfb3rHeyBCNXkMZzFyUumsfEs_7HIjwcR_hfK0QBn1-IzUzY6__w6WSMuKYW0ng1CA8swjzD5ZrDKrMAExKPgu7oD4AQBkgUECAQYAZIFBAgFGASgBi6AB9SpkSqoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBCo1yTSCBIIiOGAcBABGB0yA-uCAToCgECACgPICwHYEwyIFALQFQGYFgGAFwGyFx4KHAgAEhRwdWItMTI2MTk5MjQ0NDgwMzg3NRiPymo&sigh=cgqkc3RZBWA&uach_m=[UACH]&template_id=5000
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/9975602013579026835/ Frame 7AA3 36 KB
36 KB 17ms
16ms Image
image/jpeg 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9975602013579026835/downsize_200k_v1?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acfc56af11023640161a7fa7c0932bb736f482736b38cb1e5adf7ca835b809b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 20:02:35 GMT
x-content-type-options: nosniff
age: 505482
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36752
x-xss-protection: 0
last-modified: Fri, 06 Sep 2019 19:31:23 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 21 Sep 2023 20:02:35 GMT

GET
DATA 200
OK truncated
/ Frame 7AA3 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 7AA3 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 7AA3 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d87a928de8f7380756fda6383301985d7cd1505c6946541db65c0c22b200e27

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012209072154000/ Frame 9661 220 KB
60 KB 71ms
70ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab720224c1548ed676ca1a6e9f2ecbb3d92fe43ab4e573de9246e48f440a4636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61518
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b9e6b1d3ca7cc68d"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame 9661 14 KB
5 KB 83ms
82ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efff01c62418d6f4467c02e31f8c01ec7c4459e9310654f6dcbc30120a385209

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5208
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "dcaf3864e0ab6b08"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame 9661 94 KB
28 KB 83ms
83ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

527d0808216e24ce838e14ffd686947cd4a8719fd9562a21412ed08c8ac14614

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 85727
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28888
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 16:38:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "95b4b320f7966d1a"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 16:38:30 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame 9661 5 KB
2 KB 85ms
85ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

607150d742ffb67d983e9bd23ab87e0d436f68776c67898c57db306319840cb5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1908
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5561dff7c028bd87"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012209072154000/v0/ Frame 9661 40 KB
13 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012209072154000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd22c52347ad42343ca4c6fa76a783715312f1f4a35e97f937611a5b26aa2354

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 83901
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12958
x-xss-protection: 0
server: sffe
date: Mon, 26 Sep 2022 17:08:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "00747b471d2f1a24"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 26 Sep 2023 17:08:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9661 8 KB
894 B 28ms
28ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

74017d97a0876e72ef09a14ea0b3ad49a744811c726e7b05e305d4a6e3e07612

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 14:54:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 27 Sep 2022 16:27:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 27 Sep 2022 16:27:17 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9661 2 KB
2 KB 19ms
18ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23759
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9661 295 B
319 B 19ms
19ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23759
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 9661 0
0 24ms
23ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTqwhjq-X_URaCTK-mc0D2vY_UiPrfALmVzwTKf_ks5w7TGZz75CQEYe997lGgvPjNj92bx
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H3

200

B25164142.293005026;dc_pre=CNrJ2vCxtfoCFbGC_QcdDK8B-Q;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=1404473137;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=
ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/ Frame 9661
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=1404473137;dc_lat=;dc_rdid=;tag_for_child_directed_treatmen...
https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CNrJ2vCxtfoCFbGC_QcdDK8B-Q;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=1404473137;dc_lat=;dc_rdi...

43 B
64 B

41ms
40ms

Image
image/gif

172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CNrJ2vCxtfoCFbGC_QcdDK8B-Q;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=1404473137;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?

Requested by

Protocol

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f6.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293005026;dc_pre=CNrJ2vCxtfoCFbGC_QcdDK8B-Q;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=1404473137;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9661 0
0 62ms
61ms Image
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Ci0HZZCQzY47aC8qs9u8P9bqdsAGauLWYbPHJppbYDNrZHhABIJv07WtgleKQgqAHoAGU1u7VA8gBAeACAKgDAaoExwNP0Hs1WqjTrNNKe0_Nx47F9KwPAeLLjZ34Wva-WNxb7mvhUDwBnSAckVU_Vz-YUyH_G1ID5bi89QLBHNqLNGqYkpQdhWySUdX3xFW6cwwDv1Tj3RtoqYqTlfgE5WPvWf3d8EV74cuVUb4W-nleWGwphRu6-xQj-u05xTt-cs3uIL9IV-xiK5opGqap86kxiyRfyZwlqR9ZHOplAy1LUlvv0PLj8yFvzfFmGvvDW24boRT4V_824toC4g07Bwwp9yXG6YtVFlNAkwv2xBen1115StiRE_rRT1DFzeM7QxYkRjej4xdjuvSO9Dp6oOLcfk27oP9WqTrNC3BxyeXFaM2UHlg3zw8FQ_8STJwi_bK1hCWkYaTQpFKuqeakJEqaMAOL42VYIZT_fLdKKJVBjpPpLyOYLSrQMeO7PtlAiLHCwDsmpsqp8UF01V-3gjpgL-xK-wfPgIkWjGZzkOJi6dyQeYGwL19g21oBY9ZgQKSxwsfhfLTjR0rYjuSuRH2gNmQ8wdpbUkg5j--Qxl7g45GuFUf0mzUoVVa_L7mKVTDeDgSo_JQiiS_jsGW8Ge9F3bU0qrQ6y2DZkUWbtxvFeDRuh_Cdir0cDsAExKPgu7oD4AQBkgUECAQYAZIFBAgFGASAB9SpkSqoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBD9gTPSCBIIiOGAcBABGB0yA-uCAToCgECACgPICwHYEwyIFALQFQGYFgGAFwGyFx4KHAgAEhRwdWItMTI2MTk5MjQ0NDgwMzg3NRiPymo&sigh=LmBYAMmPjXk&uach_m=[UACH]&template_id=5020
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 9661 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a663467e111fd2237a1bc5255e8d702b099f29cb553ecab24efe98cbf898b5d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9661 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef19a301dbbc0dd7331e3fc24a7a094a7c577ecf1458994ff93b8e97ec12d611

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B14C 0
0 56ms
53ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVcCkDAEDNFixzoHTyX2pHt2jVtZrGhiacI9AeHME5jqjUgLLXgTQ0pirnP2PS2LoH-GlIg4ryadzs18_tJQQ8mlvs3ggmvhgCK9vpXQ04MyLzZI45BsR6JWtwVZxs0AkJH7kGfVfVBiCl4LWE-6qF7Ux2S-_SBwXQwu8LUJtsUIzh7c_QN_zvK3rEMTFUmzuYowq02ZlDoERu5ac-YhBJBK2KKBd84cHQ-w7iCpKYjXyG1z9jS7Pkr4nFMc_R-HHA9dpzeOTgwroI89mklTEOXhYr8uRMJQYA_t_igW6HVCltM3vLIib3X8Ds4UHo1-nkJN83bYKQUt6Ky4ZEfubQo4glQBPT&sai=AMfl-YRpHWHXUBrFcEjjY9wNixR8oieJVQyvwqVSd3GvpLH3JuascuqN8ASuJmgg57PbOSsiDAoyxm58BrupBxMhuQS4JnSELdM4ggg_3EiutmeF_KEBvNcGZiqvp0x4EP4of2c&sig=Cg0ArKJSzG4raoSK_SHIEAE&uach_m=[UACH]&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220922/r20110914/client/ Frame B14C 3 KB
1 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220922/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:25:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 11 Oct 2022 16:25:50 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B14C 140 KB
44 KB 85ms
36ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

111ac61e627008261e23043c5e6b486035f0b123b1963e2fa8671e188eb33829

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44528
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664191987193040"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 27 Sep 2022 16:27:17 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220922/r20110914/client/ Frame B14C 32 KB
13 KB 20ms
17ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220922/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01e9a6b83eabe383b954ff2ea312241161d6f422cca61b6531dd247028facd32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 13:59:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13557
x-xss-protection: 0
server: cafe
etag: 14526688295695256096
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 11 Oct 2022 13:59:50 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/almdfp680616975594/ Frame B14C 318 KB
108 KB 31ms
28ms Script
application/x-javascript 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/almdfp680616975594/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f6347d41155a6f8afdd5d4a9d73c48de7fadb7389db91a493bf0aa68f3be033b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:17 GMT
content-encoding: gzip
last-modified: Wed, 21 Sep 2022 17:49:46 GMT
server: AmazonS3
x-amz-request-id: XMMM712R54CC3J3V
etag: "08e1f2c584d8c88e39b538c950cf9030"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=48462
accept-ranges: bytes
content-length: 110565
x-amz-id-2: Ne1od01mh6c26G5HBOKc3jWjhPIO8xzBdBXsPJ8GKE2O0CVa1aE2KKqKHi6DrMInUepfbVO7vVQ=

GET
H3 200 7554863994564060305
tpc.googlesyndication.com/simgad/ Frame B14C 43 B
69 B 21ms
19ms Image
image/gif 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7554863994564060305

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 10:30:02 GMT
x-content-type-options: nosniff
age: 21435
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
last-modified: Tue, 20 Sep 2022 17:47:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 27 Sep 2023 10:30:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame B14C 0
0 71ms
27ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTevrikJtQSql9il3im0NCMNaVp4X1X5BMlkXyUBEFNuJ7U6MYYX90x5Jk2f6ehBu9RpFqn
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame B14C 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ea2aabc260813ff4aa25957cde8d45addf81848c6084364bfa2d69e85e4d525f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 f36U5LLOSFCl_RQcRb4gz5dtt8ZR3FgOTI7LNXASQxk.js Show response
pagead2.googlesyndication.com/bg/ Frame B7D7 36 KB
16 KB 115ms
29ms Script
text/javascript 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f36U5LLOSFCl_RQcRb4gz5dtt8ZR3FgOTI7LNXASQxk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f7e94e4b2ce4850a5fd141c45be20cf976db7c651dc580e4c8ecb3570124319

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 20:19:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245290
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16009
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Sep 2023 20:19:07 GMT

GET
H2 200 f36U5LLOSFCl_RQcRb4gz5dtt8ZR3FgOTI7LNXASQxk.js Show response
pagead2.googlesyndication.com/bg/ Frame C291 36 KB
16 KB 123ms
37ms Script
text/javascript 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f36U5LLOSFCl_RQcRb4gz5dtt8ZR3FgOTI7LNXASQxk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f7e94e4b2ce4850a5fd141c45be20cf976db7c651dc580e4c8ecb3570124319

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 20:19:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245290
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16009
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Sep 2023 20:19:07 GMT

GET
H3 200 /
www.facebook.com/tr/ 0
18 B 52ms
21ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=499911897232848&ev=Microdata&dl=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&rl=&if=false&ts=1664296037053&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22401(k)%20truth%20bomb%3A%20Missing%20participants%20are%20bad%2C%20but%20401(k)%20cashouts%20are%20worse%20%7C%20BenefitsPRO%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22401(k)%20truth%20bomb%3A%20Missing%20participants%20are%20bad%2C%20but%20401(k)%20cashouts%20are%20worse%20%7C%20BenefitsPRO%22%2C%22og%3Asite_name%22%3A%22BenefitsPRO%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fimages.benefitspro.com%2Fcontrib%2Fcontent%2Fuploads%2Fsites%2F412%2F2018%2F07%2Ftom-hawkins-july-26-next-job-3.jpg%22%2C%22og%3Adescription%22%3A%22At%20a%20minimum%2C%20missing%20participants%20have%20preserved%20their%20retirement%20savings%2C%20instead%20of%20cashing%20them%20out.%22%7D&cd[Schema.org]=%5B%7B%22dimensions%22%3A%7B%22h%22%3A0%2C%22w%22%3A0%7D%2C%22properties%22%3A%7B%7D%2C%22subscopes%22%3A%5B%5D%2C%22type%22%3A%22https%3A%2F%2Fschema.org%2FWebSite%22%7D%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.84&r=stable&a=tmSimo-GTM-WebTemplate&ec=1&o=30&fbp=fb.1.1664296036485.1881697625&it=1664296036187&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Tue, 27 Sep 2022 16:27:17 GMT
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-length: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame B7B1 28 KB
28 KB 41ms
40ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 20:38:02 GMT
x-content-type-options: nosniff
age: 503355
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Sep 2023 20:38:02 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame ED4E 28 KB
28 KB 41ms
41ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 20:38:02 GMT
x-content-type-options: nosniff
age: 503355
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Sep 2023 20:38:02 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 7AA3 28 KB
28 KB 45ms
44ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 20:38:02 GMT
x-content-type-options: nosniff
age: 503355
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Sep 2023 20:38:02 GMT

GET
H2 200 f36U5LLOSFCl_RQcRb4gz5dtt8ZR3FgOTI7LNXASQxk.js Show response
pagead2.googlesyndication.com/bg/ Frame 3312 36 KB
16 KB 123ms
62ms Script
text/javascript 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f36U5LLOSFCl_RQcRb4gz5dtt8ZR3FgOTI7LNXASQxk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f7e94e4b2ce4850a5fd141c45be20cf976db7c651dc580e4c8ecb3570124319

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 20:19:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245290
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16009
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Sep 2023 20:19:07 GMT

GET
H2 200 f36U5LLOSFCl_RQcRb4gz5dtt8ZR3FgOTI7LNXASQxk.js Show response
pagead2.googlesyndication.com/bg/ Frame A8A4 36 KB
16 KB 133ms
72ms Script
text/javascript 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/f36U5LLOSFCl_RQcRb4gz5dtt8ZR3FgOTI7LNXASQxk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f7e94e4b2ce4850a5fd141c45be20cf976db7c651dc580e4c8ecb3570124319

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sat, 24 Sep 2022 20:19:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245290
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16009
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Sep 2023 20:19:07 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
267 B 257ms
257ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ALM_HEADER1&hp=1&zMoatAdUnit1=benefitspro&zMoatAdUnit2=articledisplay&wf=1&ra=3&pxm=1&sgs=3&vb=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1664296035905&de=4427156406&rx=110598660422&m=0&ar=220b545db30-clean&iw=54a36c0&q=2&cb=0&cu=1664296035905&ll=2&lm=0&ln=0&em=0&en=0&d=4525440395%3A2480285401%3A5003105952%3A138270398105&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&id=1&ii=4&bo=benefitspro&bd=articledisplay&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=almheader466656885399&fd=1&it=500&pe=1%3A2204%3A2204%3A0%3A2458&fs=200409&na=190772649&cs=0
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:17 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 9661 28 KB
28 KB 39ms
38ms Font
font/woff2 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitspro.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 20:38:02 GMT
x-content-type-options: nosniff
age: 503355
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Sep 2023 20:38:02 GMT

GET
H2 200 hbw_master_307825_11598.js Show response
p.safeservingcdn.com/prebidlink/y19262/ Frame DADD 80 KB
26 KB 22ms
22ms Script
application/javascript 45.133.44.3
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://p.safeservingcdn.com/prebidlink/y19262/hbw_master_307825_11598.js
Requested by: Host: p.safeservingcdn.com
URL: https://p.safeservingcdn.com/prebidlink/19262/j.html?i=11598
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.3 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: 09b1709f8bfc41f82e066e046669c0c0fdd373848b61835646675c946d841ba5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p.safeservingcdn.com/prebidlink/19262/j.html?i=11598
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:17 GMT
content-encoding: gzip
last-modified: Fri, 23 Sep 2022 17:14:34 GMT
server: nginx
etag: W/"632de97a-13e9c"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800
expires: Thu, 29 Sep 2022 16:27:17 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame B7B1
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

89ms
44ms

Image
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Redirect headers

date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 tag.aspx Show response
ml314.com/ Frame B14C 31 KB
31 KB 18ms
17ms Script
application/javascript 34.111.234.236
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?2782022
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/almdfp680616975594/moatad.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 27d7b573de36acef9ddbf975de05251f5219d2e4b8424288aae62aa57d5a6396

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:08:27 GMT
age: 1130
x-guploader-uploadid: ADPycdsQFN6mX5-v0l4mLoU1mdIifWetTRSxbiYMs5wOcrl2KNGM-1ZCbShp-IDt3xWaYUBq3X_zh48fXIj10TEnNFOOUQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32025
last-modified: Tue, 09 Aug 2022 21:49:07 GMT
server: UploadServer
cache-control: public,max-age=3600
etag: "fe36d3317b1b052708eb2260e253aa63"
x-goog-hash: crc32c=BjH7bw==, md5=/jbTMXsbBScI6yJg4lOqYw==
x-goog-generation: 1660081747697868
cache-id: FRA-1209ea83
x-cache-hit: hit
x-goog-stored-content-length: 32025
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 n.js Show response
geo.moatads.com/ 85 B
257 B 127ms
56ms Script
text/html 18.135.121.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3MIJy%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vldfgUevl2QD4YpW6R34RpvnDsHp3lN2bOJbBer2APsOGgL%2F6PC5WmU2F3MRrrFWS1qZ&rs=1-21y3bVjbGrWLAw%3D%3D&sc=1&os=1-cA%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=ALMDFP1&hp=1&wf=1&ra=1&pxm=1&sgs=3&vb=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1664296037263&de=488057338317&m=0&ar=220b545db30-clean&iw=6bbb37b&q=7&cb=0&ym=0&cu=1664296037263&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4523359581%3A2453463030%3A6114379848%3A138405151451&zMoatMData=waiting&zMoatTopic=retirement%2Cnews%2Cdefinedcontribution&zMoatPS=footer&zMoatMMV_MAX=waiting&zMoatMSafety=waiting&zMoatMGV_MAX=waiting&zMoatMMV=waiting&zMoatMGV=waiting&zMoatHT=-&zMoatWD=-&zMoatCURL=benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4&zMoatDev=Desktop&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&id=1&ii=4&bo=21664827602&bd=21686515491&zMoatOrigSlicer1=21664827602&zMoatOrigSlicer2=21686515491&zMoatDomain=benefitspro.com&zMoatSubdomain=benefitspro.com&dfp=0%2C1&la=21686515491&gw=almdfp680616975594&fd=1&it=500&ti=0&ih=2&pe=1%3A2204%3A2204%3A0%3A2458&tz=footer&iq=waiting&tt=waiting&tu=waiting&tp=waiting&fs=200409&na=1563221978&cs=0&callback=MoatDataJsonpRequest_13639450
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/almdfp680616975594/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.135.121.86 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-135-121-86.eu-west-2.compute.amazonaws.com
Software: Microsoft-IIS/6.0 /
Resource Hash: 448d142e55babc15245b6e6f371ced227ec95816d1a101bbbfb38a01e265d0ca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:17 GMT
cache-control: max-age=900
server: Microsoft-IIS/6.0
timing-allow-origin: *
etag: "9aeed75c8723e4c1f33b50bbbb7b2fb24e4811fe"
content-length: 85
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK analytics Show response
go.alm.com/ 50 B
1 KB 721ms
302ms Script
text/javascript 18.208.125.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go.alm.com/analytics?conly=true&visitor_id=2991780&visitor_id_sign=b5495599caa0b2354d1b9077b431fef0bd418c711d26bf69ba1882ce52c39d3e2a1eb7dda968d4bb8153503a45e6670b487da121&pi_opt_in=&campaign_id=1300&account_id=998701&title=401(k)%20truth%20bomb:%20Missing%20participants%20are%20bad,%20but%20401(k)%20cashouts%20are%20worse%20|%20BenefitsPRO&url=https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713&referrer=&utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&utm_source=hs_email&utm_content=227288517
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1300&account_id=998701&title=401(k)%20truth%20bomb%3A%20Missing%20participants%20are%20bad%2C%20but%20401(k)%20cashouts%20are%20worse%20%7C%20BenefitsPRO&url=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&referrer=&utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&utm_source=hs_email&utm_content=227288517
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.208.125.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-208-125-13.compute-1.amazonaws.com
Software: PardotServer /
Resource Hash: dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 27 Sep 2022 16:27:17 GMT
X-Pardot-Route: 9b06e8e2308c32c7bf9ba8adfb7be2e1
x-pardot-rsp: 0/0/1
vary: User-Agent
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 50
Server: PardotServer
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 hb_307825_11598.js Show response
player.adtelligent.com/prebidlink/ex19263/ Frame DADD 286 KB
89 KB 50ms
16ms Script
application/javascript 45.133.44.4
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://player.adtelligent.com/prebidlink/ex19263/hb_307825_11598.js
Requested by: Host: p.safeservingcdn.com
URL: https://p.safeservingcdn.com/prebidlink/y19262/hbw_master_307825_11598.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 45.133.44.4 Philadelphia, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx /
Resource Hash: d3f5d2edb1d7efe3e24417b3a48999d2090f8b7cab6a0f773e4075b33122de03

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p.safeservingcdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:17 GMT
content-encoding: gzip
last-modified: Thu, 18 Aug 2022 20:18:51 GMT
server: nginx
etag: W/"62fe9eab-47661"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 29 Sep 2022 16:27:17 GMT
cache-control: max-age=172800
x-proxy-cache: HIT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 9661
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

109ms
75ms

Image
text/html

2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H3
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Redirect headers

date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9661 2 KB
2 KB 16ms
16ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23759
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9661 295 B
319 B 17ms
16ms Image
image/png 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012209072154000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 09:51:18 GMT
x-content-type-options: nosniff
server: cafe
age: 23759
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 28 Sep 2022 09:51:18 GMT

GET
H/1.1 200
OK / Show response
ghb.adtelligent.com/geo/ Frame DADD 153 B
429 B 174ms
32ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/geo/
Requested by: Host: p.safeservingcdn.com
URL: https://p.safeservingcdn.com/prebidlink/y19262/hbw_master_307825_11598.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 6c00f268685b8a576d1307fab673f36330a258b36d1d4afb50232c01ca2a388f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p.safeservingcdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 16:27:17 GMT
Server: Adtelligent
Content-Type: application/json
Access-Control-Allow-Origin: https://p.safeservingcdn.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 153

GET
H/1.1 200
OK tracking Show response
ghb.adtelligent.com/adunit/ Frame DADD 43 B
437 B 223ms
45ms XHR
image/gif 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/adunit/tracking?event=11&type=0&client_id=307825&site_id=11598&full_page_url=https%3A%2F%2Fwww.benefitspro.com&adid=kew14z.ke&features=16416&vpbv=N087&lifecycle_tte=481
Requested by: Host: p.safeservingcdn.com
URL: https://p.safeservingcdn.com/prebidlink/y19262/hbw_master_307825_11598.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://p.safeservingcdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 16:27:17 GMT
Server: Adtelligent
Content-Type: image/gif
Access-Control-Allow-Origin: https://p.safeservingcdn.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 43

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
267 B 32ms
31ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ALM_HEADER1&hp=1&zMoatAdUnit1=benefitspro&zMoatAdUnit2=articledisplay&wf=1&ra=3&pxm=1&sgs=3&vb=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1664296035905&de=397546198597&rx=110598660422&m=0&ar=220b545db30-clean&iw=54a36c0&q=3&cb=0&cu=1664296035905&ll=2&lm=0&ln=0&em=0&en=0&d=4525440395%3A2480285401%3A5003105952%3A138270398105&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&id=1&ii=4&bo=benefitspro&bd=articledisplay&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=almheader466656885399&fd=1&it=500&pe=1%3A2204%3A2204%3A0%3A2458&fs=200409&na=330277638&cs=0
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:17 GMT

GET
H3 200 utsync.ashx Show response
ml314.com/ Frame B14C 62 B
81 B 56ms
55ms Script
application/javascript 34.111.234.236
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=80951&ct=js&pi=&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&pv=1664296037504_jx8sg8km5&bl=en-us&cb=6834500&return=&ht=&d=&dc=&si=1664296036473_lwmvykh5x&cid=&s=1600x1200&rp=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&v=2.5.2.2
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?2782022
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:16 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62
expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ Frame B14C 20 B
482 B 662ms
198ms Script
application/javascript 52.73.151.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=2782022&v=2.5.2.2
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?2782022
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.151.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-151-3.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Tue, 27 Sep 2022 16:27:17 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public
Connection: keep-alive
Content-Length: 138
Expires: Wed, 28 Sep 2022 16:27:18 GMT

GET
H2 200 170 Show response
a.ad.gt/api/v1/u/matches/ 10 KB
4 KB 551ms
185ms Script
application/javascript 35.86.50.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/170
Requested by: Host: player.hbmp.mediafuse.com
URL: https://player.hbmp.mediafuse.com/prebidlink/x462304/hbw_master_302826_14703.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.86.50.147 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-86-50-147.us-west-2.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 165d4b32d383de13418ead461a6f1414d9ad6e2358aa43cf42cfb72d47880374

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 27 Sep 2022 16:27:17 GMT
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: nginx/1.20.0
content-type: application/javascript

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
267 B 27ms
27ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ALM_HEADER1&hp=1&zMoatAdUnit1=benefitspro&zMoatAdUnit2=articledisplay&wf=1&ra=3&pxm=1&sgs=3&vb=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1664296035905&de=243433421804&rx=110598660422&m=0&ar=220b545db30-clean&iw=54a36c0&q=4&cb=0&cu=1664296035905&ll=2&lm=0&ln=0&em=0&en=0&d=4525440395%3A2480285401%3A5003105952%3A138270398105&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&id=1&ii=4&bo=benefitspro&bd=articledisplay&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=almheader466656885399&fd=1&it=500&pe=1%3A2204%3A2204%3A0%3A2458&fs=200409&na=1276583254&cs=0
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:17 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
267 B 28ms
27ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ALMDFP1&hp=1&wf=1&ra=1&pxm=1&sgs=3&vb=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1664296037263&de=488057338317&m=0&ar=220b545db30-clean&iw=6bbb37b&q=8&cb=0&ym=0&cu=1664296037263&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4523359581%3A2453463030%3A6114379848%3A138405151451&zMoatMData=waiting&zMoatTopic=retirement%2Cnews%2Cdefinedcontribution&zMoatPS=footer&zMoatMMV_MAX=waiting&zMoatMSafety=waiting&zMoatMGV_MAX=waiting&zMoatMMV=waiting&zMoatMGV=waiting&zMoatHT=-&zMoatWD=-&zMoatCURL=benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4&zMoatDev=Desktop&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%2520Leakage%2520Email%2520Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&id=1&ii=4&bo=21664827602&bd=21686515491&zMoatOrigSlicer1=21664827602&zMoatOrigSlicer2=21686515491&zMoatDomain=benefitspro.com&zMoatSubdomain=benefitspro.com&dfp=0%2C1&la=21686515491&gw=almdfp680616975594&fd=1&it=500&ti=0&ih=2&pe=1%3A2204%3A2204%3A0%3A2458&tz=footer&iq=waiting&tt=waiting&tu=waiting&tp=waiting&fs=200409&na=546870964&cs=0
Requested by: Host: www.benefitspro.com
URL: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:17 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:17 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C291 0
20 B 124ms
64ms Image
image/gif 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BLkAvZCQzY_rcE8GN7_UP0eWZ0AsAAAAAOAHgBAI&bg=!tLelt_PNAAYIxsuQKMY7ACkAdvg8Wsp0Y5OxmGDWeoFv0AqT88-T9_gayVxU-39D5-jWQsJh6ZITLAIAAAF2UgAAAAFoAQcKAEi6Qv0lgrw7LHiQumiXc4PUHsdDyRnSvV6uXNbLPJq7einzHry3YucjwCQXbcQqnRCB2d-BSXwhj15-MhOL_toDB6DoVxWrG36ZAsBbN2XLXFLTnu5X0wgE0VkYWnHt6jbG9bIBYPOEcV6BYGlh0kpe0UZ_rZbMsOS32g45-T2pcMkO-XikSpfzp7XAEsUqVjfe5xE_kTQdd_MqnAlKy3QXdefwCPPpf28yadJkCoLJ4Y7po_UkwxzPEyOs1GCpvQxd8BXV7VYTXAKKe6m060qFXLO2aTUn5oCQLyivqITfOMWgI2P7h8NexJIvfL4LdNevSVgVdl5ihmbDBmqbOizqgys0TX0-eIRd8f0KJr1kkP7E7AbgOol4Vk-wZYphXfgf9YaJCMCobHtIlrIjLG63N2xh2fxgNhFUqtncDKKcHJfO94c6dev-l7bqgfvIrrchtKoWavEUK8-qhGNERG-oUCAV0lwez5txa9911fnh13zOob1ubOqU5v052NgpLAu9xpw4PqQAb6d3iiI8X9-Ypj0-yK5jFsLCl0NkhqGtOBqpSHpOwXg7zFirgPCky2YTkcWKI-H_4NFRbaYm5JLI_Zh34YrQtcw3-fC_2_0s_34tJTjAOccJXcVJfwKZQ5Lz_AR4N5iY6OzxUqtKrXO91SuJHJO5zNjIDqAHdx2Qo489JGh0woqvhls0P6g8M_IJPZrmYZSipZujXzc0qPqk9fzajUJg4ij7nNYizScU5iPcWFeby562JFH8RL9XxNzw7UE3bBOjby-ZlnJ73Ocqi1SnkUNLjQHsAUXnDMRfUyMazwtzs77YEYXOKLDNwpcBDWz_JsZeRWMAaOK8d_mTB4efiJqwakbylrOxDqCHXYkeEMxtJ0XXFw5sP4V03V9T-W-H0EVBA1yr85CU-8Tb7-R_FnVqVWRwvUeMbF7VaS8VxYxSf6La9E_eV1ovoGN14hp_LruTUt9prcDmEC5zTTQ-2i8Wln-XsVEXMK0XM0zzpO0ER7MikgmXyptsk9dYUifnHzn-ZvJTTg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3312 0
20 B 123ms
63ms Image
image/gif 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BrAwHZCQzY9GgFOaU7_UP0-iKyAEAAAAAOAHgBAI&bg=!ICOlI2fNAAYIxsuQKMY7ACkAdvg8WkQvvd9f9NeQHu02INlgQiaC4v0KuoUW1BpGmLBl6njLgM-WIwIAAAFXUgAAAAFoAQeZAsFvqOO_GST3-n23A5SpEgRrPKAhn1JQ1C0Oxa5d6dtshi8yU-2OgTR1j-msu-gqzUUY9CNOf7eFyJrnRoCu8SyR_22Ot0gniD8k92aazSdYRnype22_dK_GC8yz2wliQEOUnkeWiqtrhcMe1pEW2sjLi8UK2TmqPXD89PUiK2jhQKmcd8EHNRsnw-atGHmxjOjI1Ub40UbkAlnhi-rS9aHIkkqB9gJbSkK2mJxwGF7LqhDv_DhLYzCYDt196uTKlqmrmF2Gknp0wEon_UQhMuJB38SMqT2J_UojIu3HxkrDhPF5bgQtTSRb6-Bpc7ZGjKXVmPpWXTDJBIqwAAqmpBeqWpjb6j-jzZRyGjLnc65ZS3kA3TKClkDg5Gw0TdMmr4Eyj8sWd-WhDWSDmWbGcwLMB_Ikr-JyOsXCc3_cqYJoZ_hhXF1n7_O2DpHQ8DbH69aAKaU4txsOeDDEsinuPwjvrVs2q-d-WDg4hGVqSKFHpBM7ksAVjKVz9NFR4WdZsM-7bcG6p_-fGeejgRQ9OunqG9Ouo1B0JD00PTINYnV4GAcBDCoGnTtzLVsWVhHmLyIXM6IZSntYwwrBwB3KabOR2oggX0F47Yi5bPG8hdRvFfSw-REdEjXpuWOkNPasRoCcBF5ndypsVWI9IywWSkaQLoDDwc94a13j0Cl2neu17F7O9rt7AOJUwNdco-drvQI7sNRoBIHF2SYxHyJ9kljodpn02MBNoUIRsjAa1wy8tDW4itD_qlaWNnXhqvcdisi42Y8vaUtxXdZ3E4a4wxiYMGIHnDHcK74bJ230PoFRe9OEJoXTd6hMtBEiW4eWMrb10xZlavoB6I-kSWUpekWcoXLYdNFMAQ-gVS6J0xFKf3ywv04db0XVIXPFAcUYYRKe63S0ragZEa3hubqkwbOUWiq4asTj9936eqQz8dxefL8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A8A4 0
20 B 124ms
65ms Image
image/gif 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BgO2QZCQzY_rCE4yu3gOXy5LICQAAAAA4AeAEAg&bg=!3d6l3prNAAYIxsuQKMY7ACkAdvg8WiFAD8M0BRQqeO7uXDyc9DVyIakrFoJTqSywKsVeLE0QbtqYBAIAAAFKUgAAAAFoAQcKAE2Ge9lqrqWmOUKwWmR0Tu8bjNZ29PhVeyBLo-Ue_VcrrMM9L-tJNqnfY5xtQtB7nfj9kb9CtfTGXbt4mD_g7eriCq-chKPkFpLuFih-4pkCt-qoqgbuBAthdsHF6XGTh27Lb6AY1Mw-27yhJwHdTlBJGDmTTfx3LZ3zA8ZUbwLMa3o1BqIbuKVLAbN0LDLKPySYYIY4R2J5oby_zJgHAn_8EJzGrJ-htMw10VfgPtfSCQ2o2aqhM9EdLXjkIMvscJTEDTsUgk1gT6Zw44R8pBUupECsD5XJRyh4Yi2iOPpv3vnxaf-qrOYeICfbosh0OxOmjAmgnH7gxBBv5fJ3rlBN-eFlj7TsQdGhhceBnEu20JE_hwngwrEm0TZ-o2uv9fxrUH8aS09EMKiQ8aw6Eja8RZYwvpZQQM30GhJBEAWyWjUoLXeyMa_ZY4gn34blWC8A7sTeiTDCkDZ5lAoVibezANlmbEAuxjpkRMIgpDur02jcEdYkPrR7KPYXoScJhqkOgIbN-I06d1QxKAOSNxTwx8dBrda_6EEwKBrmgVAlcbiWXpaNQx8HfSr9HQFsuFElC9UQau_p_Ynw5idpqm2eo9-wYT2XDXMnseaOAksvBOlHA3SenGyGzMQCfgA7PqwkLp9VKSDLwPClAtlehFWLDY9jFAostQWK0ylHLD-qppHpXsDEmog07R20s8R3nWzZFTt_RzhhmrJsJtZoEoSuRk3XZR_twzW35CJuhsWNE0k1S8E6OVmRSLxMR0wQA5edkMm3ysrKwKSMk6iV0syZkokoG6wYl-0dTUtvFDOrtFZrhm_WoU6SIqa9DVZrnVqHsYuQg9VkiO1Be_H3nMDm5450_kFs2CLC95YUgCh3qVODKncxOIVMctqLSTMmDNb6P0ebGDD6zDi4eNmOYkxwTjury40AuQaj5ED0s6VMuM_7dRTp9OloraVebxl-yWaab44j-EKObyn-3d1HitBlVgtNEYyKht0c6reVmgQjetJyfDr5QchiVjnr1BF9AA3orsZN-30O

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B7D7 0
20 B 123ms
64ms Image
image/gif 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BFkw7ZCQzY9m6E_6s9u8PqMekmA0AAAAAOAHgBAI&bg=!iYqlis7NAAYIxsuQKMY7ACkAdvg8WomR2u0OcN6X8-NH8fs0S5eO-W0Izz15-o_njsFJmkTvKJzZswIAAAGOUgAAAAFoAQeZAr2XVrhyY2XX9ljV2JieoXaauNl7vqH_n9QfuZoRBBv-mUfeySix9DFuMsiCZlRV1VGDLxXUGSey1tX0aB9kxoJWD6g_meTF9HXbzYFZ4LaNXeN4iIqLk47isCTI1_q1wy_FIyqs47i8xIRbL3SQcTCqaJB3ARUFO36xV0MIBl2DmuBW2We3Faz6v7hQu64mAXY9Q6njbYfvgpD2pcl4ogZ5H6atC5CMlUmlauv_6tQt-_b8L7set9YTzvqNmknBPoiT3Cei4H65pNY2AvxUB8_mm8KhETs_7lrPe8Hoia_0ayfa6ooM246HZ8F7KNv_nN7ikA9-azdXK8C3A2peMYVNKe8a43gN_WF0Tx23TJTV5JeEj72oJEOrZbz8As5QLJz8w9xWKobFPCHxfBORAN8TWe_eCSB3utTofAZubX3RwGeajkBIjpCgP0kOvjZSuZi15uXUQUCXsg8_APoUSlnyjNSwUoB9pTgvB_9qcRkslUC7ijLJPGMprEP2-jMufb9UmjcbXFN9Zz4b20r8mkJL6qNDaTQJy-uDD8s-vUDcF-5fvqRywzwKC8Za15-wsm39MBZ7_ISwdlALBYL37lE6O9STxP6EYy0LCUxA7w4hr7elWlfLHuq9lTu7VC4zAA6EtqOli_Mgz4QVJBipyGGeVI3f3PZWCogfUAj8uRFAIAwwebEENqcP14yoies9HoxqXFWN7Wgas3Dzrq_0Z2wyvbTfTCE4YJKdeY8g0cESAtYy2aXMjnciAv4oCX4oZ0Whz-J38kQmuGv5rLjA-oEh0NRSc70_2LPybi_-_-uvIDrmZL1JTwZduFerf9rYNpLNRvscQkyB1UBU5TMa9hVr9T9yfaJOmsaTGTYf4dxGvsIxotxTTF_MVd6UfwAY8mBOlMfOVGCLq9nDCIo5wxAiodSfJt6-VAfdXoeotw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B14C 0
0 52ms
51ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssnqoDLeiSwmjMOu3itODSQU5FsqpRkbJs_mFkDtZIDyDwyzs-VmAhnz9QyHrsgQnBBpkfE0pHtG5WB-HyPnThz74BEWeWr-g3Y8O7Q9_i15NcfAe1n2THkxNFXyda1T5fP80sMNK7eQtdi_GFLBl_Jvd2Co7XUydBrdn9E2-r29kq6mZbPFFk6WMBrt4fsBzHUBxZWTrqjIxy_0VXXEfQtYFkrNL_miWzfWFcOJfKh-xmXdV-rr1Ye-CgBS0x9PI8bG9-1yU9fzvcnaC_8lgnWsEjgjNtDs0OKxzlSFp2csa6IGez3aGjOdkgvd0LYTIdMmIOlKbykdP4dASdu_h6tdvRYACFkQqA&sai=AMfl-YQtL_wYd0MMQS4E3HTDAErD1chQ8jO0hYuoltn592Rq80Isb3bSSw2QIOxDFVnpQRZc1Vy3HVCDdUEpelC2Boq0GVCs5-fzFsQ2TKKhRvlnYjzRABFnx7QTjBzxLmkMFf8&sig=Cg0ArKJSzPZOGbRdKmNuEAE&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 27 Sep 2022 16:27:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 27 Sep 2022 16:27:18 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 143ms
84ms XHR
application/json 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022092001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a4c0f0893bad70607f0e186bf6d11b186d2a0ec524fb1c0e4e82896e9eeb9ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 27 Sep 2022 16:27:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11313
x-xss-protection: 0

GET
H2 200 nav-icon-sign-in-white.png
www.benefitspro.com/assets/master-template/images/market-images/ 236 B
455 B 54ms
53ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/market-images/nav-icon-sign-in-white.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1be06778698a2eb16ae1c7152d7256350580f4a21fc43c5ef4218407135b0896

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:18 GMT
vary: Accept, Accept-Encoding
cf-cache-status: HIT
age: 12990
cf-polished: origFmt=png, origSize=3131
x-cache: HIT 2
backend: templates_newlaw_director
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
content-disposition: inline; filename="nav-icon-sign-in-white.webp"
content-length: 236
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"3131-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b1ebfb19034-FRA
x-vnode: 28
expires: Tue, 27 Sep 2022 20:27:18 GMT

GET
H2 200 arrow-open.png
www.benefitspro.com/assets/master-template/images/market-images/ 134 B
310 B 391ms
391ms Image
image/webp 2606:4700:4400::ac40:9199
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitspro.com/assets/master-template/images/market-images/arrow-open.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9199 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

075e1a285de33ad2c3cc75f3ebe775feb23d27f52aa8213be408e4cbc3623a10

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/2018/07/26/401k-truth-bomb-missing-participants-are-bad-but-4/?utm_campaign=Cashout%20Leakage%20Email%20Blast&utm_medium=email&_hsmi=227288517&_hsenc=p2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ&utm_content=227288517&utm_source=hs_email&slreturn=20220827122713
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:18 GMT
vary: Accept, Accept-Encoding
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=2986
x-cache: HIT 1
backend: templates_newlaw_director
content-disposition: inline; filename="arrow-open.webp"
cf-bgj: imgq:85,h2pri
content-length: 134
last-modified: Wed, 21 Sep 2022 20:57:46 GMT
server: cloudflare
etag: W/"2986-1663793866000"
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 75159b1ebfb49034-FRA
x-vnode: 21
expires: Tue, 27 Sep 2022 20:27:18 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022092001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 27 Sep 2022 16:27:18 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 2921 13 KB
5 KB 19ms
16ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitspro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1288
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 27 Sep 2022 16:05:50 GMT
expires: Wed, 27 Sep 2023 16:05:50 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4C00 783 B
532 B 63ms
62ms Document
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

dcb909d8da8e85b813c1e2a770b48044df9a1a626b5a245e957b4ccd6bb1b14c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cHcsUmYyWuaYfCEnd4oJOw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitspro.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 510
content-security-policy: script-src 'report-sample' 'nonce-cHcsUmYyWuaYfCEnd4oJOw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 27 Sep 2022 16:27:18 GMT
expires: Tue, 27 Sep 2022 16:27:18 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 lNPcL4AZZQ8z9NJpy71wtXJu_aTy2V1-RO76Pd5QcdQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 2921 36 KB
16 KB 30ms
29ms Script
text/javascript 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lNPcL4AZZQ8z9NJpy71wtXJu_aTy2V1-RO76Pd5QcdQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94d3dc2f8019650f33f4d269cbbd70b5726efda4f2d95d7e44eefa3dde5071d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Sun, 25 Sep 2022 00:38:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229744
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15861
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Sep 2023 00:38:14 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4C00 0
0 62ms
62ms Image
text/html 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022092001&jk=4324995110256866&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 2921 0
10 B 15ms
15ms Image
text/plain 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?GIwGTw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Tue, 27 Sep 2022 16:27:18 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame ED4E 42 B
64 B 73ms
73ms Image
image/gif 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssgFIfyi2e-1W01WBzwr-Jh6rwAjUPJOqx8dsLl30_HC4sru2kW-OF7S2YaWpD81Fo7qD8XrNV_Po68ykh1mll6gA8GMl-0w1TrhmuIgrzzxl7ht4PtDUkZvOgYfgfji4djX4E7q7xMqBnt8N0mRdL-wcodUSgCXZoJLWXFNu6C_kl77wlEf_Dw-rM1mEFJdXoXV4PhvB6i_3Zkm9Es1ZEqxVKbejGsRt9VT4IcL1bAwCNKxmFfhodwe_W1WjQLbabX9yIDaIBV13ExpPiInwrL-SDoiFL-txMgrI7QRqTP_NLH4QFVqK-raKHafgMuN57qTpZk_yl4HPFfF8E-ajeBS5CHTj3JSLRk_QKdWV2NUCBLDYLORXVByUFgYQkfFKM8YkaGmgGPgfLan8Sd7rqS-uszk3KXNrYZsnSLqbShsxt8xQ2k_adM1XJkk6SN5MQeOXm59NCwwdw1l1Xyvf7Z6cgw_s3qos2kxAy4t00zfE58RbgtAU3fgtUbJpwEWSqu7XvTEtO3dPqcQhEwt0B5jzkh2uPXbEMp2OSoCt5nh0i8oAZOdlCkYS2G3s5IZ-jLfj3lZwPBmE7iJ1E4BUiWodp1A1JAGFmrGpStzPxDX7-cFgWBZBQfqVNyY7MSxSz6J6Ae1GTJDc4xQPuvAiLI5bC6PWX-V8o2pMKv8Q-xOjXKumMvrTbUtOYfwSdU5xtfQQR_z-O78_PjoGFLFSSfN5LfhguETJXuL1OIFn1ENFRlIpWJKxlGVOMiLPTIPPfFZUmB3o3FvLyrQFybC-PQ07oggUi1bPZE6i7B5PglEiZa9Z78jXh_Z3TtmwVcvbJVC-ZwKbgD3swy92RTwLJPqWuSK_qwBoD9ZLwmqmn-gd2MBjJNHZ6swY0RAamRPh8EYEo_tH2VubLwnMx0fdxL1pVrmDJzJNq7jwA47ltPfergXHehN6Ke1LzjYM-XkchnVf14IMvgb8s3lpMmoHJsdx1cXKGQt7CfAOfx2--JG6hVE_UzViTZ65_PLZt5phelraaFKmIlhEKAcT83urkOeurQGDBeO4ilB1OPkVtWfPIJGGcxgIzzqZ7HDwe4doff9HWOxtDzGsdW9rdqWAth2zOJnSQmWPBvybwSmoWObjZd7uFQ41GSqlEiRv_NpWQIxBuqPw5E4LRkmVpK90YFzjHwltgcBvhq78mxhmpozUAM3kYw30wX9c14x65zzvO5qk6mHuHqgMwq-Zg8x2lQX8VbyIE_6ZVSlw2amHFwuuy_5pGnjCbeVant2wD3tDG35EGlpmGda2IrAKA2sExj858_bRM8ruYsNVp4t7aE-x_nE2EozfjLvRVWrCoaf8lovj3anjKn0142Gzo1QVqDZ-j1Rp_VDerd_jqThuQTxU7y68bpxo1leQBHtzOafxVrwQv3k60Gr_n7WkQN2D8L41dyrhEUtF6qRypN&sai=AMfl-YQLZg_6Nc6RTlr5trPWrbuCYyb1oM2OXW57a1DAUbK7WTpklb7n3kDvflkzIeVnvy0BXW-t1SacqzSUMWc2q0sUhcoEdSHtot39TiHTseD2efecSd9eUUIWZbibGtoF8kh9PDrMSQqcPxxbrQ&sig=Cg0ArKJSzGyOsVmjFCcdEAE&cid=CAASUORo6keuksogEULdhZB-NDZjQtA1HXWsd1fQUUb0BtlFHagTuwLXPDemBb1AA2E8NSBFEtUtMXcLFPnW8g4WwpaZ-WHEoWLPSOlKNnvWcAx0IA0&id=ampim&o=315,174&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1010&mtos=0,0,0,1010,1010&tos=0,0,0,1010,0&tfs=559&tls=1569&g=100&h=100&tt=1569&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 27 Sep 2022 16:27:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 65ms
65ms Image
text/html 2a00:1450:400d:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022092001&jk=4324995110256866&bg=!s7ClsPTNAAYIxsuQKMY7ACkAdvg8Wha69Yv3Yo2fotAm3A8bLT1Nm4_d44dqJhfxHHFRv2sSY1sW_gIAAABTUgAAAAJoAQcKABZZyTVaeZuq8IQaByuWD0_rs2DaYvfLmQKiKXr8HfTqWKW-C4y4Yd0lG674nJjDThZZBG-nsuXTAUbufuczK4YAe7ooDG7_I3_bVfKQh6a1rIKGw_Wqiqnde4ZDqmO3ffuOcNQSA9RRjr8_PNcsT0dPgykHj_bkoqj56yyvBbdRMZMIUEBAjvB42MbC20prRGEQXUDdsNm6Fg4EIzg6AF9Y6KvIkF2xv0SjRuykZgUgqbVzdyYd6al27jojTx_99By3Xqn6y17Furm6l_7Vi2F32CuKMxnocUQr_xxEYz9mW7Ah4nrmPthu7zZvQPbd-w6vfk-hBlii_9Y-4VQF_oNtq-4_R05ObC09FuuZjKi16a31OVr_SXbYn721WUPd-RevcqnRg2PhUzv8xxNzDwtusbewM4tkRKwEBp0cVp1vvcyvAUxqj-QHBl3_1cd-aQFUBuPWF9UNBCB2H4Js7wXL9y7Jl-JWU86AF_xsMrGtdltdd-7-XfFpoxBlsAoktMmZ97HJa1Dog3hiShkFpqncFAqX8opgFLddgVrFq1Q4xNG2cW58pZVU8jM8R9P_W0R9pHjvcHpDMDt9LtcFDpGJR0u8un9YnVGuV_1WKtOOIy2V-5VWBOP9ps63Gkpfsrut3YPwCI6_JvJcrz4HoM7SdYzMsAkf_-TVRXq-J_FsochbKm0qNFAorteHxgPRj3jVFSVtzkL3ZN0t7W4ArE8mpjOBT7vys30W4zCmWyq4hJYNI-ubetN_mXCy5uhnE8j-_VdGwOWSw6wUPWoC-qii4G25UUhJYEH4bvjAfi69MmMyMx9JusTrSoFbUM130fvY8OiZhFUW4CORlCKI5b5X4o9QAvGI-drLNzNgMw6r8EKHi49Rcf3MmJht9Sb8trQnYHIDwJgdeyas1Lew391YyY6KP2eFBLBwGJc
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H2 200 pixel.gif
px.moatads.com/ Frame E22D 43 B
267 B 27ms
27ms Image
image/gif 184.51.10.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&ra=1&pxm=7&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=PTARMIGANMEDIA1&ol=1078484734&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CA%24%3D!!tmx%5Dh3MIJy%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3CPnKMV%25%3C%2Cbq.%22oDOk%2Cz%25GY&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-IhpMhkIJ33QxUrdGk7NYu%2BFfHV3eib89DkRB2436S0SxzRtAIyeo1MnKlpdMQlJdIBr9&rs=1-Z9pXKgt%2BRfoJWg%3D%3D&sc=1&os=1-3w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1180&qe=300&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&h=177&w=220&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.benefitspro.com%2F2018%2F07%2F26%2F401k-truth-bomb-missing-participants-are-bad-but-4%2F%3Futm_campaign%3DCashout%20Leakage%20Email%20Blast%26utm_medium%3Demail%26_hsmi%3D227288517%26_hsenc%3Dp2ANqtz-_AKFxTfkpjM9qFCDR7nCfPFQ2eZviHXSUckYqe6g4zNbA2S1MImkgHASOteybMsm8SYGahVLbVom3ZwtVxQ9O8o1c6OQ%26utm_content%3D227288517%26utm_source%3Dhs_email%26slreturn%3D20220827122713&id=1&ii=1&f=1&j=https%3A%2F%2Fwww.benefitspro.com&lp=https%3A%2F%2Fwww.benefitspro.com&t=1664296036817&de=239682608401&cu=1664296036817&m=5390&ar=220b545db30-clean&iw=afc65d6&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=300&le=1&gm=1&io=1&fa=1&vv=3&vw=0%3A3%3A0&vp=0&vx=-%3A0%3A-&pe=0%3A-%3A-%3A1228%3A538&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5184&cd=26&ah=5184&am=26&xd=00&rf=0&re=1&wb=1&wm=1&wi=0&zMoatCustomParams=50%25%3A3000sec%3Acumulative&cl=0&at=0&d=27452628%3A1405503%3A346325825%3A178207315&bd=benefitspro.com&bo=benefitspro.com&gw=ptarmiganmediadcm677757797954&zMoatOrigSlicer1=1405503&zMoatOrigSlicer2=346325825&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=2&tc=0&fs=200409&na=1092480673&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.10.56 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-10-56.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dianomi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 27 Sep 2022 16:27:22 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 27 Sep 2022 16:27:22 GMT

GET
H2 200 01837fc6262f0017beb4e9e9d0a103074015806c00b08 Show response
visitor-service-eu-central-1.tealiumiq.com/alm/main/ 958 B
1 KB 24ms
24ms Script
application/javascript 18.195.240.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor-service-eu-central-1.tealiumiq.com/alm/main/01837fc6262f0017beb4e9e9d0a103074015806c00b08?callback=utag.ut%5B%22writevamain%22%5D&rnd=1664296042265

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/alm/main/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.195.240.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-195-240-254.eu-central-1.compute.amazonaws.com

Software

Resource Hash

a5ee5e404cb663432691d7064b854dd20f9ff2b535d136d412dd39b45e814c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitspro.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-version: b0f40a8afca5e49acee901e7a2d5fa49565f3e17-SNAPSHOT
date: Tue, 27 Sep 2022 16:27:22 GMT
x-region: eu-central-1
content-length: 958
strict-transport-security: max-age=31536000; includeSubdomains
x-nodeid: i-03b6f41ad66ef5ba4
content-type: application/javascript; charset=utf-8

Verdicts & Comments Add Verdict or Comment

209 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

59 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mail.rch1.com/	1970-01-20 06:18:17	Name: __cf_bm Value: _IPo8rj._l4WgwmVuF2aablnsXHlkiq5sXpnkvGh3dY-1664296033-0-Af2L2YlIVFHmIxw/Dl/ik+84WOpA8bBUWFnPZE+HzOeQZLOvKp9HM2EBtA30JEMUsZOtmFmqQQ563KLQMyf4YmA=
.mail.rch1.com/	1969-12-31 23:59:59	Name: __cfruid Value: 0e2684e0dccb367ca2cbd2351c3f1282c7811c44-1664296033
www.benefitspro.com/	1970-01-20 06:18:16	Name: NSC_wbsojti!5_ttm_10.0.254.204 Value: ffffffff0908e00a45525d5f4f58455e445a4a423660
store.law.com/	1970-01-20 06:18:19	Name: regSID Value: 4a6a1029-f3da-490f-97c1-383ff28b2be6
.law.com/	1970-01-20 06:18:59	Name: ipAddress Value: 5lE7acFUCIoqomMxsE8%3d
.law.com/	1970-01-20 15:54:16	Name: UCID Value: a969d66b-4175-4b67-9659-1fcd5518b19a
store.law.com/	1970-01-20 06:18:59	Name: CSRFToken Value: hRIUm_Mvrg3LSHoBWi1kM0Bdx7vwxuf91TaaVGj2ANM
.law.com/	1970-01-20 06:18:59	Name: ActiveDomains Value: pBFiNZNKRN518Ctp9A1S1wWAYig5
store.benefitspro.com/	1970-01-20 06:18:19	Name: regSID Value: 37553959-65fb-4a6c-b114-3f3b4b0510ad
.benefitspro.com/	1970-01-20 06:18:59	Name: ipAddress Value: 5lI%2facFUCIkupGMxt0o%3d
.benefitspro.com/	1970-01-20 15:54:16	Name: UCID Value: 93056d35-f9d2-49bf-8c38-a35b5e189ca4
www.benefitspro.com/	1970-01-20 15:03:52	Name: ssoCompliant Value:
.benefitspro.com/	1969-12-31 23:59:59	Name: hbx_lt Value: none
.demdex.net/	1970-01-20 10:37:28	Name: demdex Value: 26753440018087468940501124730123369998
.benefitspro.com/	1969-12-31 23:59:59	Name: AMCVS_96C4370453295E4C0A490D44%40AdobeOrg Value: 1
.tealiumiq.com/	1970-01-20 15:03:52	Name: TAPID Value: alm/main>01837fc6262f0017beb4e9e9d0a103074015806c00b08\|
www.benefitspro.com/	1970-01-20 06:18:17	Name: sailthru_pageviews Value: 2
.benefitspro.com/	1970-01-20 15:03:52	Name: utag_main Value: v_id:01837fc6262f0017beb4e9e9d0a103074015806c00b08$_sn:1$_ss:1$_pn:1%3Bexp-session$_st:1664297835887$ses_id:1664296035887%3Bexp-session$vapi_domain:benefitspro.com$dcsyncran:1%3Bexp-session$_prevpage:bpro%3Ajump%3Ahef45jlgfk%3Bexp-1664299636097$dc_visit:1$dc_event:1%3Bexp-session$dc_region:eu-central-1%3Bexp-session
.benefitspro.com/	1970-01-20 15:47:04	Name: _cb Value: CxmG4wCoKYLcDXngDe
.benefitspro.com/	1970-01-20 15:47:04	Name: _chartbeat2 Value: .1664296036281.1664296036281.1.BRoLjNC2jurR3ztrqDo0KxC1JJ1_.1
.benefitspro.com/	1970-01-20 06:18:17	Name: _cb_svref Value: null
.doubleclick.net/	1970-01-20 15:39:52	Name: IDE Value: AHWqTUnRAeBNmgieMC7QRHHmu0QCg8Nu19tQAJIvh9NqfHx7JtDHtaDLHPDj_RRsX98
.tealiumiq.com/	1970-01-20 10:40:20	Name: tcs.google_gid Value: eyJhbG0vbWFpbiI6IkNBRVNFR1g1SWNvMm9kcGM3bjdsMHQ2X3p3Y3wxNjY0Mjk2MDM2NDQ3In0=
.tealiumiq.com/	1970-01-20 10:40:20	Name: tcs.google_cver Value: eyJhbG0vbWFpbiI6IjF8MTY2NDI5NjAzNjQ0NyJ9
.linkedin.com/	1970-01-20 07:01:28	Name: UserMatchHistory Value: AQKjtMQRhFqqFQAAAYN_xihL-b8T4xsDZWQC5S1Ps94QRxz-gHw2fML9FMq3cRd8zQTG4IZqmMhXGg
.linkedin.com/	1970-01-20 07:01:28	Name: AnalyticsSyncHistory Value: AQJs-vF0S0YEowAAAYN_xihLlxfGQ8cpzphrVsn9OanIb8vq_J8w0JnIdJ_Jwg2P5d6NOQJx6U8FbVhhFVA81w
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 15:03:52	Name: bcookie Value: "v=2&4550c112-859b-4b56-8af8-25de0ad4bbb8"
.linkedin.com/	1970-01-20 06:19:42	Name: lidc Value: "b=VGST07:s=V:r=V:a=V:p=V:g=2458:u=1:x=1:i=1664296036:t=1664382436:v=2:sig=AQGUYpn_WZb5pOktcPlX5UMHTsLvkNsM"
.everesttech.net/	1970-01-20 15:03:52	Name: everest_g_v2 Value: g_surferid~YzMkZAAAAHpbswOJ
.t.co/	1970-01-20 15:54:16	Name: muc_ads Value: c056033f-aae1-4206-9106-9a4d348481a5
.benefitspro.com/	1970-01-20 08:27:52	Name: _fbp Value: fb.1.1664296036485.1881697625
.dpm.demdex.net/	1970-01-20 10:37:28	Name: dpm Value: 26753440018087468940501124730123369998
.twitter.com/	1970-01-20 15:54:16	Name: guest_id_marketing Value: v1%3A166429603657623150
.twitter.com/	1970-01-20 15:54:16	Name: guest_id_ads Value: v1%3A166429603657623150
.twitter.com/	1970-01-20 15:54:16	Name: personalization_id Value: "v1_qoD9behCJ1b/1x+HAxYeOw=="
.twitter.com/	1970-01-20 15:54:16	Name: guest_id Value: v1%3A166429603657623150
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 15:03:52	Name: bscookie Value: "v=1&20220927162716ab639fab-7508-4874-83fa-29408eb93a49AQHe77rFOMcwzGkDjEFqYr4vZimee7_p"
.linkedin.com/	1970-01-20 10:37:28	Name: li_gc Value: MTswOzE2NjQyOTYwMzY7MjswMjFnwFC2kPZEUzu4pRLYwqdmcA25H9pYbfYt2InosdLnFg==
.benefitspro.com/	1970-01-20 06:18:17	Name: s_pers Value: %20qpv_v40%3Dbpro%253Ajump%253Ahef45jlgfk%7C1664297836805%3B
.benefitspro.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.benefitspro.com/	1970-01-20 06:18:17	Name: __cf_bm Value: 0P4phovb0v14b0qrUTCRMNSARjzLo17epkzT6dysmJA-1664296036-0-AYZGWxZxO607Et7+qHmaFSVeAnDCyHWZ8VaTRE6qg/+15YFXwjODxY6cHdnfkashRd4fOeQ0znaQgEr6tuUjzr67pxDuSgYo/SQKNXQ4/KUbaqPnx7ntuRuWWDpSqXb3Wg==
www.benefitspro.com/	1970-01-20 06:19:42	Name: almGeoLoc2 Value: DE
.benefitspro.com/	1970-01-20 15:39:52	Name: __gads Value: ID=daee77e2cc198c05-226f321033ce009e:T=1664296036:S=ALNI_MY3n7DeFTu08Ls-6kMcP6WoWqu7IQ
.benefitspro.com/	1970-01-20 15:54:16	Name: AMCV_96C4370453295E4C0A490D44%40AdobeOrg Value: -1303530583%7CMCIDTS%7C19263%7CMCMID%7C31256028685216173580627335461199589454%7CMCAAMLH-1664900836%7C6%7CMCAAMB-1664900836%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1664303236s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19270%7CvVersion%7C3.3.0
www.benefitspro.com/	1970-01-20 07:01:28	Name: _pbjs_userid_consent_data Value: 3524755945110770
.benefitspro.com/	1970-01-20 15:03:52	Name: _pubcid Value: de53d35d-0de3-400c-973a-a5be8aadfa7f
www.benefitspro.com/	1970-01-20 15:03:52	Name: sailthru_content Value: 08d666716c997721f2ac1cdd0969c6e2
www.benefitspro.com/	1970-01-20 15:03:52	Name: sailthru_visitor Value: 77bcd0ae-fa19-45e8-a032-9773584ba3fb
.pardot.com/	1970-01-20 15:54:16	Name: visitor_id997701 Value: 2991780
.pardot.com/	1970-01-20 15:54:16	Name: visitor_id997701-hash Value: b5495599caa0b2354d1b9077b431fef0bd418c711d26bf69ba1882ce52c39d3e2a1eb7dda968d4bb8153503a45e6670b487da121
pi.pardot.com/	1970-01-20 06:18:17	Name: lpv997701 Value: aHR0cHM6Ly93d3cuYmVuZWZpdHNwcm8uY29tLzIwMTgvMDcvMjYvNDAxay10cnV0aC1ib21iLW1pc3NpbmctcGFydGljaXBhbnRzLWFyZS1iYWQtYnV0LTQvP3V0bV9jYW1wYWlnbj1DYXNob3V0JTIwTGVha2FnZSUyMEVtYWlsJTIwQmxhc3QmdXRtX21lZGl1bT1lbWFpbCZfaHNtaT0yMjcyODg1MTcmX2hzZW5jPXAyQU5xdHotX0FLRnhUZmtwak05cUZDRFI3bkNmUEZRMmVadmlIWFNVY2tZcWU2ZzR6TmJBMlMxTUlta2dIQVNPdGV5Yk1zbThTWUdhaFZMYlZvbTNad3RWeFE5TzhvMWM2T1EmdXRtX2NvbnRlbnQ9MjI3Mjg4NTE3JnV0bV9zb3VyY2U9aHNfZW1haWwmc2xyZXR1cm49MjAyMjA4MjcxMjI3MTM%3D
www.benefitspro.com/	1970-01-20 15:54:16	Name: visitor_id997701 Value: 2991780
www.benefitspro.com/	1970-01-20 15:54:16	Name: visitor_id997701-hash Value: b5495599caa0b2354d1b9077b431fef0bd418c711d26bf69ba1882ce52c39d3e2a1eb7dda968d4bb8153503a45e6670b487da121
.doubleclick.net/	1970-01-20 06:18:19	Name: DSID Value: NO_DATA
go.alm.com/	1970-01-20 15:54:16	Name: visitor_id997701 Value: 2991780
go.alm.com/	1970-01-20 15:54:16	Name: visitor_id997701-hash Value: b5495599caa0b2354d1b9077b431fef0bd418c711d26bf69ba1882ce52c39d3e2a1eb7dda968d4bb8153503a45e6670b487da121
.benefitspro.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_campaign%3Demail%253Ahs_email%253ACashout%2520Leakage%2520Email%2520Blast%253A227288517%3B%20s_evar50%3D412-68327%3B%20s_prop50%3D412-68327%3B%20s_ppvl%3Dbpro%25253Ajump%25253Ahef45jlgfk%252C27%252C27%252C1200%252C1600%252C1200%252C1600%252C1200%252C1%252CP%3B%20s_ppv%3Dbpro%25253Ajump%25253Ahef45jlgfk%252C21%252C21%252C1200%252C1600%252C1200%252C1600%252C1200%252C1%252CP%3B

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://z.moatads.com/ptarmiganmediadcm677757797954/moatad.js(Line 137) Message: The deviceorientation events are blocked by permissions policy. See https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
other	warning	URL: https://cdn.ampproject.org/rtv/012209072154000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://cdn.ampproject.org/rtv/012209072154000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://cdn.ampproject.org/rtv/012209072154000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://cdn.ampproject.org/rtv/012209072154000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=3628800

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.ad.gt
aa66ca644bf800eb55046400a2fef300.safeframe.googlesyndication.com
ad.doubleclick.net
adservice.google.com
adservice.google.de
ajax.googleapis.com
ak.sail-horizon.com
alm.demdex.net
analytics.twitter.com
api.sail-personalize.com
api.sail-track.com
b.law.com
cdn.ampproject.org
cdnjs.cloudflare.com
cm.everesttech.net
cm.g.doubleclick.net
collect.tealiumiq.com
connect.facebook.net
datacloud.tealiumiq.com
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
geoip.alm.com
ghb.adtelligent.com
ghb.hbmp.mediafuse.com
go.alm.com
googleads.g.doubleclick.net
images.benefitspro.com
imageserver.amlaw.com
in.ml314.com
mail.rch1.com
mb.moatads.com
ml314.com
p.safeservingcdn.com
p.typekit.net
pagead2.googlesyndication.com
pi.pardot.com
ping.chartbeat.net
pixel.adsafeprotected.com
player.adtelligent.com
player.hbmp.mediafuse.com
player.mediafuse.com
px.ads.linkedin.com
px.moatads.com
px4.ads.linkedin.com
s.dpmsrv.com
securepubads.g.doubleclick.net
snap.licdn.com
static.ads-twitter.com
static.adsafeprotected.com
static.chartbeat.com
store.benefitspro.com
store.law.com
t.co
tags.tiqcdn.com
telemetries.jeeng.com
tpc.googlesyndication.com
use.typekit.net
users.api.jeeng.com
vi.ml314.com
visitor-service-eu-central-1.tealiumiq.com
www.benefitspro.com
www.dianomi.com
www.facebook.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
z.moatads.com
104.18.22.230
104.244.42.197
104.244.42.67
104.75.88.194
13.107.42.14
13.32.99.47
142.251.39.34
15.188.95.229
172.217.18.6
18.135.121.86
18.185.150.186
18.195.240.254
18.208.125.13
18.66.112.103
184.51.10.56
192.226.82.212
192.226.85.63
199.232.16.157
2600:9000:223c:aa00:18:1fcd:351:7bc1
2600:9000:223f:fc00:8:48e:53c0:93a1
2606:2c40::c73c:671d
2606:4700:10::6816:39ae
2606:4700:10::ac43:264e
2606:4700:4400::6812:22b2
2606:4700:4400::6812:2a67
2606:4700:4400::ac40:9199
2606:4700::6811:180e
2620:1ec:21::14
2a00:1450:4001:806::2001
2a00:1450:4001:810::200a
2a00:1450:4001:811::2002
2a00:1450:4001:811::2004
2a00:1450:4001:812::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2002
2a00:1450:4001:831::2001
2a00:1450:400d:807::2002
2a00:1450:400d:80a::2003
2a00:1450:400d:80e::2002
2a00:1450:400d:80e::2008
2a00:1450:400d:80e::200a
2a02:26f0:11a::6867:4851
2a02:26f0:3500:16::215:1495
2a02:26f0:3500:16::215:149b
2a03:2880:f007:8:face:b00c:0:1
2a03:2880:f12d:83:face:b00c:0:25de
2a0c:5c81:5142::2
3.215.172.219
34.111.234.236
34.200.39.142
34.248.32.199
35.201.104.135
35.86.50.147
45.133.44.3
45.133.44.4
52.19.103.22
52.210.26.59
52.51.170.224
52.73.151.3
99.83.154.140
99.83.218.184
00670f0a62630d8ff7db4a0625c290372edaf14aeb32c0f91266ef8dfefb9c7a
00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674
01e9a6b83eabe383b954ff2ea312241161d6f422cca61b6531dd247028facd32
03e1225b90e549f09a646fb67b309a4d9e4681dc7ffaba5b5c48f41bff9f4e9b
04a185d67f6ead753be77d3ed23364e4bd28e21168628df5a8ea26f0a1f54de8
04bcbf22aed03a8ea72525562e6a2c181a6781c856bf5208f4399a98cf54f02f
075e1a285de33ad2c3cc75f3ebe775feb23d27f52aa8213be408e4cbc3623a10
09b1709f8bfc41f82e066e046669c0c0fdd373848b61835646675c946d841ba5
0a86d39730d3798075d6bedace543e73f10b66cd2461a649a6c7dcabbe945c99
0adce7288d8695bd58abcf6c721fc5b33f1f1ffba1cd69477e4a93bea0c767e5
0b96e2d8daef004fa73380c29b23a4c7f9c790c75a1c9f538859de1fcfbae895
10805a6cf60990b0d11d410fc39683e48f6027b361d5171cf9595c7552b72ffe
10f63eeedd48638d7707b27efcf4982dbaa287241cc35b1a893fec1a9d8ffda0
111ac61e627008261e23043c5e6b486035f0b123b1963e2fa8671e188eb33829
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1308a0343bcbd5d5884604cac2081ad65b01676b88b629cc32ddf187e795e4ef
165d4b32d383de13418ead461a6f1414d9ad6e2358aa43cf42cfb72d47880374
1be06778698a2eb16ae1c7152d7256350580f4a21fc43c5ef4218407135b0896
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1d6e66eb994a8253ca0a8a6a200fd07b4786cdd906c40db17830103fcc095005
1fb24161c35dc226c53499352c66a31214c21320ac654dcebe15e0bfc6c8d370
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27d7b573de36acef9ddbf975de05251f5219d2e4b8424288aae62aa57d5a6396
29348abc23c216c553b4e83c0dfa24a90dc78488492247ffdc344bf9cf31eccc
2aff5614a231508d127ef71ee9cfeb2a3d24a42ae8aff6dd09305a822b480f1b
2d192c4ee2e44a7a8bf37c10896fac2c8ad41624f0c0f02afa356736b63af97f
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
300706e57de1a7af148bd670379c4b39bb36dda8160e42d92747a3139af37816
300908cbcb84903590648db1851fcb3c493af3aaab47d4109e0a9f8394e06fd7
30de911f70fbfdee70d5159b61cab8149251740e97dcbded177b534ceec6284a
344242d12af607f2e9967ff04eb21789036bb15901876e16f4ca3ab437f2918f
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3a4c0f0893bad70607f0e186bf6d11b186d2a0ec524fb1c0e4e82896e9eeb9ae
3a663467e111fd2237a1bc5255e8d702b099f29cb553ecab24efe98cbf898b5d
3b91e6a4b14493d67f9660e6d4a2e27c1eea54d97ccb7c30acf3b89998b3be99
3c2a4e30e5f3f4d4b6816d0b64b4906d588f2139ad1182fc97bdf4e60afedc3d
3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa
3e30806436b2b0815faeb6b71f1739f57a53edc401d1170185801359530a5a65
3e4b10bddcd2040b7e0c34a9f5680a64e0ee44c8e00259dfaa60ba1739effb88
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
44627ca08835c910fc06544ca0c8e6fa716a5ccca48399837a8cc2a484a28861
448d142e55babc15245b6e6f371ced227ec95816d1a101bbbfb38a01e265d0ca
44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e
47395347833919b1b83bb90b7487da0d9213502fb8f18af28230b9c4a199affa
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4a9aa397a58f4c3850dae4677e23131d94e41c8e2fda04f5b4cd87747b6ea2ed
4b2c4cddc369e8c521eabe08f086ec6a2b8a7ad0360036348ff01c9b16775b8b
4d06bad352253c257e71e3f33c77726263394c5fd650cf671e9aab4055aa11e8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
527d0808216e24ce838e14ffd686947cd4a8719fd9562a21412ed08c8ac14614
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
582f1b5d33e54e95557255c97d79a90d3fda73d7b2b105695446fe643eb737cc
5a02d8eef54e76a16a95b2325079d0f55222cecc927a60bac1de8e2a8c0257af
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5a553da7ecb0174521c8c80f6b8d97a001481235b5a97cb0c270fc9ffe59a747
5de5e170b84a68fa9f0245e82c53b8a8566a228585e3299eabac2379459060a9
607150d742ffb67d983e9bd23ab87e0d436f68776c67898c57db306319840cb5
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62a1f9d4a70121359493d87cfb029bf3202ba37f0dfdf85bf98a4dc3a64c7335
63c54e1a7365643d41619441accc66105de41c9820a3a041cc115bf1b71a91d0
659982ff5dc4222a830703646062215bbd21a2fb13e4cc2833461e7718ce2565
6bb1b5fd0cb586f7c2922717b4247e513c65a7dc866aea813ef3a274e669503d
6bd36ce04facff41ab5b774dfea1f83253f21d8dbff16037c6f310f07607a787
6c00f268685b8a576d1307fab673f36330a258b36d1d4afb50232c01ca2a388f
6c1d8bd967ed66a65e2faaccba7797dc2a104c8a55183ab0b6aa0a5d47b746cd
6c3da4325cff4886cf47c4508feb32e8741976f7e17ef057114d155d6eb2cb9d
6d87a928de8f7380756fda6383301985d7cd1505c6946541db65c0c22b200e27
70503c92bcbb8105d95ec4de2012f23098c3383586e95323e4b3384b56af4beb
74017d97a0876e72ef09a14ea0b3ad49a744811c726e7b05e305d4a6e3e07612
75732e13ba7ccb55a10f0bda7c3cbf5725f5c913f8d0803523eb92a168e22b31
7666b06b5069d4ff364b52c8b78fd0ac7b02f86c1503292d5af8ade288249d1d
7a695d75ed5265fb2f07d7f73e41ffe4acea9b5c5f6573294038d5ef560a0086
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7d07e8a81e67c0fa6399678409e4c4c5c2ca450f0ed95de9fde52226accf485e
7f7e94e4b2ce4850a5fd141c45be20cf976db7c651dc580e4c8ecb3570124319
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
81c4cbefa26738bb911ba5b534beff1abaadb10ba99df0ada0da3b12d1e37249
835ac542d299d08372d37230b5d648d57463e77bc2fa3f9bee611abea9646ff7
866e71a2b55fed66fc8ef10d5bab0716a5e31ea4d129f233321503dd04c31bdb
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
89bf8cdea73ce776d6b81d03837bc7f04af5e3946b839a3c0bfbf3094ad3f7be
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8ac56a77fa125a4c6576925c1263c6c17076eb7a07e3280dc3fe0781fe1a2289
8db8ec3d4d6ad571f545cf51a31f642b123471ba744388f3cbd2c60b0afa4ee7
8e6725acd3b6b64558610f04824916460d5e26b028d757bbb013be3bf9a013a5
9398dd93c612d77b9e0bcfe449becc1a5269af74409cbab1ae485c49d5bf3b9b
93a22a0e7b076844df8bbc2d01d9d50b6f46412cb41ccd7fbf053467778dedab
94d3dc2f8019650f33f4d269cbbd70b5726efda4f2d95d7e44eefa3dde5071d4
999b37529edf4d7b34cf4bdcd937594e893a1d3add9811102f7818936b8d4293
9b10871e0ed40a6467305847c09ef8549757ff13707f168d2ca3025659baa5ac
9b77f08b1a04c909c48a7f0f3b3e300f0e6f6abe667a19c513fedf67c19fa2a1
9b99ce50d05750058143cb93936075ad5107f9a3e5b03f2d4872c0ebe753a9f7
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9dde752a0a83f77379ff94d7560a636796ff3bd448d4d0c54965795f356858d8
9dffbd45ce48bf5e8eeb90b3d8567f8270f217c174de81fe3693d6dcdbaa1588
9fc52b69d2882e0acffb922952c4143ba451645879bdb7df3419a4df65946494
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2544b35317df6156ed8dd3cec802785526182131888e0b2274667c4aef1dd4c
a2b997da567762896061490c3c08e506b2e5b936978560fc12251dd245140b32
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a328c21fadc1b4b4353c004aa511351033cbf4e6b80314ba95fda8c2657c9d19
a34377483ff3aa917edd6efc5adef60b169de3b576b2dce9627b22f0392059b7
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ee5e404cb663432691d7064b854dd20f9ff2b535d136d412dd39b45e814c62
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a8236998816487aa6623e3626d7cd50f395e3deee0732c33b150bec3cb81f9a3
a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940
ab720224c1548ed676ca1a6e9f2ecbb3d92fe43ab4e573de9246e48f440a4636
ab9b0ceb64dafe908478125fc1e61e975f0945e2b1ae99f0163baba84f789b3b
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acfc56af11023640161a7fa7c0932bb736f482736b38cb1e5adf7ca835b809b5
adedde7f7b41ccb00053be543804ebd24a479d4b57329ea8a3590c14d3f569eb
b14b41bd4ca0bc20bec20a6a2b845e6c162fd541b4c576d329bdba5f747bca08
b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b6ab91cf3c1ce9246885f3bfaac69706096cd170b60b6fd5bee1bd7b441806fb
b72ea1062b7bb84439787a3341bbd692b4074493f1e618d3780cad3271c22494
bb8efee9807c0bc0f5f1f9e550d07ef797eaf6dab36eeee50df57e3ece7802bd
bc27706dd92ab740e0277d6af91b0add4e7fe8628607594085b41a763ff1e466
bd05d9d820c56ab5c2e2da93da473cd02013b8fff06c92aec1ca00f35808b572
bfa7bbadab025152b98292c2a09edf2525533d79c6371d44d69fde48ec7773de
c11dd239decc5aabc20c4d2e655c6bd40d9cb1d8c64e15d3c69a525e2fc94a00
c25aad21e410b837b04e08e1bb2f54ef9887585cd46a894c8fc00e8e2dcb45a1
c868ea5adf14b93b7db936b4a5aa1400cdcf744baaf01faf1ecc402f2775dbfc
c874c9a3e2757790076e34bd49db931eb7484e6347877192f649429cf3f6e3e6
cd9216308f7433d319f912cfc029861f0176f0d0af13c57338d291f757fb01de
cd983ac133b21cb30a726eb5b49fff32eaadd7f79165c677fc52e2efcac5ff41
cdd8e0a30a99d13b654e9e5bd236cf4c8423d13f3a5917da3e46cdacb199af76
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0a76ec36613caaf91abaf681db7c469c02d7941647eb683409cdd21b7b1169e
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d35b5fd65497ae8d66b6e52bbad869c48bf379174ab0175f10e5d760741cbdcd
d3f5d2edb1d7efe3e24417b3a48999d2090f8b7cab6a0f773e4075b33122de03
d3fff52cc9de72fca07dd6bd4704e1294eca19f13a7514e35814ebbb555c4047
d5c88c41788ede7b85e5e87e5b8e086d79fbe6ff67ea3c74ffba76835bba466a
d62f9c89984ad059d574ae6b64c9134628041695c09290643e2d53238638bdda
d6b6d81cfbd49fe1bd0236efeaa240acafdc559910819197df94983926f84d22
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
d848076aad575c2b1b4840797552f3fe1535c58154453c09d3f7b742b522c14f
d95fd234da61a7dd771d7c8ae4eb877ee599ea56235575851aca171b9608cb7b
dcb909d8da8e85b813c1e2a770b48044df9a1a626b5a245e957b4ccd6bb1b14c
dcf430710cdd1359115293f45d5023b2a560aef8a2c1e59d578b8b1e10a216d3
dd22c52347ad42343ca4c6fa76a783715312f1f4a35e97f937611a5b26aa2354
df690f011f9fd617ca22376522eef3c1a90c33cf3f8f10f5dfb4751ac26a202b
e036d4c0bab9dcd3d8ed9d625c2cdd24f4d0474f1a4232f0e7c9471aaf0cf470
e1da4cb13c17887992e744ef305c0a018b16d96a568701918fd589d279de04a3
e35cef0b65277dfb6604bec11e6e65e6bab5bb16b16f5a4612795da3e20ff718
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b9d52f002201be697fbc0ebf4bdcc61d6c01d0bb1359213e62c67e21850047
e3ff4085e5a0b672837450c65e5b0c42fa7407d5095dc2c6f59a221c8942302f
e45722ddb7174f1a972804b4d1c6478989b42fcd5007461cbea87b30bca3e9c3
e63a692c6e4153e3611cca55f723b3396b0170c0a114e1a01beefe24a846e96e
e6e4f2361d88da42b9bf37a0155cf6bae4389dbfb64b5887373381ee16f13836
e85633178fa1dfc5ed1506b0a48709ab9a277b84d55de98ad7dc27d96a7ac38a
ea2aabc260813ff4aa25957cde8d45addf81848c6084364bfa2d69e85e4d525f
edbb5500bfb83c3a7fbc17bcaf6c7ea20e6ea057963bdcc5885725e3126bed2e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef19a301dbbc0dd7331e3fc24a7a094a7c577ecf1458994ff93b8e97ec12d611
efff01c62418d6f4467c02e31f8c01ec7c4459e9310654f6dcbc30120a385209
f3599c62e7f19c9428aa0622e6eae0cd2726d6569f4a1349045cba7da5a12768
f4377bb1002fddeb2c271f9fb55b9ec1eca9d385aa5906d30cbdb1bb858c950e
f4fb2954bc2129533ffd10d39909549ad56a10907252158460e91642a8066221
f6347d41155a6f8afdd5d4a9d73c48de7fadb7389db91a493bf0aa68f3be033b
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fba4888caca4f8a5ca041a427025b229b0da593c3d478a3b4a51effef5963aae
fc76428cad5c36631113a653d30ef85dbcfe672934b13630f4fdd2c1f1403f58
fd3d957f38ee564d0cf89af1cdf6ce46dbe0c228bfb65bd4720445db5fefcf9f
fda987a7db536b15976cb373bfcf7fb437f76ce9fd6cab676d58ede1e8c046cf
ffb50d904db44b3985dc1b402000ee05d09a5df0b83e3cf9296ca30286807714

www.benefitspro.com Open in urlscan Pro 2606:4700:4400::ac40:9199 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

256 Requests

93 %HTTPS

48 %IPv6

43 Domains

70 Subdomains

57 IPs

7 Countries

3215 kBTransfer

8205 kBSize

59 Cookies

24 Outgoing links

Page URL History

Redirected requests

256 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.benefitspro.com Open in urlscan Pro
2606:4700:4400::ac40:9199 Public Scan

Screenshot
Live screenshot

Full Image

256
Requests

93 %
HTTPS

48 %
IPv6

43
Domains

70
Subdomains

57
IPs

7
Countries

3215 kB
Transfer

8205 kB
Size

59
Cookies

256 HTTP transactions
12 data transactions