urlscan.io logo urlscan.io
SecurityTrails logo

newenrollmentplans.com Open in urlscan Pro
2606:4700:3032::6815:2483  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://forwardbonuses.com/
Effective URL: https://newenrollmentplans.com/
Submission: On March 18 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 1 countries across 11 domains to perform 35 HTTP transactions. The main IP is 2606:4700:3032::6815:2483, located in United States and belongs to CLOUDFLARENET, US. The main domain is newenrollmentplans.com.
TLS certificate: Issued by GTS CA 1P5 on January 28th 2024. Valid for: 3 months.
This is the only time newenrollmentplans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

8    2606:4700:3031::6815:54c7 (United States)

ASN13335 (CLOUDFLARENET, US)
forwardbonuses.com
1    2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    2607:f8b0:4006:821::200a (United States)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
6    2606:4700:3032::6815:2483 (United States)

ASN13335 (CLOUDFLARENET, US)
newenrollmentplans.com
1    2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    2606:4700:10::6816:26b6 (United States)

ASN13335 (CLOUDFLARENET, US)
create.lidstatic.com
2    2607:f8b0:4006:809::200a (United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
3    2607:f8b0:4006:80d::2003 (United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
4    3.234.77.222 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-234-77-222.compute-1.amazonaws.com
create.leadid.com
1    18.164.115.171 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-115-171.jfk50.r.cloudfront.net
d2m2wsoho8qq12.cloudfront.net
1    2600:9000:24f0:f400:4:1957:6500:93a1 (United States)

ASN16509 (AMAZON-02, US)
b-js.ringba.com
1    54.210.139.207 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-210-139-207.compute-1.amazonaws.com
display.ringba.com
3    45.223.17.68 (United States)

ASN19551 (INCAPSULA, US)
deviceid.trueleadid.com
Apex Domain
Subdomains		 Transfer
8 forwardbonuses.com
forwardbonuses.com
284 KB
6 newenrollmentplans.com
newenrollmentplans.com
204 KB
4 leadid.com
create.leadid.com — Cisco Umbrella Rank: 20248 Failed
2 KB
3 trueleadid.com
deviceid.trueleadid.com — Cisco Umbrella Rank: 26076
23 KB
3 gstatic.com
fonts.gstatic.com
79 KB
3 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 716
fonts.googleapis.com — Cisco Umbrella Rank: 110
34 KB
2 ringba.com
b-js.ringba.com — Cisco Umbrella Rank: 337902
display.ringba.com — Cisco Umbrella Rank: 280953
14 KB
2 lidstatic.com
create.lidstatic.com — Cisco Umbrella Rank: 30424
76 KB
1 cloudfront.net
d2m2wsoho8qq12.cloudfront.net
2 KB
1 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 251
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 437
1 KB
35 11
Domain Requested by
8 forwardbonuses.com forwardbonuses.com
6 newenrollmentplans.com forwardbonuses.com
newenrollmentplans.com
4 create.leadid.com create.lidstatic.com
deviceid.trueleadid.com
3 deviceid.trueleadid.com d2m2wsoho8qq12.cloudfront.net
deviceid.trueleadid.com
3 fonts.gstatic.com fonts.googleapis.com
2 fonts.googleapis.com newenrollmentplans.com
2 create.lidstatic.com forwardbonuses.com
1 display.ringba.com b-js.ringba.com
1 b-js.ringba.com forwardbonuses.com
1 d2m2wsoho8qq12.cloudfront.net create.lidstatic.com
1 connect.facebook.net forwardbonuses.com
1 ajax.googleapis.com forwardbonuses.com
1 cdn.jsdelivr.net forwardbonuses.com
35 13

This site contains no links.

Subject Issuer Validity Valid
forwardbonuses.com
GTS CA 1P5		 2024-03-15 -
2024-06-13		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2024-02-19 -
2024-05-13		 3 months crt.sh
newenrollmentplans.com
GTS CA 1P5		 2024-01-28 -
2024-04-27		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-12-27 -
2024-03-26		 3 months crt.sh
lidstatic.com
E1		 2024-01-28 -
2024-04-27		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2024-02-19 -
2024-05-13		 3 months crt.sh
create.leadid.com
Amazon RSA 2048 M02		 2023-08-21 -
2024-09-17		 a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2023-10-10 -
2024-09-19		 a year crt.sh
*.ringba.com
Amazon RSA 2048 M03		 2023-11-27 -
2024-12-23		 a year crt.sh
imperva.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1		 2024-01-16 -
2024-07-14		 6 months crt.sh

This page contains 3 frames:

Primary Page: https://newenrollmentplans.com/
Frame ID: D143D8F822BBE06681BF230E6C8E9417
Requests: 30 HTTP requests in this frame

Frame: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Frame ID: 1D15BA9CFBB4ED72FBE2E48D59DE7E4B
Requests: 1 HTTP requests in this frame

Frame: https://deviceid.trueleadid.com/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Frame ID: C55D4DB99B32481FC499ED2C58155636
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

MyObamacareRates

Page URL History Show full URLs

  1. https://forwardbonuses.com/ Page URL
  2. https://newenrollmentplans.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • /_Incapsula_Resource
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

35
Requests

97 %
HTTPS

69 %
IPv6

11
Domains

13
Subdomains

14
IPs

1
Countries

720 kB
Transfer

1385 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://forwardbonuses.com/ Page URL
  2. https://newenrollmentplans.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

35 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
forwardbonuses.com/ 		12 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:54c7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
b391333c8d611f86ebf92302f9bac7466195e6345571a61095fa4ce0bcb0b574

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
max-age=2678400
cf-cache-status
EXPIRED
cf-ray
8667c5c31a4e4c1e-MIA
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 18 Mar 2024 19:54:04 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NbGHhwlhqFM9LDF5L3Aip0WY7upoU7nf%2B45B08ySedUrCjp7cnAbZUQvXYxTIM8lGUWAl1%2B0XXFmSHzxN2FFR9LXcIk%2BnC%2FP1S7hWSkw0kt4GVx7DCHgRST4hRQ8rkX%2Bsy3vRpEEtYhy8LgnbHtQBsg%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
Express
styles.css
forwardbonuses.com/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://forwardbonuses.com/css/styles.css
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:54c7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
5b55ba15933b862ad5fce7557c17c148e36588f0ae5df964870ebb68ecfb4d5b

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"cc7-0BVp0OtNDeJHWINhMMBNEiO/+eE"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qxqKi%2FraFJl2EGFoGETO%2B8nEb9y4Xb%2Ffo5by0ktF1jOIBrxHszmuUpRptHlnvQXVc8pweopdbxysagY1rTZsSvm4giZq%2F6puxmNYTiSpuZeXEeBBiEn3wE5J9P9ZGyNuHJhFVmBW4oBd%2Bur2rVaAzRM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2678400
cf-ray
8667c5c45c304c1e-MIA
alt-svc
h3=":443"; ma=86400
modern-normalize.min.css
cdn.jsdelivr.net/npm/modern-normalize@v1.1.0/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/modern-normalize@v1.1.0/modern-normalize.min.css
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
50c30c4f7d265efc35ab0f988b901448212281d385f1162c5f716651174e07ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 18 Mar 2024 19:54:04 GMT
x-content-type-options
nosniff
content-encoding
br
age
2144889
x-jsd-version
1.1.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
990
x-served-by
cache-fra-etou8220066-FRA, cache-mia-kmia1760093-MIA
x-jsd-version-type
version
etag
W/"6d6-5Ui059LAhvAsqMJUdMTuvNgsnrc"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
logo.webp
forwardbonuses.com/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forwardbonuses.com/images/logo.webp
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:54c7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
0001aaeb9d257978c8985c0295c76f031200f806848b6b5f5704e78fd9eb8535

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"d74-isOCM8wMElmdoyyRc3sIdeNp/UA"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=saAyEWUVwL3nK%2Fuvtki2WjX34zokr6pqu675F5HA4mFSiDQ0vKC4D8hBrJ0Ai4oDYmj2oHHD3wiPJdQ5FWBxGtiuat5Z5b1zpu3BWFDM8dAaXy2O03oSTOzx1aqG5%2F0mNvttxcy4bqWzr4%2FqDFQBw8c%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
8667c5c45c334c1e-MIA
alt-svc
h3=":443"; ma=86400
content-length
3444
5800.png
forwardbonuses.com/images/ 		266 KB
267 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://forwardbonuses.com/images/5800.png
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:54c7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
2472338e71304ce46d6fb406cfb2ae6d0fe7b7d2bdb686161315b709a4ed8881

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"42944-fGSPdJdOQ88J7djD4mToETEQr7A"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zWcprceFwFn0fUQi9j1%2Bx879amGplCRbnHM03VHwIPXHyewnXiqwmxm5mCGDHSBlXUBbX5qFoEkKVXmoH3yQuRdIF7xHErh3COeTNIMOWSU%2FA25U40nOhUlxfmAWMpe0VeqDf4K0BbQWSAei8R%2B6Uo8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
8667c5c45c364c1e-MIA
alt-svc
h3=":443"; ma=86400
content-length
272708
rocket-loader.min.js
forwardbonuses.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://forwardbonuses.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:54c7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 Mar 2024 18:07:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65f099fc-302c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2FMmLDQt8Y%2Bog3KD%2FXpiDbR3pkPQaR7XFN2V1TZyoak86WfT8oE4NMSHXfwkmz9fnuWeS%2Fyl376SmILkNRng7m0XtcKkaUPAUr%2BnjHkEPqwsz72xn77%2BisBnsgY9%2B53wiiRkNEB2Xh5RTA7KBTRv1w0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
8667c5c45c374c1e-MIA
expires
Wed, 20 Mar 2024 19:54:04 GMT
absf_v1.0_references.js
forwardbonuses.com/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://forwardbonuses.com/js/absf_v1.0_references.js
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:54c7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
bbf002f36f21f1bc1b79d3af13f60fc0fac252b74d7a71a4ed9bfda049ba64a2

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"751-7PFU5ABo8VUYzOu1bTIeTx+VFFU"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bTCuMWt1wpyQXWF9rVE0O8AQsKeLUV28GFCwaFygGSxBwJ%2BiQpbaoEppOvtWaFCtM%2FmSQ5dEHq7p0U%2F3bpgcmH28kyITO65nnHyAVgjgl5D3ENJaFvLPDKGg%2Bd1kPom8I1yFbXpQnz5ymdrPQZOA54c%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2678400
cf-ray
8667c5c59dd26da9-MIA
alt-svc
h3=":443"; ma=86400
loader.js
forwardbonuses.com/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://forwardbonuses.com/js/loader.js
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:54c7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
32a1d58daea29c795ad97537d27590c283f7d580604ac5e93ba0fb222592575b

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"c21-sONBW4GRChIYn5vpG8iGMKU2X9I"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oRBoKLJbhgdmQySLoLlfSgKqh3MEUOZJ0gCUt3Gh2TzUXsiO%2Bp1XAWLFn37dY4skn7Q2Somi%2FLeG%2F5NH6HyIHs8nBCBtMna6FJ814jTZqMAR6mEPP0nSqX%2FIDiQA%2F8AAcieiHwPXeBytN4BwVIvWySI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2678400
cf-ray
8667c5c59dd36da9-MIA
alt-svc
h3=":443"; ma=86400
countdown.js
forwardbonuses.com/js/ 		504 B
753 B 		Script
General
Check archive.org
Download Go to
Full URL
https://forwardbonuses.com/js/countdown.js
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:54c7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
0e47b1350cf329c793437da7e12c09f395d65726a80d9a7f35b6a0db85a896d9

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"1f8-AUvfoIdMQ1X6qJRAcf5vy5+Y7Vg"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eE6n22ooHjRuLrf3A1sbbVRikQ30MrpFZ8oDNIe8kjx4ByAJAa72C0XWex%2BCFDyUXKvLr9B6CwnC%2Bpv6VVE38pyjzCAUzmlvguoBgyFob2LP01H5%2BqPhtliMzTlaP%2BhtPGd4kfumxNTp4xViw2ouH%2Fo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2678400
cf-ray
8667c5c59dd66da9-MIA
alt-svc
h3=":443"; ma=86400
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 15:55:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
14334
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31017
x-xss-protection
0
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 18 Mar 2025 15:55:11 GMT
Primary Request /
newenrollmentplans.com/ 		23 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://newenrollmentplans.com/
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/js/absf_v1.0_references.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2483 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
6f25cf2c778fce6aabecdc48fcd0830e42251abf53ec32c74e98618767590495

Request headers

Referer
https://forwardbonuses.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
max-age=2678400
cf-cache-status
EXPIRED
cf-ray
8667c5c7fe45370a-MIA
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 18 Mar 2024 19:54:05 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7nAQpoXpUERrLYbSrE3Mir5MpevYuhuxEzitVUencFHG80LAd3rXPKtAIb%2B1C51mD11JAexyC0FQtsSeAKEm%2F8cHcCaeuRIcXf8RgG9eCSmhUItg4BUoGVib%2FcXUxTQDQpW%2BJ0dZ5iQgSmSg6LoSbbCtSlwV"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
Express
fbevents.js
connect.facebook.net/en_US/ 		65 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

content-security-policy
default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Mon, 18 Mar 2024 19:54:05 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
57659
x-xss-protection
0
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality
GOOD; q=0.7, rtt=63, rtx=0, c=12, mss=1294, tbw=2773, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma
public
x-fb-debug
vHfFBg7xIrx7s6WU23j7o/TVrXYbDLeGK99+v/5dFg+DPw3K8XEAsuVprnWub9SkDoYBsbUEU37OvZALil4IZg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
vary
Accept-Encoding
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type
application/x-javascript; charset=utf-8
x-frame-options
DENY
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
a57816b4-6c59-f397-7853-7e14e45d3e1b.js
create.lidstatic.com/campaign/ 		121 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:26b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
https://forwardbonuses.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
x-amz-version-id
0TYZIhZnCiJDj1Gzr_aWxHS1MWCxaYWH
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
K7GFAZ6PS02JGDRS
age
1057
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-id-2
naHmjZEDdE1bQ/TtJT+dhVadmv02WV/Ov5wsKEUxYEAPgI4d1WgJrFgc02Y7kEJKN3TgJjSQ2B7YOkfePN8b5oNXjmbmlol/v00QZmCMYW4=
last-modified
Thu, 18 Jan 2024 02:21:13 GMT
server
cloudflare
etag
W/"bc138804ddd94411bd78fba4df4e96b0"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=1800
cf-ray
8667c5c7f83931de-MIA
GenerateToken
create.leadid.com/2.12.1/ 		0
0
bootstrap.min.css
newenrollmentplans.com/css/ 		158 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://newenrollmentplans.com/css/bootstrap.min.css
Requested by
Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2483 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72

Request headers

Referer
https://newenrollmentplans.com/
Origin
https://newenrollmentplans.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"279d8-G+N7YjBsjAxndbtMk8XkxOE9l3U"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2zSenJpuhMj%2B%2FxpHs%2BYjDGbRDV5pQFbu5aj6Zme%2BVI6MsjzXtLTiyKp1XUM%2Fr9Xo0%2B%2BOnM2fRgq1s8gl1UsjJjjgsy%2FbiRJMDtheWXMnCYEz0Edxkn3wLkXte9gjYeuA77DSRHGixrt8FVipmk0j6c4HWnUw"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2678400
cf-ray
8667c5c93fb8370a-MIA
alt-svc
h3=":443"; ma=86400
css
fonts.googleapis.com/ 		9 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap
Requested by
Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
80b51eb98df76e4f9d7dd4e13ee821497cdb52835b67b74defb5a723b3ea13b6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://newenrollmentplans.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 18 Mar 2024 19:54:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 18 Mar 2024 19:54:05 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 18 Mar 2024 19:54:05 GMT
css2
fonts.googleapis.com/ 		23 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap
Requested by
Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:809::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2edca8c7b268ea2c28f1c0163a70761b07268cab6b11386456cfdcd4759cdf1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://newenrollmentplans.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 18 Mar 2024 19:54:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 18 Mar 2024 19:54:05 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 18 Mar 2024 19:54:05 GMT
logo.png
newenrollmentplans.com/images/ 		114 KB
114 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://newenrollmentplans.com/images/logo.png
Requested by
Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2483 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
d1854f2659dc32e24936df4a715d520ba3b2d3da5b03a3fe84d5904446bbb20a

Request headers

accept-language
en-US,en;q=0.9
Referer
https://newenrollmentplans.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"1c760-KNQWKKlfM4e9HIFYB5aik573NbA"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zea8ROMcU7wod0l2bnRxG3GLRJZq9RFtyEqS9r4uQ13zcMePbJzwPgojDnEMOvB45ZMQBo2Y9mQKFPRs81XKqmU%2BeI8z9y4N3Z5%2FnbwEgctpZ4La%2FGvu9U6GXTYJsG8f7%2BJNTYHR2s4vn%2FzqQdJcaN50mcW7"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
8667c5c93fbb370a-MIA
alt-svc
h3=":443"; ma=86400
content-length
116576
image.jpg
newenrollmentplans.com/images/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://newenrollmentplans.com/images/image.jpg
Requested by
Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2483 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
f70a1c4355672de33b4f6af28f01121e969e9ac38365905c7ba6b4701a054792

Request headers

accept-language
en-US,en;q=0.9
Referer
https://newenrollmentplans.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"7a46-zYQ/YRN1YIvI9yrQhgtF7UwkqkI"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4hoW9%2FGCbPGVSn7i40hiUrBhH14jvXM7tumdaTcy3BqEEL8pdnUJV6%2FNq9C0NXa84%2FLTVnLIA3Fl7mwCY7nYpoJYR6L%2BplmwDd5uANSypWhhidBCDY%2FDaXW7gPcvbKiiIwt8Eiq%2F1Kpglzy3lwEa3hoCqXet"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
8667c5c93fbd370a-MIA
alt-svc
h3=":443"; ma=86400
content-length
31302
rocket-loader.min.js
newenrollmentplans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://newenrollmentplans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2483 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-US,en;q=0.9
Referer
https://newenrollmentplans.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 Mar 2024 18:07:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65f099fc-302c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HNcYPxflMva7zjCcw8v4NlNlJ9CUsm%2Fx2TSAQAWaDw0ckezLjIpeV9JsuiA5tqO%2BKTC5PrrGKRRLQPaeR%2F0vbuLxnZgt6D9%2FYzuM5a305fm1Rgnt9fbycOivILbEoDjkljS8Z7lbhG%2BBOlHv16NyHmBSz25v"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
8667c5c94fd5370a-MIA
expires
Wed, 20 Mar 2024 19:54:05 GMT
bootstrap.bundle.min.js
newenrollmentplans.com/js/ 		79 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://newenrollmentplans.com/js/bootstrap.bundle.min.js
Requested by
Host: newenrollmentplans.com
URL: https://newenrollmentplans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:2483 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
9520018fa5d81f4e4dc9d06afb576f90cbbaba209cfcc6cb60e1464647f7890b

Request headers

Referer
https://newenrollmentplans.com/
Origin
https://newenrollmentplans.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:06 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
Express
etag
W/"13a24-kNFQNu9I/LM2oTW66BK0VmnxkEQ"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HDdlFEQVe4yEk3%2Bf06djXmtsfZAAnuNPusitAEbAY4zsbezzujwi02fNA8%2BXjL9FWtEnqeSPPrj6t0cWXDJVhmaNI5mkmXoiHPv%2F3qF5r6rhIevvI27m2wpmumBBSUDthLWpPvQg3TJaEMEuDJCfTmbhy81I"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=2678400
cf-ray
8667c5cb3ad6dae9-MIA
alt-svc
h3=":443"; ma=86400
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 		47 KB
48 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://newenrollmentplans.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 13 Mar 2024 06:27:15 GMT
x-content-type-options
nosniff
age
480411
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48236
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Mar 2025 06:27:15 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://newenrollmentplans.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 13 Mar 2024 08:56:32 GMT
x-content-type-options
nosniff
age
471454
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Mar 2025 08:56:32 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://newenrollmentplans.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Wed, 13 Mar 2024 08:52:30 GMT
x-content-type-options
nosniff
age
471696
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Mar 2025 08:52:30 GMT
a57816b4-6c59-f397-7853-7e14e45d3e1b.js
create.lidstatic.com/campaign/ 		121 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:26b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9947cbb5ca79a84719954ea34e03988bb27ea30bb57d9cb4ff3783c84564d0a5

Request headers

accept-language
en-US,en;q=0.9
Referer
https://newenrollmentplans.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:06 GMT
x-amz-version-id
0TYZIhZnCiJDj1Gzr_aWxHS1MWCxaYWH
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
K7GFAZ6PS02JGDRS
age
1058
x-amz-server-side-encryption
AES256
x-amz-replication-status
COMPLETED
x-amz-id-2
naHmjZEDdE1bQ/TtJT+dhVadmv02WV/Ov5wsKEUxYEAPgI4d1WgJrFgc02Y7kEJKN3TgJjSQ2B7YOkfePN8b5oNXjmbmlol/v00QZmCMYW4=
last-modified
Thu, 18 Jan 2024 02:21:13 GMT
server
cloudflare
etag
W/"bc138804ddd94411bd78fba4df4e96b0"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=1800
cf-ray
8667c5cd5a1931de-MIA
GenerateToken
create.leadid.com/2.12.1/ 		36 B
658 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://create.leadid.com/2.12.1/GenerateToken?msn=1&pid=74b2c06b-77af-4fd0-a570-b9a85cc1fbd6&_=31144764
Requested by
Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.234.77.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-234-77-222.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f9bcecc34269b167007b9e604306da6e8ebd208d1b5befee50e85c7e275f1d38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://newenrollmentplans.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Mon, 18 Mar 2024 19:54:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
nginx
access-control-max-age
1728000
content-type
text/plain;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
access-control-allow-headers
X-Requested-With, Content-Type
expires
Sat, 26 Jul 1997 05:00:00 GMT
iframe.html
d2m2wsoho8qq12.cloudfront.net/ Frame 1D15 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Requested by
Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.164.115.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-115-171.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://newenrollmentplans.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Access-Control-Allow-Headers
*
Access-Control-Allow-Origin
*
Age
41074
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Mon, 18 Mar 2024 08:30:39 GMT
Etag
W/"65a0715c-dbb"
Last-Modified
Thu, 11 Jan 2024 22:53:16 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Transfer-Encoding
chunked
Via
1.1 931eba134e92940e6c080405fee84c64.cloudfront.net (CloudFront)
X-Amz-Cf-Id
D-z1hN4h8_SzLofXk82CsVShM7Fzp492RZqrhw84HaPuqf1yI1OekQ==
X-Amz-Cf-Pop
JFK50-P6
X-Cache
Hit from cloudfront
SaveDom
create.leadid.com/2.12.1/ 		0
623 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://create.leadid.com/2.12.1/SaveDom?msn=2&pid=74b2c06b-77af-4fd0-a570-b9a85cc1fbd6&token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&_=31144765
Requested by
Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.234.77.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-234-77-222.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://newenrollmentplans.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Mon, 18 Mar 2024 19:54:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
nginx
access-control-max-age
1728000
content-type
text/plain;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
access-control-allow-headers
X-Requested-With, Content-Type
expires
Sat, 26 Jul 1997 05:00:00 GMT
CA3efe1122f0fc479bb67e286818ec6966
b-js.ringba.com/ 		13 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b-js.ringba.com/CA3efe1122f0fc479bb67e286818ec6966
Requested by
Host: forwardbonuses.com
URL: https://forwardbonuses.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:24f0:f400:4:1957:6500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
fa5c959317c14a9a13cde4e8d0766334da1c2c34f24701af99f0959d193ae87a

Request headers

accept-language
en-US,en;q=0.9
Referer
https://newenrollmentplans.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-runtime
0.0000
date
Mon, 18 Mar 2024 19:54:06 GMT
via
1.1 ed8dbde89917eaa6ca93ba7fad809c48.cloudfront.net (CloudFront)
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-amz-cf-pop
JFK50-P3
x-powered-by
ASP.NET
access-control-max-age
300
x-cache
Miss from cloudfront
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
public
content-length
13212
x-amz-cf-id
Y6wsE9EWl3U43sSVoLF0d9BTHQLEnXkXzSxTLsT3yogFbCI73EkAOA==
expires
Mon, 18 Mar 2024 19:59:06 GMT
Snap
create.leadid.com/2.12.1/ 		0
623 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://create.leadid.com/2.12.1/Snap?msn=3&pid=74b2c06b-77af-4fd0-a570-b9a85cc1fbd6&token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&_=31144766
Requested by
Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.234.77.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-234-77-222.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://newenrollmentplans.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Mon, 18 Mar 2024 19:54:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
nginx
access-control-max-age
1728000
content-type
text/plain;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
access-control-allow-headers
X-Requested-With, Content-Type
expires
Sat, 26 Jul 1997 05:00:00 GMT
gnbulk
display.ringba.com/v2/nis/ 		402 B
795 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://display.ringba.com/v2/nis/gnbulk
Requested by
Host: b-js.ringba.com
URL: https://b-js.ringba.com/CA3efe1122f0fc479bb67e286818ec6966
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.210.139.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-210-139-207.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
fdd11cac83fdaa83ca46cc315b46825d5e3758283842cad85196ee3d0ca1017d

Request headers

Referer
https://newenrollmentplans.com/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 18 Mar 2024 19:54:06 GMT
X-Runtime
0.0030
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Access-Control-Max-Age
300
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://newenrollmentplans.com
Cache-Control
no-cache
Connection
keep-alive
Content-Length
402
Expires
-1
iframe.html
deviceid.trueleadid.com/ Frame C55D 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://deviceid.trueleadid.com/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Requested by
Host: d2m2wsoho8qq12.cloudfront.net
URL: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.223.17.68 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx /
Resource Hash
5ec367de9bb900460ac5aa6548f77af36c7fa06b8532383f62cd8c9f7cdf0698
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://d2m2wsoho8qq12.cloudfront.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
max-age=86400 public
content-encoding
gzip
content-type
text/html
date
Mon, 18 Mar 2024 19:54:07 GMT
etag
W/"6554d155-1049"
expires
Tue, 19 Mar 2024 19:54:07 GMT
last-modified
Wed, 15 Nov 2023 14:10:29 GMT
p3p
CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
server
nginx
strict-transport-security
max-age=31536000
x-cdn
Imperva
x-iinfo
4-1172484-1131710 pNNy RT(1710791646842 36) q(0 0 0 0) r(1 1) U24
x-incap-sess-cookie-hdr
7XryClrr+jz+4flsq7QUA96b+GUAAAAABgJdIVUI8QvrhgJU/7sJ0w==
_Incapsula_Resource
deviceid.trueleadid.com/ Frame C55D 		140 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://deviceid.trueleadid.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=177333026
Requested by
Host: deviceid.trueleadid.com
URL: https://deviceid.trueleadid.com/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.223.17.68 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
018d3b6b7f9faffd34a4f17d0a932c0cce92ce057424df897692c30d3e16c835
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://deviceid.trueleadid.com/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
cache-control
no-cache, no-store
content-encoding
gzip
x-robots-tag
noindex
content-length
20500
content-type
application/javascript
SaveDeviceId.js
create.leadid.com/2.12.1/ Frame C55D 		0
627 B 		Script
General
Check archive.org
Download Go to
Full URL
https://create.leadid.com/2.12.1/SaveDeviceId.js?lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&methods=48&token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&uuid=a2f4cf775ffb420abf427bd575ef600e
Requested by
Host: deviceid.trueleadid.com
URL: https://deviceid.trueleadid.com/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.234.77.222 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-234-77-222.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-US,en;q=0.9
Referer
https://deviceid.trueleadid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 18 Mar 2024 19:54:07 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
nginx
access-control-max-age
1728000
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
access-control-allow-headers
X-Requested-With, Content-Type
expires
Sat, 26 Jul 1997 05:00:00 GMT
_Incapsula_Resource
deviceid.trueleadid.com/ Frame C55D 		1 B
36 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://deviceid.trueleadid.com/_Incapsula_Resource?SWKMTFSR=1&e=0.5433854467719175
Requested by
Host: deviceid.trueleadid.com
URL: https://deviceid.trueleadid.com/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.223.17.68 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://deviceid.trueleadid.com/iframe.html?token=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
1
content-type
text/plain

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
create.leadid.com
URL
https://create.leadid.com/2.12.1/GenerateToken?msn=1&pid=c9e0958e-ed8c-48ac-8c68-270480fa6fe8&_=333115032

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| __cfQR function| getQueryParams function| addToQueryString number| uidEvent object| bootstrap function| survey1 function| survey2 function| survey3 function| result boolean| __cfRLUnblockHandlers object| LeadiDconfig object| LeadiD object| defaultStyleFrame object| ringba_known_numbers object| _rgba object| ringba object| _rgba_tags

5 Cookies

Domain/Path Name / Value
newenrollmentplans.com/ Name: leadid_token-F252983F-4BD1-0DD8-CD81-F4700AF60B66-A57816B4-6C59-F397-7853-7E14E45D3E1B
Value: 4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
.trueleadid.com/ Name: nlbi_3051494
Value: N4cwRyxZZxXkyA+MC30iGwAAAACOBv4wul+QraHij1hoYXKh
.trueleadid.com/ Name: visid_incap_3051494
Value: 61Iro3h9TWea0C+fU3sI5t6b+GUAAAAAQUIPAAAAAAC1QUKin7vv/GJ5CnaABAF6
.trueleadid.com/ Name: incap_ses_222_3051494
Value: v7CsV2NIEzn+4flsq7QUA96b+GUAAAAASStSBScl+HT4fZTzXbP99g==
.deviceid.trueleadid.com/ Name: uuid
Value: a2f4cf775ffb420abf427bd575ef600e

14 Console Messages

Source Level URL
Text
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://newenrollmentplans.com/?leadid=4BC4BDA0-DDA5-0BEB-9CFB-9E43DC00C538
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
b-js.ringba.com
cdn.jsdelivr.net
connect.facebook.net
create.leadid.com
create.lidstatic.com
d2m2wsoho8qq12.cloudfront.net
deviceid.trueleadid.com
display.ringba.com
fonts.googleapis.com
fonts.gstatic.com
forwardbonuses.com
newenrollmentplans.com
create.leadid.com
18.164.115.171
2600:9000:24f0:f400:4:1957:6500:93a1
2606:4700:10::6816:26b6
2606:4700:3031::6815:54c7
2606:4700:3032::6815:2483
2607:f8b0:4006:809::200a
2607:f8b0:4006:80d::2003
2607:f8b0:4006:821::200a
2a03:2880:f012:10c:face:b00c:0:3
2a04:4e42:600::485
3.234.77.222
45.223.17.68
54.210.139.207
0001aaeb9d257978c8985c0295c76f031200f806848b6b5f5704e78fd9eb8535
018d3b6b7f9faffd34a4f17d0a932c0cce92ce057424df897692c30d3e16c835
0e47b1350cf329c793437da7e12c09f395d65726a80d9a7f35b6a0db85a896d9
2472338e71304ce46d6fb406cfb2ae6d0fe7b7d2bdb686161315b709a4ed8881
2edca8c7b268ea2c28f1c0163a70761b07268cab6b11386456cfdcd4759cdf1d
32a1d58daea29c795ad97537d27590c283f7d580604ac5e93ba0fb222592575b
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
50c30c4f7d265efc35ab0f988b901448212281d385f1162c5f716651174e07ff
5b55ba15933b862ad5fce7557c17c148e36588f0ae5df964870ebb68ecfb4d5b
5ec367de9bb900460ac5aa6548f77af36c7fa06b8532383f62cd8c9f7cdf0698
6f25cf2c778fce6aabecdc48fcd0830e42251abf53ec32c74e98618767590495
80b51eb98df76e4f9d7dd4e13ee821497cdb52835b67b74defb5a723b3ea13b6
9520018fa5d81f4e4dc9d06afb576f90cbbaba209cfcc6cb60e1464647f7890b
9947cbb5ca79a84719954ea34e03988bb27ea30bb57d9cb4ff3783c84564d0a5
b391333c8d611f86ebf92302f9bac7466195e6345571a61095fa4ce0bcb0b574
bbf002f36f21f1bc1b79d3af13f60fc0fac252b74d7a71a4ed9bfda049ba64a2
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d1854f2659dc32e24936df4a715d520ba3b2d3da5b03a3fe84d5904446bbb20a
e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f70a1c4355672de33b4f6af28f01121e969e9ac38365905c7ba6b4701a054792
f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72
f9bcecc34269b167007b9e604306da6e8ebd208d1b5befee50e85c7e275f1d38
fa5c959317c14a9a13cde4e8d0766334da1c2c34f24701af99f0959d193ae87a
fdd11cac83fdaa83ca46cc315b46825d5e3758283842cad85196ee3d0ca1017d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e