refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:d2b Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://url.us.m.mimecastprotect.com/s/AHPlClYmElF22gPPvFGRI1j?domain=t.co
Effective URL:
https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everf...
Submission: On July 03 via api (July 3rd 2024, 8:39:12 pm UTC) from US — Scanned from US

Summary HTTP 150 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 50 IPs in 2 countries across 45 domains to perform 150 HTTP transactions. The main IP is 2606:4700::6812:d2b, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 565031.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 22nd 2023. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	205.139.111.12 205.139.111.12	30031 (MIMECAST-) (MIMECAST-)
1	72.21.81.130 72.21.81.130	15133 (EDGECAST) (EDGECAST)
1	2607:f8b0:400... 2607:f8b0:400d:c0e::cf	15169 (GOOGLE) (GOOGLE)
1 2	192.3.45.74 192.3.45.74	36352 (AS-COLOCR...) (AS-COLOCROSSING)
2 2	18.232.203.164 18.232.203.164	14618 (AMAZON-AES) (AMAZON-AES)
1 1	18.210.69.85 18.210.69.85	14618 (AMAZON-AES) (AMAZON-AES)
1 3	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7	2606:4700::68... 2606:4700::6812:d2b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.173.219.101 18.173.219.101	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6812:c2b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:1408:ec0... 2600:1408:ec00:886::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.164.124.56 18.164.124.56	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2606:4700:303... 2606:4700:3036::ac43:b89e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:400d:c0f::5f	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:1ef5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	52.206.87.211 52.206.87.211	14618 (AMAZON-AES) (AMAZON-AES)
1	108.138.129.160 108.138.129.160	16509 (AMAZON-02) (AMAZON-02)
15	2607:f8b0:400... 2607:f8b0:400d:c04::61	15169 (GOOGLE) (GOOGLE)
1	18.164.124.33 18.164.124.33	16509 (AMAZON-02) (AMAZON-02)
2 4	2606:4700:440... 2606:4700:4400::6812:2412	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6 7	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
2 2	68.67.160.184 68.67.160.184	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	69.173.146.5 69.173.146.5	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	104.36.113.107 104.36.113.107	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	35.211.178.172 35.211.178.172	19527 (GOOGLE-2) (GOOGLE-2)
1	3.209.149.25 3.209.149.25	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.39.9 63.140.39.9	14618 (AMAZON-AES) (AMAZON-AES)
3	2001:4860:480... 2001:4860:4802:34::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c04::9c	15169 (GOOGLE) (GOOGLE)
2	2600:1408:ec0... 2600:1408:ec00:289::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	15.204.44.87 15.204.44.87	16276 (OVH) (OVH)
1	2600:9000:23c... 2600:9000:23cb:0:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	173.194.66.157 173.194.66.157	15169 (GOOGLE) (GOOGLE)
10	151.101.65.44 151.101.65.44	54113 (FASTLY) (FASTLY)
6	2600:1f18:24e... 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1	14618 (AMAZON-AES) (AMAZON-AES)
1	3.163.245.4 3.163.245.4	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:251... 2600:9000:2514:8200:a:8e7d:9900:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2606:4700:1::... 2606:4700:1::6813:854c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:400d:c00::5e	15169 (GOOGLE) (GOOGLE)
2	54.205.80.0 54.205.80.0	14618 (AMAZON-AES) (AMAZON-AES)
2 2	74.125.192.156 74.125.192.156	15169 (GOOGLE) (GOOGLE)
1 2	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	63.140.39.130 63.140.39.130	14618 (AMAZON-AES) (AMAZON-AES)
2	3.216.97.11 3.216.97.11	14618 (AMAZON-AES) (AMAZON-AES)
9	2a04:4e42:400... 2a04:4e42:400::300	54113 (FASTLY) (FASTLY)
2	2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
4	23.62.168.244 23.62.168.244	16625 (AKAMAI-AS) (AKAMAI-AS)
2	51.81.49.47 51.81.49.47	16276 (OVH) (OVH)
1 1	2600:1f18:730... 2600:1f18:730:b110:ad0a:6457:c7a4:96de	14618 (AMAZON-AES) (AMAZON-AES)
1	52.201.12.52 52.201.12.52	14618 (AMAZON-AES) (AMAZON-AES)
5	35.190.43.134 35.190.43.134	15169 (GOOGLE) (GOOGLE)
1	108.139.29.79 108.139.29.79	16509 (AMAZON-02) (AMAZON-02)
12	2607:f8b0:400... 2607:f8b0:400d:c03::9d	15169 (GOOGLE) (GOOGLE)
12	2607:f8b0:400... 2607:f8b0:400d:c00::93	15169 (GOOGLE) (GOOGLE)
2	107.21.125.170 107.21.125.170	14618 (AMAZON-AES) (AMAZON-AES)
150	50

2 205.139.111.12 (United States) 2 redirects

ASN30031 (MIMECAST-, US)
PTR: us-api.mimecast.com

url.us.m.mimecastprotect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.21.81.130 (United States)

ASN15133 (EDGECAST, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c0e::cf (Morganton, United States)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.3.45.74 (Buffalo, United States) 1 redirects

ASN36352 (AS-COLOCROSSING, US)
PTR: annical.net

zourir.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.232.203.164 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-232-203-164.compute-1.amazonaws.com

trkmrk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.210.69.85 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-210-69-85.compute-1.amazonaws.com

trkfocus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.76.131 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6812:d2b (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.219.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-219-101.jfk52.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:c2b (United States)

ASN13335 (CLOUDFLARENET, US)

trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:ec00:886::1e80 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.164.124.56 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-124-56.jfk50.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:3036::ac43:b89e (United States)

ASN13335 (CLOUDFLARENET, US)

fonts.cdnfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c0f::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1ef5 (United States)

ASN13335 (CLOUDFLARENET, US)

content.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.206.87.211 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-206-87-211.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.129.160 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-129-160.jfk50.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2607:f8b0:400d:c04::61 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.164.124.33 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-124-33.jfk50.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:4400::6812:2412 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

action.dstillery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
action.media6degrees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.223.40.198 (United States) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.184 (Colonia, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.146.5 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.36.113.107 (United States) 1 redirects

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.211.178.172 (North Charleston, United States) 2 redirects

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.209.149.25 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-209-149-25.compute-1.amazonaws.com

quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.9 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-9.data.adobedc.net

somni.rocketmortgage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:34::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c04::9c (Morganton, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1408:ec00:289::1931 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.204.44.87 (Hillsboro, United States)

ASN16276 (OVH, FR)
PTR: ext.sor126.incmdb.net

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23cb:0:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.66.157 (United States)

ASN15169 (GOOGLE, US)
PTR: qo-in-f157.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.65.44 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

rum-http-intake.logs.datadoghq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.163.245.4 (United States)

ASN16509 (AMAZON-02, US)

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2514:8200:a:8e7d:9900:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.pmsrv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:1::6813:854c (United States)

ASN13335 (CLOUDFLARENET, US)

a.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c00::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.205.80.0 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-80-0.compute-1.amazonaws.com

script.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.192.156 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: qn-in-f156.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.36.155 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.130 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-130.data.adobedc.net

adobedc.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.216.97.11 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-216-97-11.compute-1.amazonaws.com

psp.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a04:4e42:400::300 (United States)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.62.168.244 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-168-244.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.81.49.47 (United States)

ASN16276 (OVH, FR)
PTR: ext.svh331.incmdb.net

pix.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b110:ad0a:6457:c7a4:96de (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.201.12.52 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-201-12-52.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.190.43.134 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 134.43.190.35.bc.googleusercontent.com

tr.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tr6.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.29.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-79.jfk50.r.cloudfront.net

ads.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2607:f8b0:400d:c03::9d (Morganton, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2607:f8b0:400d:c00::93 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.21.125.170 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-107-21-125-170.compute-1.amazonaws.com

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 844 trc.taboola.com — Cisco Umbrella Rank: 711	24 KB
15	doubleclick.net 2 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 136 cm.g.doubleclick.net — Cisco Umbrella Rank: 274 googleads.g.doubleclick.net — Cisco Umbrella Rank: 70	21 KB
15	google.com analytics.google.com — Cisco Umbrella Rank: 174 www.google.com — Cisco Umbrella Rank: 5	1 KB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 81	1 MB
13	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 565031 static-msql-prod.refinance.quickenloans.com trackpixel.refinance.quickenloans.com content.refinance.quickenloans.com cdn.mortgage.quickenloans.com Failed	372 KB
7	adsrvr.org 6 redirects insight.adsrvr.org — Cisco Umbrella Rank: 1062 match.adsrvr.org — Cisco Umbrella Rank: 405	4 KB
6	datadoghq.com rum-http-intake.logs.datadoghq.com — Cisco Umbrella Rank: 9470
6	cdnfonts.com fonts.cdnfonts.com — Cisco Umbrella Rank: 10133	184 KB
6	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 6938 psp.pushnami.com — Cisco Umbrella Rank: 23242 trc.pushnami.com — Cisco Umbrella Rank: 6710	19 KB
5	snapchat.com tr.snapchat.com — Cisco Umbrella Rank: 938 tr6.snapchat.com — Cisco Umbrella Rank: 1283	758 B
5	googleapis.com storage.googleapis.com — Cisco Umbrella Rank: 434 fonts.googleapis.com — Cisco Umbrella Rank: 83	3 KB
4	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 913	4 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 242 quicken.demdex.net — Cisco Umbrella Rank: 103986 adobedc.demdex.net — Cisco Umbrella Rank: 7021	3 KB
3	anura.io script.anura.io — Cisco Umbrella Rank: 59643 ads.anura.io — Cisco Umbrella Rank: 76170	23 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 361	14 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 4229 rp.liadm.com — Cisco Umbrella Rank: 1242 rp4.liadm.com — Cisco Umbrella Rank: 5750	37 KB
3	revjet.com ads.revjet.com — Cisco Umbrella Rank: 7400 pix.revjet.com — Cisco Umbrella Rank: 6947	9 KB
3	lmbahsj2.com 1 redirects www.lmbahsj2.com — Cisco Umbrella Rank: 991110	20 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 114	4 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 682	1 KB
2	mgid.com a.mgid.com — Cisco Umbrella Rank: 12834	6 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 204	71 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 1130	25 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 394	1 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 279	2 KB
2	media6degrees.com action.media6degrees.com — Cisco Umbrella Rank: 11881	948 B
2	dstillery.com 2 redirects action.dstillery.com — Cisco Umbrella Rank: 10230	317 B
2	trkmrk.com 2 redirects trkmrk.com	951 B
2	zourir.com 1 redirects zourir.com	961 B
2	mimecastprotect.com 2 redirects url.us.m.mimecastprotect.com — Cisco Umbrella Rank: 12631	3 KB
1	gstatic.com fonts.gstatic.com	33 KB
1	pmsrv.co c.pmsrv.co — Cisco Umbrella Rank: 101294	4 KB
1	sc-static.net sc-static.net — Cisco Umbrella Rank: 1274	21 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 133	21 KB
1	rocketmortgage.com somni.rocketmortgage.com — Cisco Umbrella Rank: 115447	471 B
1	pubmatic.com 1 redirects simage2.pubmatic.com — Cisco Umbrella Rank: 918	483 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 432	2 KB
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1543	37 KB
1	lowermybills.com content.lowermybills.com	7 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1073	7 KB
1	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 428	81 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 5884	7 KB
1	trkfocus.com 1 redirects trkfocus.com	815 B
1	t.co t.co — Cisco Umbrella Rank: 726	759 B
0	deviceatlas.com Failed cs-cdn.deviceatlas.com Failed
150	45

	Domain	Requested by
18	trc.taboola.com	cdn.taboola.com
15	www.googletagmanager.com	refinance.quickenloans.com www.googletagmanager.com trackpixel.refinance.quickenloans.com
12	www.google.com
12	googleads.g.doubleclick.net	www.googletagmanager.com
6	rum-http-intake.logs.datadoghq.com	www.datadoghq-browser-agent.com
6	fonts.cdnfonts.com	static-msql-prod.refinance.quickenloans.com fonts.cdnfonts.com
5	match.adsrvr.org	4 redirects
5	refinance.quickenloans.com	zourir.com static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
4	tr.snapchat.com	sc-static.net
4	ct.pinterest.com	s.pinimg.com
4	content.refinance.quickenloans.com	static-msql-prod.refinance.quickenloans.com
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
3	bat.bing.com	t.co bat.bing.com
3	analytics.google.com	www.datadoghq-browser-agent.com
3	www.lmbahsj2.com	1 redirects trackpixel.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	trc.pushnami.com	www.datadoghq-browser-agent.com
2	pix.revjet.com	ads.revjet.com
2	www.facebook.com
2	psp.pushnami.com	www.datadoghq-browser-agent.com
2	dsum-sec.casalemedia.com	1 redirects
2	cm.g.doubleclick.net	2 redirects
2	script.anura.io	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	a.mgid.com	t.co
2	connect.facebook.net	t.co connect.facebook.net
2	s.pinimg.com	t.co s.pinimg.com
2	x.bidswitch.net	2 redirects
2	ib.adnxs.com	2 redirects
2	insight.adsrvr.org	2 redirects
2	action.media6degrees.com
2	action.dstillery.com	2 redirects
2	dpm.demdex.net	1 redirects refinance.quickenloans.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
2	trkmrk.com	2 redirects
2	zourir.com	1 redirects storage.googleapis.com
2	url.us.m.mimecastprotect.com	2 redirects
1	tr6.snapchat.com	sc-static.net
1	ads.anura.io	www.datadoghq-browser-agent.com
1	rp4.liadm.com
1	rp.liadm.com	1 redirects
1	adobedc.demdex.net	assets.adobedtm.com
1	fonts.gstatic.com	fonts.googleapis.com
1	c.pmsrv.co	trackpixel.refinance.quickenloans.com
1	sc-static.net	t.co
1	cdn.taboola.com	t.co
1	www.googleadservices.com	trackpixel.refinance.quickenloans.com
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	t.co
1	stats.g.doubleclick.net	www.googletagmanager.com
1	somni.rocketmortgage.com	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	simage2.pubmatic.com	1 redirects
1	pixel.rubiconproject.com	1 redirects
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	content.lowermybills.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	assets.adobedtm.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
1	trkfocus.com	1 redirects
1	storage.googleapis.com	t.co
1	t.co
0	cdn.mortgage.quickenloans.com Failed	trackpixel.refinance.quickenloans.com
0	cs-cdn.deviceatlas.com Failed	refinance.quickenloans.com
150	64

This site contains links to these domains. Also see Links.

Domain
www.lowermybills.com
privacyportal-cdn.onetrust.com
www.quickenloans.com
www.quickencompare.com
www.amerisave.com
www.credible.com
www.fhfa.gov
capitalmarkets.fanniemae.com
www.jdpower.com
www.starleafsquare.com
quickenloans.com
www.nmlsconsumeraccess.org

Subject Issuer	Validity	Valid
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-08` - `2025-05-07`	a year	crt.sh
storage.googleapis.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
192-3-45-74-host.colocrossing.com 192-3-45-74-host.colocrossing.com	`2023-01-05` - `2024-01-05`	a year	crt.sh
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2023-12-22` - `2024-12-21`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M03	`2024-01-03` - `2025-01-31`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
*.pushnami.com Amazon RSA 2048 M02	`2024-02-03` - `2025-03-03`	a year	crt.sh
cloudflareinsights.com GTS CA 1P5	`2024-05-08` - `2024-08-06`	3 months	crt.sh
cdnfonts.com GTS CA 1P5	`2024-05-25` - `2024-08-23`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
lowermybills.com Cloudflare Inc ECC CA-3	`2023-10-11` - `2024-10-10`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-12` - `2024-12-14`	a year	crt.sh
*.google-analytics.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
somni.rocketmortgage.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-19` - `2025-02-18`	a year	crt.sh
*.google.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-07` - `2024-08-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-04-12` - `2024-07-11`	3 months	crt.sh
*.revjet.com GlobalSign GCC R6 AlphaSSL CA 2023	`2024-03-27` - `2025-04-28`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M03	`2023-12-02` - `2024-12-29`	a year	crt.sh
*.googleadservices.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-23` - `2024-11-22`	a year	crt.sh
*.logs.datadoghq.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-16` - `2025-02-17`	a year	crt.sh
sc-static.net Amazon RSA 2048 M03	`2023-12-21` - `2025-01-18`	a year	crt.sh
pmsrv.co Amazon RSA 2048 M02	`2023-09-16` - `2024-10-14`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2024-03-14` - `2025-04-15`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 04	`2024-06-19` - `2024-12-16`	6 months	crt.sh
mgid.com E1	`2024-05-09` - `2024-08-07`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
script.anura.io Amazon RSA 2048 M03	`2023-10-16` - `2024-11-13`	a year	crt.sh
adobedc.demdex.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-22` - `2024-11-21`	a year	crt.sh
*.snap.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-21` - `2025-02-20`	a year	crt.sh
ads.anura.io Amazon RSA 2048 M03	`2024-04-29` - `2025-05-27`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Frame ID: C8CE2A6102D621BF65EF9CC101BD09D5
Requests: 102 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: 14659E11E05E30579B3151939385EBAA
Requests: 1 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: 42B9921C53F4035BE099A5E7B56B709F
Requests: 1 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: B86B7718E8671808AB83A2C971772D34
Requests: 33 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=409e6a74-8d7f-465e-87b0-cc6eb99f3a76&u_scsid=eb1417a7-746b-4bd5-aae7-4c7fe0065c73&u_sclid=a69a23c7-03e7-44c1-ade9-7a78cb96ab03
Frame ID: 99F6937A0E9B2396CEFE012C272D4E57
Requests: 1 HTTP requests in this frame

Frame: https://ct.pinterest.com/ct.html
Frame ID: 820649509756E1BDE20AFAB6A8514054
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Calculate New Payment - Start Here | Quicken Loans

Page URL History Show full URLs

https://url.us.m.mimecastprotect.com/s/AHPlClYmElF22gPPvFGRI1j?domain=t.co HTTP 307
https://url.us.m.mimecastprotect.com/r/61jD29eBuHLxW_SRK3NQ1OUey8r1DK04HQ_c8R4n18xZpVC86uVumcqNbY70_EbJhOoXPAFco2... HTTP 307
https://t.co/RCQJtkghYU Page URL
https://storage.googleapis.com/h4mhoyal1r0/g1f584sefg.html Page URL
http://zourir.com/gqzrv.html HTTP 307
https://zourir.com/gqzrv.html Page URL
https://zourir.com/gqzrv.html?od=1vct667ec8c2167ddo9c.oO6SM.Yzzzyrfft1bczz111_zr873.fft1bd3d3d3... HTTP 302
https://trkmrk.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_ot... HTTP 302
https://trkmrk.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_ot... HTTP 302
https://trkfocus.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_ot... HTTP 302
https://www.lmbahsj2.com/CK67XL/FGXLG/?sub1=42163&sub2=445499539&sub3=6nh45dbgnnvvc87319qxrx HTTP 302
https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Page Statistics

150
Requests

93 %
HTTPS

43 %
IPv6

45
Domains

64
Subdomains

50
IPs

2
Countries

2375 kB
Transfer

7362 kB
Size

84
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://www.lowermybills.com/legal/stateprivacy/
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/calculator-refinance
Title: Free Mortgage Payment Calculator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/home-equity-rate-table/
Title: Second Mortgage Payment Calculator

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/calculator-affordability
Title: Home Value Estimator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/home-equity-loans/home-equity-loan-amount-calculator/
Title: Free Estimated Home Equity Calculator

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/mortgage-rates
Title: See Today's Rates

Search URL Search Domain Scan URL

URL: https://www.amerisave.com/rates/
Title: Rates

Search URL Search Domain Scan URL

URL: https://www.amerisave.com/loan-programs/cash-out-refinance/
Title: here

Search URL Search Domain Scan URL

URL: https://www.credible.com/personal-loan-prequalification
Title: Rates shown

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: https://capitalmarkets.fanniemae.com/media/20371/display
Title: https://capitalmarkets.fanniemae.com/media/20371/display

Search URL Search Domain Scan URL

URL: https://www.jdpower.com/
Title: jdpower.com

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/privacy-policy/
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/state-privacy/
Title: State Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/disclosures-licenses/
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/ad-targeting/
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://www.starleafsquare.com/o-nrpx-d41-18fc5e526fb936daac7301f127413de5
Title: Unsubscribe

Search URL Search Domain Scan URL

URL: https://quickenloans.com/
Title: QuickenLoans.com

Search URL Search Domain Scan URL

URL: http://www.nmlsconsumeraccess.org/
Title: www.nmlsconsumeraccess.org

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://url.us.m.mimecastprotect.com/s/AHPlClYmElF22gPPvFGRI1j?domain=t.co HTTP 307
https://url.us.m.mimecastprotect.com/r/61jD29eBuHLxW_SRK3NQ1OUey8r1DK04HQ_c8R4n18xZpVC86uVumcqNbY70_EbJhOoXPAFco2SIVKgAEVACOfJXay6d7YFYRNQe-KjDgO3pA5urbkV6akVgAQXSGFCaHpfgKfmQogmzU3lRTXw6BjiT_CJOK16qkymcrrf2X-jALPMjkqkN6RbYi41yNN4-LPgOaCuMmb-NW2koRS14nPMuwhpMdouctQ5pZNqh_DTRT9bPybYlqHlboUFK-T0Kqe5Wvnt-sV7e8ZQwoRIuXH5RNwjO0U1qq23DxXEP6U8mV3aExwSp4dkmQ4e24h6UecEHpESni6crZ47_JdG-ckpC6QfLJ3aTpfDf25ppRW5DnuTcXJAn7x5eSTic4HFDx3I-UiJVzfMKWofxQQtwCHAQ0dHjcCMBpg3uCRjTwhx2FilbA_hUbgzQ6fyYlSg15UenvB16_1VfWhQxr-5xFz3f8ODELnR9Wua6E5ywz0FgIAQgHW4WNEzBBjsn5i24QuRncoEN8FHIuDLBn1MQnkT1sJ5Ev-c8XrmOdkH1JFA8PqMNgJfpYO6r8co_MWbDqSHskurC5B0MrmYUXPSdhUBWWWyiW_07u69nMi0ejP2Yyns9f0f17oCO1v68i0E3T8jmNyo89q14iC9ykSEV1bX-zDtPdwjsROkzzLldiOAI0nI0TUwuQ_L0lqPcA8sOhZFe1JCHjCdxXHD9X9ovjSzu1VD-FF-WZ38FSDFGU8dbI3PEetSaoAc2HDQ8rjHuB8gbym9RZb5Dvk1viqwrnqBMtXQzNKYIVi5xr-8QFVXJvwjgp9FTr-3qQJu2wKUQX2iXFwCb_AHwfJOzKXcRUiyMP__bp7pFfRlHwdUUSE2XvhAnlbUKJ_JTiSCUYTPMIIrD21lbKEhPSDPg3ABdsjTyGAiQSWgDkTgrgiXaNM3Pswt17RK3FCKC5dDORIuzlE7Pd06jBxBW4h8GMK6_ZgdPFsrKZmske4Qa23bIozbMVbrt4qPy6C5me6StkCUtUzP7xVLZx0M_qvmJNrUobvkM82KydqtK36oeiTFX6EPtqQEuf1cK1VtjlA4ZgYjXj8NgOA7dFvAnNpoT_fDubq7plrBuRoaNN0YHt8f1uprbGe8BVwTN3gfvWN5DBCZPHf1mlQL5ZZW-PNijCMIcMR6rzDMoB65hrOk6OMseyD-QPELQEFZxbTZ-NRi3gqKTNKH7tkaMfLPp_p5Z2Cg0kl8QPt33Usl0sOl2gS0GP0Y-RSQpWaXmaKxbPsfFe0e2Ik-MRf8B8T-vEYq6fo29-fPzj5Q_w8dQGnFDMaJ6L5a269zW4wWmP5w8T9FREd-HeW1IuoQBsul4Uzgjk05uHAmjyBrNxXmgCn69xUAExITBuZNt4Cg5RP5vTWeCPvIClgGeiAtexbmxqhtEqHehT3Gj7HfhKBUK5bWWnlB_EVBSjgszu_O0Vdkk-z2Ti-BX_jmNopAKCnrkBtLwm1aR52RoEm7z4GXCNPSYufVoIw4eBXFqLCeqQPKb-UDlloOJ8pUpdHjqNoEgscPi2RKhrZsFCDTAidYLIFCINHQeHjrQ6yi-akQwYbVBITNk05mjFBPhOeISbUilOzNhVGdkOIge13Lk3h9CpuVak-wJzDfBGxGpHhu7JUxAsulKX4tzmfaVBLRBW3YDQlalZLyJOpu7XJ2CrB2Y-GhtZkQluFxfS9yVCDoqpMezFS5atP2NebiB_GECEDucNKbzBXp4A2GsPxBQjV9t5znAnSC0qDIorH0OXxWwXKZ6vcsDXs8yEOIC2F8LAntVSsveC2fGVvP0fWdmz4aUYYdcvwHXs-voe8bEutPmSJEZPOZgcsC9JSqSrgyzrh4dwtwbYOiD2SlZ646BZ9AS6lreKFyIIJUvFB2VOS20RwDr8ZfG-_Xz8euNLeYtZ43zacCtiq_xVddI6zQo3GI75RfNJhMo1OPghKrSDApHF6P3V0xoCX1QagoQNghXlnHhodvThyJLxhEgo6slIMhDqDe94ufpx2raRMz8x_TJVwIvQQqxgU-mm-mIsq-H9-N6wjxNz1iYinkd1vORKrVMaplVdG0GEcx_CvsVdNjwYFBk2QBbL5unXdaf2FI7feXf-Vs7nasO1pTDgacDkMKo9SymqgJl4rh6d7Fa6toxNqSznxzKIk9Z HTTP 307
https://t.co/RCQJtkghYU Page URL
https://storage.googleapis.com/h4mhoyal1r0/g1f584sefg.html Page URL
http://zourir.com/gqzrv.html HTTP 307
https://zourir.com/gqzrv.html Page URL
https://zourir.com/gqzrv.html?od=1vct667ec8c2167ddo9c.oO6SM.Yzzzyrfft1bczz111_zr873.fft1bd3d3d3gyZDNiZWpi0u6Nvi HTTP 302
https://trkmrk.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_others|wwwwx|fft1b&s4=vct667ec8c2167ddo9c&s5=2d3bejb|16847|zzzyrfft1b|Y HTTP 302
https://trkmrk.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_others|wwwwx|fft1b&s4=vct667ec8c2167ddo9c&s5=2d3bejb|16847|zzzyrfft1b|Y&ch-redir=1&ckmxid=cq2rdlkp0000n373j2tg HTTP 302
https://trkfocus.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_others|wwwwx|fft1b&s4=vct667ec8c2167ddo9c&s5=2d3bejb|16847|zzzyrfft1b|Y&ch-redir=1&ckmxid=cq2rdlkp0000n373j2tg&ckmguid=bb6ce6a6-34e1-4d52-9cf5-2a9f7b99c994 HTTP 302
https://www.lmbahsj2.com/CK67XL/FGXLG/?sub1=42163&sub2=445499539&sub3=6nh45dbgnnvvc87319qxrx HTTP 302
https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://url.us.m.mimecastprotect.com/s/AHPlClYmElF22gPPvFGRI1j?domain=t.co HTTP 307
https://url.us.m.mimecastprotect.com/r/61jD29eBuHLxW_SRK3NQ1OUey8r1DK04HQ_c8R4n18xZpVC86uVumcqNbY70_EbJhOoXPAFco2SIVKgAEVACOfJXay6d7YFYRNQe-KjDgO3pA5urbkV6akVgAQXSGFCaHpfgKfmQogmzU3lRTXw6BjiT_CJOK16qkymcrrf2X-jALPMjkqkN6RbYi41yNN4-LPgOaCuMmb-NW2koRS14nPMuwhpMdouctQ5pZNqh_DTRT9bPybYlqHlboUFK-T0Kqe5Wvnt-sV7e8ZQwoRIuXH5RNwjO0U1qq23DxXEP6U8mV3aExwSp4dkmQ4e24h6UecEHpESni6crZ47_JdG-ckpC6QfLJ3aTpfDf25ppRW5DnuTcXJAn7x5eSTic4HFDx3I-UiJVzfMKWofxQQtwCHAQ0dHjcCMBpg3uCRjTwhx2FilbA_hUbgzQ6fyYlSg15UenvB16_1VfWhQxr-5xFz3f8ODELnR9Wua6E5ywz0FgIAQgHW4WNEzBBjsn5i24QuRncoEN8FHIuDLBn1MQnkT1sJ5Ev-c8XrmOdkH1JFA8PqMNgJfpYO6r8co_MWbDqSHskurC5B0MrmYUXPSdhUBWWWyiW_07u69nMi0ejP2Yyns9f0f17oCO1v68i0E3T8jmNyo89q14iC9ykSEV1bX-zDtPdwjsROkzzLldiOAI0nI0TUwuQ_L0lqPcA8sOhZFe1JCHjCdxXHD9X9ovjSzu1VD-FF-WZ38FSDFGU8dbI3PEetSaoAc2HDQ8rjHuB8gbym9RZb5Dvk1viqwrnqBMtXQzNKYIVi5xr-8QFVXJvwjgp9FTr-3qQJu2wKUQX2iXFwCb_AHwfJOzKXcRUiyMP__bp7pFfRlHwdUUSE2XvhAnlbUKJ_JTiSCUYTPMIIrD21lbKEhPSDPg3ABdsjTyGAiQSWgDkTgrgiXaNM3Pswt17RK3FCKC5dDORIuzlE7Pd06jBxBW4h8GMK6_ZgdPFsrKZmske4Qa23bIozbMVbrt4qPy6C5me6StkCUtUzP7xVLZx0M_qvmJNrUobvkM82KydqtK36oeiTFX6EPtqQEuf1cK1VtjlA4ZgYjXj8NgOA7dFvAnNpoT_fDubq7plrBuRoaNN0YHt8f1uprbGe8BVwTN3gfvWN5DBCZPHf1mlQL5ZZW-PNijCMIcMR6rzDMoB65hrOk6OMseyD-QPELQEFZxbTZ-NRi3gqKTNKH7tkaMfLPp_p5Z2Cg0kl8QPt33Usl0sOl2gS0GP0Y-RSQpWaXmaKxbPsfFe0e2Ik-MRf8B8T-vEYq6fo29-fPzj5Q_w8dQGnFDMaJ6L5a269zW4wWmP5w8T9FREd-HeW1IuoQBsul4Uzgjk05uHAmjyBrNxXmgCn69xUAExITBuZNt4Cg5RP5vTWeCPvIClgGeiAtexbmxqhtEqHehT3Gj7HfhKBUK5bWWnlB_EVBSjgszu_O0Vdkk-z2Ti-BX_jmNopAKCnrkBtLwm1aR52RoEm7z4GXCNPSYufVoIw4eBXFqLCeqQPKb-UDlloOJ8pUpdHjqNoEgscPi2RKhrZsFCDTAidYLIFCINHQeHjrQ6yi-akQwYbVBITNk05mjFBPhOeISbUilOzNhVGdkOIge13Lk3h9CpuVak-wJzDfBGxGpHhu7JUxAsulKX4tzmfaVBLRBW3YDQlalZLyJOpu7XJ2CrB2Y-GhtZkQluFxfS9yVCDoqpMezFS5atP2NebiB_GECEDucNKbzBXp4A2GsPxBQjV9t5znAnSC0qDIorH0OXxWwXKZ6vcsDXs8yEOIC2F8LAntVSsveC2fGVvP0fWdmz4aUYYdcvwHXs-voe8bEutPmSJEZPOZgcsC9JSqSrgyzrh4dwtwbYOiD2SlZ646BZ9AS6lreKFyIIJUvFB2VOS20RwDr8ZfG-_Xz8euNLeYtZ43zacCtiq_xVddI6zQo3GI75RfNJhMo1OPghKrSDApHF6P3V0xoCX1QagoQNghXlnHhodvThyJLxhEgo6slIMhDqDe94ufpx2raRMz8x_TJVwIvQQqxgU-mm-mIsq-H9-N6wjxNz1iYinkd1vORKrVMaplVdG0GEcx_CvsVdNjwYFBk2QBbL5unXdaf2FI7feXf-Vs7nasO1pTDgacDkMKo9SymqgJl4rh6d7Fa6toxNqSznxzKIk9Z HTTP 307
https://t.co/RCQJtkghYU

Request Chain 2

http://zourir.com/gqzrv.html HTTP 307
https://zourir.com/gqzrv.html

Request Chain 19

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720039144891 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720039144891

Request Chain 26

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId] HTTP 302
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]

Request Chain 27

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:4ld0kml&fmt=3 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=6e805a18-75d1-4593-a363-688617fb7498 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D6e805a18-75d1-4593-a363-688617fb7498 HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=8041705718402632460&ttd_tdid=6e805a18-75d1-4593-a363-688617fb7498 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=6e805a18-75d1-4593-a363-688617fb7498&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6e805a18-75d1-4593-a363-688617fb7498&r=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dpubmatic HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic HTTP 302
https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=6e805a18-75d1-4593-a363-688617fb7498&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch HTTP 302
https://x.bidswitch.net/ul_cb/syncd?dsp_id=93&user_group=1&user_id=6e805a18-75d1-4593-a363-688617fb7498&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch

Request Chain 50

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId= HTTP 302
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=

Request Chain 68

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:3ohu1zr&fmt=3 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NmU4MDVhMTgtNzVkMS00NTkzLWEzNjMtNjg4NjE3ZmI3NDk4&gdpr=0&gdpr_consent=&ttd_tdid=6e805a18-75d1-4593-a363-688617fb7498 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=NmU4MDVhMTgtNzVkMS00NTkzLWEzNjMtNjg4NjE3ZmI3NDk4&gdpr=0&gdpr_consent=&ttd_tdid=6e805a18-75d1-4593-a363-688617fb7498&google_tc= HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=6e805a18-75d1-4593-a363-688617fb7498&google_gid=CAESEE8nQrJN2Y9W3TOzFKQ4paE&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=6e805a18-75d1-4593-a363-688617fb7498&expiration=1722631146&gdpr=0&gdpr_consent= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=6e805a18-75d1-4593-a363-688617fb7498&expiration=1722631146&gdpr=0&gdpr_consent=&C=1

Request Chain 90

https://rp.liadm.com/j?dtstmp=1720039146796&aid=a-06d7&se=e30&duid=ddc3c751f117--01j1x5515gyma6jcf9n4ke732m&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&wpn=lc-bundle&refr=https%3A%2F%2Fzourir.com%2F&cd=.quickenloans.com HTTP 302
https://rp4.liadm.com/j?dtstmp=1720039146796&aid=a-06d7&se=e30&duid=ddc3c751f117--01j1x5515gyma6jcf9n4ke732m&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&wpn=lc-bundle&refr=https%3A%2F%2Fzourir.com%2F&cd=.quickenloans.com&i6=MjYwMDo4MDM6YTg4OjMwODI6Ojgy&n3pc=true

150 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

RCQJtkghYU
t.co/
Redirect Chain

https://url.us.m.mimecastprotect.com/s/AHPlClYmElF22gPPvFGRI1j?domain=t.co
https://url.us.m.mimecastprotect.com/r/61jD29eBuHLxW_SRK3NQ1OUey8r1DK04HQ_c8R4n18xZpVC86uVumcqNbY70_EbJhOoXPAFco2SIVKgAEVACOfJXay6d7YFYRNQe-KjDgO3pA5urbkV6akVgAQXSGFCaHpfgKfmQogmzU3lRTXw6BjiT_CJOK1...
https://t.co/RCQJtkghYU

579 B
759 B

399ms
104ms

Document
text/html

72.21.81.130
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/RCQJtkghYU

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

72.21.81.130 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_b /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 278
content-type: text/html; charset=utf-8
date: Wed, 03 Jul 2024 20:38:41 GMT
expires: Wed, 03 Jul 2024 20:43:42 GMT
perf: 7402827104
server: tsa_b
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: d64eabbf0c8f8f135ff5be1b07805a87870e24cf596719f6ab3c04b8875e6a3d
x-response-time: 12
x-transaction-id: e5ecc2709ce3ab87
x-xss-protection: 0

Redirect headers

Cache-control: no-store
Connection: keep-alive
Content-Length: 0
Date: Wed, 03 Jul 2024 20:38:41 GMT
Location: https://t.co/RCQJtkghYU
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Robots-Tag: noindex, nofollow

GET
H2 200 g1f584sefg.html
storage.googleapis.com/h4mhoyal1r0/ 226 B
698 B 158ms
158ms Document
text/html 2607:f8b0:400d:c0e::cf
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/h4mhoyal1r0/g1f584sefg.html
Requested by: Host: t.co
URL: https://t.co/RCQJtkghYU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c0e::cf Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://t.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-length: 226
content-type: text/html
date: Wed, 03 Jul 2024 20:38:42 GMT
etag: "91dff1b52ffd9dcb044e02547a724133"
expires: Wed, 03 Jul 2024 21:38:42 GMT
last-modified: Fri, 16 Feb 2024 11:03:24 GMT
server: UploadServer
x-goog-generation: 1708081404912521
x-goog-hash: crc32c=rXOOKg== md5=kd/xtS/9ncsETgJUenJBMw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 226
x-guploader-uploadid: ACJd0Nr9Vk3EqFnQ4hnLo5lbY8LskVaVKeeCLYIKbm4TdrHK1IbR8L1QvgyvcXx-dA409KS6B8w

GET
H/1.1

200
OK

gqzrv.html
zourir.com/
Redirect Chain

http://zourir.com/gqzrv.html
https://zourir.com/gqzrv.html

239 B
511 B

546ms
260ms

Document
text/html

192.3.45.74
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: https://zourir.com/gqzrv.html
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/h4mhoyal1r0/g1f584sefg.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.3.45.74 Buffalo, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS: annical.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 SVN/1.7.14 / PHP/5.4.16
Resource Hash

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://storage.googleapis.com/h4mhoyal1r0/g1f584sefg.html#?od=1vct667ec8c2167ddo9c.oO6SM.Yzzzyrfft1bczz111_zr873.fft1bd3d3d3gyZDNiZWpi0u6Nvi
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Length: 239
Content-Type: text/html; charset=UTF-8
Date: Wed, 03 Jul 2024 20:38:43 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 SVN/1.7.14
X-Powered-By: PHP/5.4.16

Redirect headers

Location: https://zourir.com/gqzrv.html#?od=1vct667ec8c2167ddo9c.oO6SM.Yzzzyrfft1bczz111_zr873.fft1bd3d3d3gyZDNiZWpi0u6Nvi
Non-Authoritative-Reason: HttpsUpgrades

GET
H2

200

Primary Request / Show response
refinance.quickenloans.com/
Redirect Chain

https://zourir.com/gqzrv.html?od=1vct667ec8c2167ddo9c.oO6SM.Yzzzyrfft1bczz111_zr873.fft1bd3d3d3gyZDNiZWpi0u6Nvi
https://trkmrk.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_others|wwwwx|fft1b&s4=vct667ec8c2167ddo9c&s5=2d3bejb|16847|zzzyrfft1b|Y
https://trkmrk.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_others|wwwwx|fft1b&s4=vct667ec8c2167ddo9c&s5=2d3bejb|16847|zzzyrfft1b|Y&ch-redir=1&ckmxid=cq2rdlkp0000n3...
https://trkfocus.com/?E=mQcCP%2buut4ELPRyCLqLYT0wL%2fRIqPdb%2f&s1=6nh45dbgnnvvc87319qxrx&s3=ee_others|wwwwx|fft1b&s4=vct667ec8c2167ddo9c&s5=2d3bejb|16847|zzzyrfft1b|Y&ch-redir=1&ckmxid=cq2rdlkp0000...
https://www.lmbahsj2.com/CK67XL/FGXLG/?sub1=42163&sub2=445499539&sub3=6nh45dbgnnvvc87319qxrx
https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transact...

115 KB
24 KB

736ms
569ms

Document
text/html

2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=

Requested by

Host: zourir.com
URL: https://zourir.com/gqzrv.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

ea29aec9d81ce2ee8f9b3a93930d765a9fad14e9573e82fcde73153239b63019

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://zourir.com/gqzrv.html#?od=1vct667ec8c2167ddo9c.oO6SM.Yzzzyrfft1bczz111_zr873.fft1bd3d3d3gyZDNiZWpi0u6Nvi
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cf-cache-status: DYNAMIC
cf-ray: 89d9ae65fe2572a1-EWR
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Wed, 03 Jul 2024 20:38:48 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 377
content-type: text/html; charset=utf-8
date: Wed, 03 Jul 2024 20:38:47 GMT
location: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: 370843f1-5bef-4a3a-99ef-9d3cd7262897

GET
H2 200 main.8ab0f18eb12832f8d8c7.css
static-msql-prod.refinance.quickenloans.com/ 381 KB
46 KB 198ms
71ms Stylesheet
text/css 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f21ce40b16925c76f891adf9aff87c84e535e6263acf1bcc7d1427fca0431d2f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:38:48 GMT
x-amz-version-id: dSxfHZAKofFQ9.Xdkk4PDkerEA4h6zUj
via: 1.1 8c17de0f985b9ec9dbef8f79e2137106.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P3
age: 1033
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Thu, 20 Jun 2024 06:12:51 GMT
server: cloudflare
etag: W/"3ffd6e253d1935b2bb34e46318b41bd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 89d9ae6a9d2e196c-EWR
x-amz-cf-id: YN_PmeowYYETHIgdf-5a3EVnlaGxphJ3SNIMUyDshKJbPSWWRmU1nQ==
expires: Thu, 04 Jul 2024 00:38:48 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 21 KB
7 KB 186ms
61ms Script
application/x-javascript 18.173.219.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.219.101 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-219-101.jfk52.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 08:30:04 GMT
content-encoding: gzip
via: 1.1 66ea06c52ae44609b3bf6f6054c081b6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK52-P1
age: 43725
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6759
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Oct 2023 12:27:20 GMT
server: AmazonS3
etag: "15864ce88fa79a3e954417d0c3396798"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: IGw3QDn19Cpyah8uSjG7fgQ72KriQJKZvHOc7oT__BjLUGZkqlG30g==

GET dacs.js
cs-cdn.deviceatlas.com/ 0
0

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
917 B 202ms
65ms Script
application/javascript 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efc6ca568cdf9d36f57664a37cceeab3585bb68a764e331c7c81e240e8d18137

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-c7114233cd489ae347ae.js
date: Wed, 03 Jul 2024 20:38:48 GMT
via: 1.1 8cdf4e2d4f4070992665477c4dbca0c0.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P2
age: 180
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 26 Jun 2024 23:05:50 GMT
server: cloudflare
etag: W/"4c57be2488b4787a0d3e7b447f231fe3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 89d9ae6aad5c7d11-EWR
x-amz-cf-id: IQLSTwA21oTjAR9HEHNq0YEu8Rsegw1bo4S4cSIGY6zMD-YQmlHQBg==
expires: Thu, 04 Jul 2024 00:38:48 GMT

GET
H2 200 launch-099982a746cc.min.js Show response
assets.adobedtm.com/b14636b10888/a3ec7ef1f366/ 257 KB
81 KB 212ms
36ms Script
application/x-javascript 2600:1408:ec00:886::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:886::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:38:48 GMT
content-encoding: gzip
last-modified: Mon, 02 Oct 2023 19:55:09 GMT
server: AkamaiNetStorage
etag: "b31a1f9e9f88d2133e2b3a9abeeddcd7:1696276509.604687"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 82392
expires: Wed, 03 Jul 2024 21:38:48 GMT

GET
H2 200 5fa1b4cbe02a560012bcbdf7 Show response
api.pushnami.com/scripts/v1/push/ 92 KB
19 KB 183ms
40ms Script
application/javascript 18.164.124.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/5fa1b4cbe02a560012bcbdf7
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-56.jfk50.r.cloudfront.net
Software: /
Resource Hash: 71ca1526b583a6283752d155fada0ed1a64f1ea43cf17d88f4d39cfc315cc7d9

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:32:48 GMT
content-encoding: gzip
via: 1.1 7c1248297a08764c17a9223ad5c211f8.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P7
age: 361
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: ZuQxTx0f7o0ETckMiK5AiAwwvevZaKc2AtMKYJ3nsvSbPG-K6YBd9g==

GET
H2 200 main.8ab0f18eb12832f8d8c7.js Show response
static-msql-prod.refinance.quickenloans.com/ 1 MB
245 KB 60ms
60ms Script
application/javascript 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c5e7d4ce4eeb1e758d9e6d2f0921ee74a5678da15c290fc4745b877365828fb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:38:48 GMT
x-amz-version-id: IZI.ue4__ozjry8XiCMUYv402hYR7Gl1
via: 1.1 a65e9b4047452e76aa43b68828db2d7e.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P3
age: 1033
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Thu, 20 Jun 2024 06:12:51 GMT
server: cloudflare
etag: W/"2fef9b651ebd1358fac4e390f7979734"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 89d9ae6b3dbc196c-EWR
x-amz-cf-id: EUvNCOPpQpxjd3CLSw5kGyEcZ7yXjIhvrlVleh30LgF3a1LoGQAMzg==
expires: Thu, 04 Jul 2024 00:38:48 GMT

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 159ms
70ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:38:49 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
server: cloudflare
etag: W/"2024.6.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 89d9ae6e9f2d42b8-EWR

GET
H3 200 stack-ssi
fonts.cdnfonts.com/css/ 1 KB
737 B 177ms
42ms Stylesheet
text/css 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/stack-ssi
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76b65310895e8341f3804e1f3d436a0910928874964daf20f6e2d7a8a69553f4

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://static-msql-prod.refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:38:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 309334
cf-polished: origSize=1385
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sun, 30 Jun 2024 06:43:15 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mulJr3%2F9efaQRVB6Y2lB5BF9n6NCFapGpmpstkEB4I927stEuhKB4314MaRTb6%2ByzE0gR33SZF9bi%2FWreMYO5I6DgcC5%2F8SiHQS%2BrH%2FjrEPLu8l1qs2W9fNCtmoPdTjU844BBztajkeGE9mk%2FpH7MPw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 89d9ae6c4ea50f53-EWR

GET
H3 200 myriad-pro
fonts.cdnfonts.com/css/ 2 KB
726 B 177ms
43ms Stylesheet
text/css 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/myriad-pro
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ebc3cd1d0af023685181ad52ed67b334bad44ea95407db09b40c2de15fcc165

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://static-msql-prod.refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:38:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9695132
cf-polished: origSize=2010
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 13 Mar 2024 15:33:17 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z6N1DmXOaQTt%2F1koapGLjtlM3fKUEIW627RyXN%2BNKB4HL9suonyCjdO05It5QmhLt1rleClAjJH7UraaXeb2XzEvdfulokLr62I6zSSIoFVIxr6ecprrHhDyKcN6gLxARy4iWO8o2tfEWNdPj%2FXS7PA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 89d9ae6c4ea80f53-EWR

GET
H2 200 css2
fonts.googleapis.com/ 875 B
500 B 204ms
97ms Stylesheet
text/css 2607:f8b0:400d:c0f::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4d2816f1f714364675a3a4ff25db96f2a5677b6cce94e150e61250bfdde4d258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://static-msql-prod.refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 03 Jul 2024 20:38:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 20:38:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 03 Jul 2024 20:38:49 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
801 B 206ms
99ms Stylesheet
text/css 2607:f8b0:400d:c0f::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

971b2673f92ee01c1b6e98372fdefdd4f0a83714167783eba0671fa0d966f9f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://static-msql-prod.refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 03 Jul 2024 20:38:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 20:38:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 03 Jul 2024 20:38:49 GMT

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
1 KB 174ms
67ms Stylesheet
text/css 2607:f8b0:400d:c0f::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fef95b324850099ff32808fb88cbf0af034d69cc4558110ea65e3b323fc17d0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://static-msql-prod.refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 03 Jul 2024 20:38:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 20:38:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 03 Jul 2024 20:38:49 GMT

GET
H2 200 css2
fonts.googleapis.com/ 427 B
376 B 205ms
98ms Stylesheet
text/css 2607:f8b0:400d:c0f::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://static-msql-prod.refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 03 Jul 2024 20:38:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 20:38:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 03 Jul 2024 20:38:49 GMT

GET
H2 200 dacs.js Show response
content.lowermybills.com/deviceatlas-1.6/ 21 KB
7 KB 195ms
50ms Script
application/javascript 2606:4700::6812:1ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://content.lowermybills.com/deviceatlas-1.6/dacs.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:1ef5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

592f244a454b1fabb9420ddc74002f325b0ebfc4d912815f45a4585b0685da8f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:04 GMT
via: 1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 765
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 11 Jun 2024 08:58:50 GMT
server: cloudflare
etag: W/"bce79d9575b3d328f46a0c856ff9bf44"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=7200
cf-ray: 89d9aecfba6b7277-EWR
x-amz-cf-id: KuOJKGXJH326UjAjA8Q9eI8I5zUiaa5Urlaa-98pg_kDxvADQv6hpA==
expires: Wed, 03 Jul 2024 22:39:04 GMT

GET
H2 200 pixel-c7114233cd489ae347ae.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 190 KB
24 KB 42ms
41ms Script
application/javascript 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd35d03cc363c21dafc6bb78ba34fa54cc77ff6f6060814039c36e97bb69cfcd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:04 GMT
content-encoding: gzip
via: 1.1 d3a2886dcf7e47b1e56baf628c69dc24.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P2
age: 167
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 26 Jun 2024 21:50:51 GMT
server: cloudflare
etag: W/"235a063695e9c2ae54d1cdf44776580d"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 89d9aececa507d11-EWR
x-amz-cf-id: atfnkq1r2QVSoa8rExO8I-8RUeaHHY6mI-EW_wtY9tN1ueQeibZ_Yg==
expires: Thu, 04 Jul 2024 00:39:04 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720039144891
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720039144891

609 B
1 KB

35ms
35ms

XHR
application/json

52.206.87.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720039144891

Requested by

Protocol

Server

52.206.87.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-87-211.compute-1.amazonaws.com

Software

Resource Hash

6c0aae3d1aa01a726f26a61cfbf8d497b8f31407acb85bb384bf0604b79861f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

dcs: dcs-prod-va6-1-v061-072d7bc2c.edge-va6.demdex.com 3 ms
pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: LEnLWnSnQdo=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 444
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-va6-1-v061-076624a94.edge-va6.demdex.com 0 ms
pragma: no-cache
date: Wed, 03 Jul 2024 20:39:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: Iq3XThT6Ts8=
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1720039144891
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 190ms
36ms Script
application/javascript 108.138.129.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.129.160 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-129-160.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:38:21 GMT
content-encoding: br
via: 1.1 e5f49cd65618fc548cd417b060a75e76.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
age: 45
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: KoEF2C3ZjhNHREfPQYVUQ4Fo9NN6pGTmvKOVxLW5tBV8X4_3TziyDw==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 282 KB
96 KB 181ms
69ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

58ecbfa481697f15a58c0a6b3b406cb86b8e672cac1d3b3156a789df07d86460

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 98297
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:05 GMT

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 5 KB
4 KB 226ms
225ms XHR
application/json 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

fe3008f7e6675d3979dffb4c0cbe7bd433f03feda8ba2e00bc849b726b246186

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Bearer null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"1546-wrol14jzVRzs6wff5t77ZWzTS8E"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 89d9aed72bd972a1-EWR
x-xss-protection: 1; mode=block

GET
BLOB 200
OK 37b9895d-99dc-47ee-8488-9f9bebe9bdb5
https://refinance.quickenloans.com/ 26 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://refinance.quickenloans.com/37b9895d-99dc-47ee-8488-9f9bebe9bdb5
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Length: 26149
Content-Type

GET
H2 200 hub
api.pushnami.com/scripts/v1/ Frame 1465 0
0 171ms
46ms Document
text/html 18.164.124.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/5fa1b4cbe02a560012bcbdf7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.124.33 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-124-33.jfk50.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 1500
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Wed, 03 Jul 2024 20:14:06 GMT
vary: accept-encoding
via: 1.1 f6acfb143216fabf7be9b3a603a486ae.cloudfront.net (CloudFront)
x-amz-cf-id: VHL_Jsvw2SS9sIz--K7YPTe2L-vC0ZG_1BZBeEw_vRuow8DoVYy4fg==
x-amz-cf-pop: JFK50-P7
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 318 KB
104 KB 67ms
66ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5436f0e9041e12e7200c44df4cef7591c4a295b714257721df003a7836c1904f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 106375
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H2

200

nsjs Show response
action.media6degrees.com/orbserv/
Redirect Chain

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]

5 B
606 B

102ms
100ms

Script
text/html

2606:4700:4400::6812:2412
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
Protocol: H2
Server: 2606:4700:4400::6812:2412 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=ISO-8859-1
content-language: en-US
access-control-allow-origin: *
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
cf-ray: 89d9aed9a8904caf-PHL

Redirect headers

location: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
access-control-allow-origin: *
date: Wed, 03 Jul 2024 20:39:06 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 89d9aed90fb44caf-PHL
content-type: text/html; charset=iso-8859-1

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:4ld0kml&fmt=3
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=6e805a18-75d1-4593-a363-688617fb7498
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D6e805a18-75d1-4593-a363-688617fb7498
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=8041705718402632460&ttd_tdid=6e805a18-75d1-4593-a363-688617fb7498
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=6e805a18-75d1-4593-a363-688617fb7498&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6e805a18-75d1-4593-a363-688617fb7498&r=https%3A%2F%2Fmatch.adsrvr.org%2...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=6e805a18-75d1-4593-a363-688617fb7498&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch
https://x.bidswitch.net/ul_cb/syncd?dsp_id=93&user_group=1&user_id=6e805a18-75d1-4593-a363-688617fb7498&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch

70 B
509 B

28ms
28ms

Image
image/gif

52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch
Protocol: H2
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 03 Jul 2024 20:39:08 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Redirect headers

Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch
Date: Wed, 03 Jul 2024 20:39:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 200 dest5.html
quicken.demdex.net/ Frame 42B9 0
0 201ms
29ms Document
text/html 3.209.149.25
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.209.149.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-209-149-25.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Wed, 03 Jul 2024 20:39:06 GMT
dcs: dcs-prod-va6-2-v061-02f0b7b48.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 3 Jul 2024 08:56:21 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: R/H2PGmXRBQ=

GET
H2 200 id Show response
somni.rocketmortgage.com/ 48 B
471 B 273ms
51ms XHR
application/x-javascript 63.140.39.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.rocketmortgage.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=32123023136735247551536565546179470824&ts=1720039146160

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.9 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-9.data.adobedc.net

Software

jag /

Resource Hash

c338d337018765cff13a76b6984e86924b163c980ae75b6165cb37ea13962820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
178 B 31ms
31ms XHR
text/plain 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 89d9aed79c6e72a1-EWR

POST
H2 204 collect Show response
analytics.google.com/g/ 0
261 B 179ms
72ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je4710v9169491831z89137104487za200zb9137104487&_p=1720039144924&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1646401858.1720039146&ul=en-us&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1720039146&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&dr=https%3A%2F%2Fzourir.com%2F&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=22935&_z=fetch
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
261 B 198ms
68ms Ping
text/plain 2607:f8b0:400d:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-RXLL9Z7XBK&cid=1646401858.1720039146&gtm=45je4710v9169491831z89137104487za200zb9137104487&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c04::9c Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect Show response
analytics.google.com/g/ 0
54 B 159ms
73ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je4710v9169491831z89137104487za200zb9137104487&_p=1720039144924&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1646401858.1720039146&ul=en-us&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1720039146&sct=1&seg=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&dr=https%3A%2F%2Fzourir.com%2F&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_et=4&tfd=22956&_z=fetch
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
840 B 54ms
41ms Image
image/png 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
via: 1.1 5af2699243b550d789ef9dce0b522ed2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 6654
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Mon, 11 Mar 2024 13:46:57 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 89d9aed8afe17d11-EWR
x-amz-cf-id: woQnwNXNgm6YznUnxf5BCG6_jPC9pwMoa8291mGr3ncF-NqB2MDVUg==
expires: Thu, 04 Jul 2024 00:39:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
82 KB 49ms
48ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

58c372996464132cf3b5a9b6daa5830ec34697a9990e78f2c781fbe3c9d3803e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84139
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ Frame B86B 5 KB
2 KB 298ms
50ms Script
application/javascript 2600:1408:ec00:289::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: t.co
URL: https://t.co/RCQJtkghYU
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:289::1931 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 22a7c0f21be2b8240a32adb4e3b490724a69eee63bf02e47615f6d001c0f81f6

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-cdn: akamai
etag: "ecd8d25c94266835b528fc293ee30bdf"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 1880

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 205 KB
74 KB 129ms
129ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

196dc3440f8ca1afa96fb9d6fa5dbcf885ef098b9760a1a515f41f5c6b53f9b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76132
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame B86B 222 KB
59 KB 139ms
36ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: t.co
URL: https://t.co/RCQJtkghYU

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

63bae03aa97278acb1d6f7863e593999bbdc5d280d2fa5a3050f234ce5eee850

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 03 Jul 2024 20:39:06 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58293
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=12, mss=1392, tbw=2768, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: RYk3yWGbjR6k1G/yH1rA1VbzQ/ZGe2wcksPxgABLeuox7kMCvTdH4t+HVbykwsyTBGPTC10n4b1RLETpUjA96g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
ads.revjet.com/ Frame B86B 19 KB
8 KB 391ms
117ms Script
application/javascript 15.204.44.87
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: t.co
URL: https://t.co/RCQJtkghYU
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 15.204.44.87 Hillsboro, United States, ASN16276 (OVH, FR),
Reverse DNS: ext.sor126.incmdb.net
Software: nginx /
Resource Hash: 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
last-modified: Mon, 18 Dec 2023 10:27:15 GMT
server: nginx
etag: W/"65801e83-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Wed, 03 Jul 2024 20:49:06 GMT

GET
H2 200 a-06d7.min.js Show response
b-code.liadm.com/ Frame B86B 101 KB
36 KB 271ms
63ms Script
application/javascript 2600:9000:23cb:0:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23cb:0:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 72c1bab19ae1dc60cc73c71c0a8f59777c85913e59e2b4487cd11e70bd928c23

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 14:23:43 GMT
content-encoding: gzip
via: 1.1 043cf9310ff19c0e58a0b6e76877f570.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
age: 22523
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public,max-age=86400
x-amz-cf-id: hWpO6TJraNA8eE5Y2-NxOyCXdlIViKbCJI8mexdTAKeHa0IvNa996w==

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 56 KB
21 KB 627ms
541ms Script
text/javascript 173.194.66.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.66.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qo-in-f157.1e100.net

Software

cafe /

Resource Hash

b5187f214868ccaf0cab0a1ad7167b3f0d10d914ccabb4fd2729cad9101bb55e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21080
x-xss-protection: 0
server: cafe
etag: 4843064822739953192
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 235 KB
84 KB 171ms
171ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

899c415d3ec88c9d57d8a270492594334e24549976bf0852131bfea0a5aefcde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86042
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1390358/ Frame B86B 69 KB
21 KB 190ms
78ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: t.co
URL: https://t.co/RCQJtkghYU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 28c197dfc2c26b6d901bc0efdf6439b77bf10a2a1f98a3acc5d65abaf788c27b

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: JR3bLfayvGIo2WoeEkTf0n_K_KyMF9rt
content-encoding: gzip
via: 1.1 varnish
date: Wed, 03 Jul 2024 20:39:06 GMT
x-amz-request-id: T2SANKB409YCCNM8
age: 66
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
fastly-restarts: 1
x-amz-id-2: SNiYdovnZNaYXYmYnBPy/Xa13XJpw5UgGt9fO8UPKWF6ErzSTYJRXOVeuWKsx4oiegOx28dEk1o=
x-served-by: cache-ewr18144-EWR
content-length: 21247
last-modified: Wed, 03 Jul 2024 09:59:08 GMT
server: AmazonS3
x-timer: S1720039146.466175,VS0,VE26
etag: "79f67e6ed168cfb57aeedcb94c09f244"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 9
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 4662

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 235 KB
84 KB 192ms
192ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

437565448cf65bc008ecf3420fba411dcb0de63fd31e0a3ed0d9423d7d1a6c65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85950
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
90 KB 238ms
238ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

78e29b268c01b538dbbcdc8092318bd0a71036997182bcc04e89d71e4f8fb7d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92570
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 264 KB
91 KB 58ms
58ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11388547050

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a476128af7a13f7a6e18c1640e2bf92faaa68537186204f6fc8456d83760ed70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93411
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET deviceAtlasLmb.min.js
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame B86B 0
0

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 270ms
80ms Ping
application/json 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-DOSKZL216&batch_time=1720039146345
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
85 KB 225ms
225ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9fd0bb540bd3576344a289390fed47f224d154e118644a89fa2dd0245ee6956e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87027
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H2

200

nsjs Show response
action.media6degrees.com/orbserv/
Redirect Chain

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=

5 B
342 B

125ms
124ms

Script
text/html

2606:4700:4400::6812:2412
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=
Protocol: H2
Server: 2606:4700:4400::6812:2412 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=ISO-8859-1
content-language: en-US
access-control-allow-origin: *
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
cf-ray: 89d9aed9b8b14caf-PHL

Redirect headers

location: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=
access-control-allow-origin: *
date: Wed, 03 Jul 2024 20:39:06 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 89d9aed90fb74caf-PHL
content-type: text/html; charset=iso-8859-1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
90 KB 226ms
225ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

255ba74255fbca81c035cceb9c1a9ab9be2849ab7a8a39f28deea6fe19a79e51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92566
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
85 KB 238ms
237ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

18aba4f0a8e697735a4382e45658d39d3d8979292fea2fa1c17e2f4d3b7006be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87059
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 265 KB
91 KB 254ms
254ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11380533681

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f6b982382b9995d6359fc0868e8b3e7f5323d1cf89462d2e3b6f6e02c7048f29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93561
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame B86B 50 KB
21 KB 320ms
152ms Script
application/javascript 3.163.245.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: t.co
URL: https://t.co/RCQJtkghYU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.245.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: fcc3c439edc63318783aed993f9d2a5be255270297b5453bceb2384d9993886c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
via: 1.1 a7253311f94fb967603a1d22f7a3c43a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: PHL51-P1
x-cache: Miss from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 21453
x-amz-cf-id: xc2nRz__jKYXqksUGjbwz_AV_gg9jEGT2LFiKIa_OItnGtzsVQcVdg==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 265 KB
91 KB 272ms
271ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9a2b61aadc50a578eeef4543776bc42810a97a88470a39659be5b9b27c51be90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93556
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H2 200 src Show response
c.pmsrv.co/v2/conversion/ Frame B86B 3 KB
4 KB 393ms
133ms Script
text/javascript 2600:9000:2514:8200:a:8e7d:9900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:8200:a:8e7d:9900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash: d8cbc596bdee9ceb0f3b176892acfb59f5535b3ab2f7f3da519a9c59a7389531

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
via: 1.1 14b9e21ac67dd643dc9e782cb20c49a2.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P8
x-powered-by: Express
etag: W/"d6b-5FvrY9MCXV5zpCr/QL4U12UJSL0"
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
content-length: 3435
x-amz-cf-id: wZDj8GMppRfIswzPHsGKufJTWj_gWlmcErhpAO5azzt1yHRPcA7WQQ==
expires: -1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 235 KB
84 KB 330ms
330ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e396e7a333fb85cf7ade2cb26a23c33f8ec13d63a723a72b5df0512cbdfdfc96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86130
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:06 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 60 KB
19 KB 233ms
63ms Script
text/javascript 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-c7114233cd489ae347ae.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1a6435ec41848bb2da51f6c469d1168e15993000f11a96638cbd488b06ba3ad4

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: b26919f2-0c9b-434d-98ee-fdbf81a445b6
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 252ms
49ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: t.co
URL: https://t.co/RCQJtkghYU

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 03 Jul 2024 20:39:06 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A289B3F4246E4FA1B2BB3CB570F0E3C1 Ref B: PHL30EDGE0108 Ref C: 2024-07-03T20:39:06Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H3 200 mgsensor.js Show response
a.mgid.com/ Frame B86B 17 KB
6 KB 258ms
98ms Script
application/javascript 2606:4700:1::6813:854c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a.mgid.com/mgsensor.js?d=1720039146359

Requested by

Host: t.co
URL: https://t.co/RCQJtkghYU

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:1::6813:854c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45d2c055791d072ed388bb395f90aaebf2425189bbd03942b8f60855ba4f6988

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
x-mg-request-uuid: 0f516042-fca6-457c-950d-e3d96c55d4be
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 89d9aedb89370cb1-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 qllogo.png
content.refinance.quickenloans.com/msql/ 4 KB
4 KB 57ms
57ms Image
image/png 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/qllogo.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://static-msql-prod.refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
via: 1.1 bf8d7cb6fca5d51158e1109ca40fe242.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 6654
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 3877
x-xss-protection: 1; mode=block
last-modified: Mon, 11 Mar 2024 13:46:58 GMT
server: cloudflare
etag: "277055237f3837abfae204219c13fa6c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 89d9aed908317d11-EWR
x-amz-cf-id: cC_exv6foW9wYqUbLn3fqwwOCdhD_miavhN6t_666tUR_TX5B4dq-g==
expires: Thu, 04 Jul 2024 00:39:06 GMT

GET
H2 200 home-icon.png
content.refinance.quickenloans.com/msql/ 499 B
721 B 68ms
67ms Image
image/png 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/home-icon.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64a6e8d00c22b320355dc737581468bfe44b606aecbfe2fc7d2d57ea4c1c2ad8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://static-msql-prod.refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
via: 1.1 c4d0da6268789cfda9bb5da1f3f8fc58.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 1639
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 499
x-xss-protection: 1; mode=block
last-modified: Wed, 24 Apr 2024 14:40:34 GMT
server: cloudflare
etag: "0b1942df486abf0cbd77b876c966c942"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 89d9aed908337d11-EWR
x-amz-cf-id: xqEYpIUESDEaM1zEbGi3CKb2EBSVZToClwlnpmOBsMfgfwITXR6rHw==
expires: Thu, 04 Jul 2024 00:39:06 GMT

GET
H3 200 MYRIADPRO-COND.woff
fonts.cdnfonts.com/s/492/ 59 KB
59 KB 291ms
114ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-COND.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55cbdff52a4ce0061ff5347c7003f6086224a8f5b5d7d3afa3feb420ec8585b5

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6034143
alt-svc: h3=":443"; ma=86400
content-length: 60044
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "ea8c-5d73bbca4b3e7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bclWKbCRw4wIVgZvBLUBig6AvofRbtguyDVsOiPQrWkBo2k2zgEzm87TEOiFdzyPZ1bcMLgpzney41iGLIk8gYm0z6Old64EhNEhNAGDuU9pHglnuxkc1SVECW1XW68%2FvJ6OGpfzErPsw4zrPIbZ96s%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 89d9aeda3d047c9a-EWR

GET
H3 200 MYRIADPRO-BOLD.woff
fonts.cdnfonts.com/s/492/ 61 KB
62 KB 336ms
159ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLD.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 962f8da44a5e7f4416402f6bc4a7165ab26cef621f6c24cb74f5e8db5fdc5f9e

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4740941
alt-svc: h3=":443"; ma=86400
content-length: 62676
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "f4d4-5d73bbca4afff"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DQvgeQSFq0Zjj7kBtIWkYvzq53aSF3B4WZL%2FXF2hFjZ9pf%2BICpa%2F3twsYlbAN564DZxROzLKD%2FKZga25WuV0OK6Qw%2BbfhKv0uczn4wAWLNHNBnDAqtc8dzjc%2BbngJS55mbN6wZePC%2Fn%2FxpE%2Fks%2BG0xg%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 89d9aeda3d087c9a-EWR

GET
H3 200 MYRIADPRO-SEMIBOLD.woff
fonts.cdnfonts.com/s/492/ 61 KB
62 KB 339ms
163ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-SEMIBOLD.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f6b883d93b2767c0d04efeeeb65ac92a170c1d966fefc635586d233e5f318cc

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4740941
alt-svc: h3=":443"; ma=86400
content-length: 62448
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "f3f0-5d73bbca4b7cf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RnCPwCEK6lksxavfi7bvx62SKjtJE6NWLC%2FIsXV7PsJvteg8zfN4IiHUT9X6FJfJE%2FXtSh2TnpxVFs4QTPZl%2FJS4LaBDwGr%2BA5vYfvIlv88F30ch833MKJPFdmA3800U0q%2BNF9aOL9qFuec1S6KZEps%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 89d9aeda3d097c9a-EWR

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
33 KB 246ms
88ms Font
font/woff2 2607:f8b0:400d:c00::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c00::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 28 Jun 2024 06:04:34 GMT
x-content-type-options: nosniff
age: 484472
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 28 Jun 2025 06:04:34 GMT

GET
H2 200 request.js Show response
script.anura.io/ 64 KB
22 KB 268ms
74ms Script
application/javascript 54.205.80.0
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/request.js?instance=3439535758&exid=8c481767-227d-5602-8790-27fe630c8a92&source=affl_everflow_ql-lre_9_233&campaign=42163&849223635485

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.205.80.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-205-80-0.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e2125edb15f1bd4d39e295d65696a672d4333505e5f2d66a576c0f30eec249b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:3ohu1zr&fmt=3
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NmU4MDVhMTgtNzVkMS00NTkzLWEzNjMtNjg4NjE3ZmI3NDk4&gdpr=0&gdpr_consent=&ttd_tdid=6e805a18-75d1-4593-a363-68861...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=NmU4MDVhMTgtNzVkMS00NTkzLWEzNjMtNjg4NjE3ZmI3NDk4&gdpr=0&gdpr_consent=&ttd_tdid=6e805a18-75d1-4593-a363-688...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=6e805a18-75d1-4593-a363-688617fb7498&google_gid=CAESEE8nQrJN2Y9W3TOzFKQ4paE&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=6e805a18-75d1-4593-a363-688617fb7498&expiration=1722631146&gdpr=0&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=6e805a18-75d1-4593-a363-688617fb7498&expiration=1722631146&gdpr=0&gdpr_consent=&C=1

43 B
563 B

48ms
47ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=6e805a18-75d1-4593-a363-688617fb7498&expiration=1722631146&gdpr=0&gdpr_consent=&C=1
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZcgoXhNeGn881REa4Ce%2F81EDeRaJ9Htyn%2FimZjYEDs9PV4J0Vv98PKgtwXz3R29AZYEdEBCbZGy8BZVJD1D6skwuWFbSwm5pRIoJpo3hY0VfeJ1k%2FEMluZ%2F7FfHEtih%2BrQHZKGZ0%2BKAd6g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 89d9aedd0c664265-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:06 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5N3agX65kzuttsND%2BvHSypIWCjtR1c1e9sd15PzNYn7ww%2BwlFnGmG5QPT3XspGITP8JCui6c4MqdAm69qzb%2FKfirKAUzyRN1%2BQFDJH%2BlwHSMp7v89%2BueJFQZZ4Eqgtqna4wcGkCIPufaJg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=39&external_user_id=6e805a18-75d1-4593-a363-688617fb7498&expiration=1722631146&gdpr=0&gdpr_consent=&C=1
cache-control: no-cache
cf-ray: 89d9aedc6b6f4265-EWR
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 down-arrow.png
content.refinance.quickenloans.com/msql/ 333 B
526 B 64ms
64ms Image
image/png 2606:4700::6812:c2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/down-arrow.png

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:c2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29502f440e5e16b564bbd6922c08e44a959ef72aff8c4e41d9ecb57cb3bc2e06

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
via: 1.1 a1546fc751225809c39b89ba9e8d715c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 1639
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
content-length: 333
x-xss-protection: 1; mode=block
last-modified: Wed, 24 Apr 2024 14:40:34 GMT
server: cloudflare
etag: "b162a14dca2f70ac6f002b415f11d717"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 89d9aed928517d11-EWR
x-amz-cf-id: WJVTY56nxagkLfnSBxOst_jyIElOQfBofOMJMqs0U53Rr9sqr_jjAQ==
expires: Thu, 04 Jul 2024 00:39:06 GMT

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
110 B 164ms
164ms XHR
text/plain 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 89d9aed91dab72a1-EWR
content-length: 2
x-xss-protection: 1; mode=block

POST
H2 200 interact Show response
adobedc.demdex.net/ee/v1/ 1 KB
1005 B 303ms
111ms Fetch
application/json 63.140.39.130
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://adobedc.demdex.net/ee/v1/interact?configId=b1d8d3c2-1fda-4646-9d8a-484cec8d3f55&requestId=546d6791-b0fc-4b25-b122-7ca1cf8b5cd4

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.130 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-130.data.adobedc.net

Software

jag /

Resource Hash

324b7ec9e04334641dcfb98066f7d0afdcb237395e6f89afda2e809eb738f0a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: jag
vary: Origin
content-type: application/json;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Retry-After, X-Adobe-Edge, X-Request-ID
x-adobe-edge: VA6;7
access-control-allow-credentials: true
x-konductor: N/A
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-request-id: 546d6791-b0fc-4b25-b122-7ca1cf8b5cd4

GET
H3 304 myriad-pro
fonts.cdnfonts.com/css/ 2 KB
478 B 158ms
158ms Stylesheet
text/css 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/myriad-pro
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.8ab0f18eb12832f8d8c7.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ebc3cd1d0af023685181ad52ed67b334bad44ea95407db09b40c2de15fcc165

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
If-Modified-Since: Wed, 13 Mar 2024 15:33:17 GMT
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
cf-cache-status: HIT
last-modified: Wed, 13 Mar 2024 15:33:17 GMT
cf-bgj: minify
server: cloudflare
age: 9695149
cf-polished: origSize=2010
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F3jQhq7lQbKcSiAoGGIoJHDuIOpWQCq3d3iJjBJET9rE1snzGXmyK%2BppnMc37BtnqQKEgPpF6lciZgi3trHlJNIcglfs4KnkzS3DFDX3TxGwyQxBBVwZdYf1jK1nxH8re7AKZov6Q8njZoZZ%2F6hXV9Q%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 89d9aed92dd00f53-EWR
alt-svc: h3=":443"; ma=86400

POST
H2 200 psp Show response
psp.pushnami.com/api/ 2 B
152 B 514ms
513ms Fetch
text/html 3.216.97.11
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.216.97.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-97-11.compute-1.amazonaws.com
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded
accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
key: 5fa1b4cbe02a560012bcbdf7
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Wed, 03 Jul 2024 20:39:07 GMT
x-powered-by: Express
content-length: 2
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type: text/html; charset=utf-8

OPTIONS
H2 204 psp
psp.pushnami.com/api/ Frame 0
0 250ms
67ms Preflight 3.216.97.11
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.216.97.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-97-11.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: key
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
date: Wed, 03 Jul 2024 20:39:06 GMT
vary: Access-Control-Request-Headers
x-powered-by: Express

GET
H2 200 1736491679707345 Show response
connect.facebook.net/signals/config/ Frame B86B 54 KB
12 KB 57ms
55ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1736491679707345?v=2.9.160&r=stable&domain=refinance.quickenloans.com&hme=733c3732ec767f7a62e7787aff967e6d19b1e13e533937876f2e15efe07bf678&ex_m=67%2C113%2C100%2C104%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C160%2C163%2C175%2C171%2C172%2C174%2C28%2C94%2C50%2C73%2C173%2C155%2C158%2C168%2C169%2C176%2C122%2C39%2C33%2C134%2C14%2C48%2C181%2C180%2C124%2C17%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C101%2C103%2C37%2C102%2C29%2C25%2C156%2C159%2C131%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C98%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C34%2C80%2C2%2C35%2C60%2C40%2C99%2C43%2C75%2C65%2C105%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C106

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0a2f032261be668c4ebdb28502c882682bfda90aca02a30325678fedb8cfa90d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 03 Jul 2024 20:39:06 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 11922
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=61, mss=1392, tbw=63791, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: f9yeNhcr+CmefkzsTQQY6pCknl5Ek7qDLqHVOOQJJvhkevMGpnbeJZVTqr8uvoD7i+98n0rmvmsUzzwUJx97aA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

OPTIONS
H2 200 unip
trc.taboola.com/1390358/log/3/ Frame 0
0 275ms
109ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1720039146564&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&tos=3&ssd=1&scd=0&ler=other&mrir=u&vi=1720039146558
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:06 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 20623
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039147.745219,VS0,VE22
x-vcl-time-ms: 22

OPTIONS
H2 200 unip
trc.taboola.com/1467390/log/3/ Frame 0
0 271ms
109ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1720039146569&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&tos=6&ssd=1&scd=0&ler=other&mrir=u&vi=1720039146558
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:06 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 20119
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039147.745188,VS0,VE21
x-vcl-time-ms: 21

OPTIONS
H2 200 unip
trc.taboola.com/1074476/log/3/ Frame 0
0 211ms
51ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1720039146572&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&tos=9&ssd=1&scd=0&ler=other&mrir=u&vi=1720039146558
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:06 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 17263
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039147.745155,VS0,VE18
x-vcl-time-ms: 18

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame B86B 0
63 B 64ms
63ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1720039146564&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&tos=3&ssd=1&scd=0&ler=other&mrir=u&vi=1720039146558
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 19
date: Wed, 03 Jul 2024 20:39:06 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 17295
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039147.856334,VS0,VE19
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame B86B 0
381 B 104ms
102ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1720039146569&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&tos=6&ssd=1&scd=0&ler=other&mrir=u&vi=1720039146558
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 26
date: Wed, 03 Jul 2024 20:39:06 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 20771
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039147.856364,VS0,VE26
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame B86B 0
667 B 59ms
58ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1720039146572&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&tos=9&ssd=1&scd=0&ler=other&mrir=u&vi=1720039146558
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 21
date: Wed, 03 Jul 2024 20:39:06 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 20151
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039147.795901,VS0,VE21
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 /
www.facebook.com/tr/ Frame B86B 0
273 B 262ms
87ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com&rl=https%3A%2F%2Frefinance.quickenloans.com&if=true&ts=1720039146618&sw=1600&sh=1200&v=2.9.160&r=stable&ec=0&o=4124&fbp=fb.1.1720039146616.991983745440789824&pm=1&hrl=8f477c&cdl=API_unavailable&it=1720039146533&coo=false&cs_cc=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=10, mss=1392, tbw=2775, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 03 Jul 2024 20:39:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ Frame B86B 67 B
4 KB 342ms
169ms Image
image/png 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com&rl=https%3A%2F%2Frefinance.quickenloans.com&if=true&ts=1720039146618&sw=1600&sh=1200&v=2.9.160&r=stable&ec=0&o=4124&fbp=fb.1.1720039146616.991983745440789824&pm=1&hrl=8f477c&cdl=API_unavailable&it=1720039146533&coo=false&cs_cc=1&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x1289f4ec3f077644","source_keys":["1","2"]},{"key_piece":"0xe2602dedf7c4c6b6","source_keys":["1","2"]}],"aggregatable_values":{"1":1}}
content-encoding: zstd
x-content-type-options: nosniff
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
date: Wed, 03 Jul 2024 20:39:06 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7387511881763688462", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=9, rtx=0, c=10, mss=1392, tbw=3092, tp=-1, tpl=-1, uplat=92, ullat=0
pragma: no-cache
x-fb-debug: Zfvk85BEEQHiaQcjbWO+YwD+b18YvPzIUG/YzaoQnSvgLkaaiAkca/Ptbcqs/NuF3OGrTjN5thxD0ecHKEOCRA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7387511881763688462"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 main.ea1c939c.js Show response
s.pinimg.com/ct/lib/ Frame B86B 80 KB
23 KB 71ms
70ms Script
application/javascript 2600:1408:ec00:289::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.ea1c939c.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:ec00:289::1931 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d23d5715ffe428ffa9ce297fba04eb9ba463cbc6478269f0c53ceeeada3c95c6

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
x-cdn: akamai
etag: "2bb7f81e0335844a4b164b873a7f7a30"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 23139

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 191ms
101ms Ping
application/json 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-DOSKZL216&batch_time=1720039146646
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 / Show response
ct.pinterest.com/user/ Frame B86B 327 B
710 B 178ms
62ms XHR
application/json 23.62.168.244
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&cb=1720039146735&dep=2%2CPAGE_LOAD

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.ea1c939c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.62.168.244 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-62-168-244.deploy.static.akamaitechnologies.com

Software

Resource Hash

5612e07185add6333ccf39345089eedafce9235ae2770f3e3c93e88805532780

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.5a68dc17.1720039146.6c412a3e
x-envoy-upstream-service-time: 1
content-length: 187
x-pinterest-rid: 1465958004231054
pin-unauth: dWlkPU16azVOREUwTjJZdE1ETTVOQzAwWlRNMUxUaGtNMlV0WlRBM1l6RTBOR1JtT0RGaQ
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: cac24a94a4695e758e25b435c5c0c6dca81d437a
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/v3/ Frame B86B 35 B
528 B 176ms
62ms Fetch
image/gif 23.62.168.244
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/v3/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D%22%2C%22ref%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D%22%2C%22if%22%3Atrue%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%22ea1c939c%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22126%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22126%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22126.0.6478.126%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1720039146739

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.ea1c939c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.62.168.244 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-62-168-244.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.5a68dc17.1720039146.6c412a3d
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=600
content-length: 35
x-pinterest-rid: 1062916973066772
pragma: no-cache
referrer-policy: origin
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
pinterest-version: cac24a94a4695e758e25b435c5c0c6dca81d437a
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pd2259 Show response
pix.revjet.com/track/ Frame B86B 46 B
222 B 242ms
86ms Script
text/javascript 51.81.49.47
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd2259?__noscript=false&__cbf=revjet.callbacks.cb1720039146741&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&referrer=https%3A%2F%2Fzourir.com%2F&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.81.49.47 , United States, ASN16276 (OVH, FR),
Reverse DNS: ext.svh331.incmdb.net
Software: /
Resource Hash: 1847b6eb065d9c498ca655abf36ce3daccfb7f20eba97bcacdf7278320e457c0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 pd3876 Show response
pix.revjet.com/track/ Frame B86B 46 B
223 B 215ms
85ms Script
text/javascript 51.81.49.47
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd3876?__noscript=false&__cbf=revjet.callbacks.cb1720039146742&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&referrer=https%3A%2F%2Fzourir.com%2F&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.81.49.47 , United States, ASN16276 (OVH, FR),
Reverse DNS: ext.svh331.incmdb.net
Software: /
Resource Hash: 1b983bac0271f4bee7ca9d457a7ed6fe0d8d8c2381ee478903afdc3428a4563a

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-length: 46
content-type: text/javascript

GET
H2

200

j Show response
rp4.liadm.com/ Frame B86B
Redirect Chain

https://rp.liadm.com/j?dtstmp=1720039146796&aid=a-06d7&se=e30&duid=ddc3c751f117--01j1x5515gyma6jcf9n4ke732m&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%2...
https://rp4.liadm.com/j?dtstmp=1720039146796&aid=a-06d7&se=e30&duid=ddc3c751f117--01j1x5515gyma6jcf9n4ke732m&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%...

13 B
347 B

309ms
74ms

XHR
application/json

52.201.12.52
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1720039146796&aid=a-06d7&se=e30&duid=ddc3c751f117--01j1x5515gyma6jcf9n4ke732m&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&wpn=lc-bundle&refr=https%3A%2F%2Fzourir.com%2F&cd=.quickenloans.com&i6=MjYwMDo4MDM6YTg4OjMwODI6Ojgy&n3pc=true
Protocol: H2
Server: 52.201.12.52 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-12-52.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 03 Jul 2024 20:39:07 GMT
x-pixel-event-id: 069da988-139c-45e9-b631-d4d6303c585b
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: null
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 13

Redirect headers

location: https://rp4.liadm.com/j?dtstmp=1720039146796&aid=a-06d7&se=e30&duid=ddc3c751f117--01j1x5515gyma6jcf9n4ke732m&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&wpn=lc-bundle&refr=https%3A%2F%2Fzourir.com%2F&cd=.quickenloans.com&i6=MjYwMDo4MDM6YTg4OjMwODI6Ojgy&n3pc=true
access-control-allow-origin: https://refinance.quickenloans.com
date: Wed, 03 Jul 2024 20:39:06 GMT
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET

GET
H2 204 247005605.js Show response
bat.bing.com/p/action/ 0
118 B 60ms
58ms Script
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/247005605.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Wed, 03 Jul 2024 20:39:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FEF7BA8383DD4FA0B65B3C564A439698 Ref B: PHL30EDGE0108 Ref C: 2024-07-03T20:39:06Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
360 B 80ms
79ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=247005605&Ver=2&mid=bbe29dec-af08-469b-8320-e18f23864600&sid=4afaa7e0397c11ef8d9d8f0186735c79&vid=4afbf6d0397c11ef857589e78044b50e&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&kw=refinance,%20mortgage,%20mortgages,%20refinancing,%20mortgage%20rates,%20refinance%20mortgage,%20refinance%20rates,%20refinancing%20rates,%20refinancing%20home,%20home%20loan,%20home%20loans,%20equity%20loans,%20home%20equity%20loans,%20home%20equity%20loan,%20second%20mortgage,%20home%20equity%20loan%20rates,%20credit%20card%20consolidation,%20debt%20loans,%20credit%20card%20debt%20consolidation,%20bad%20credit%20loans,%20debt%20free,%20bad%20credit,%20debt%20help,%20debt%20solutions,%20money%20management,%20credit%20card%20debt,%20personal%20loan,%20bad%20credit%20mortgage,%20mortgage%20calculator&p=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&r=https%3A%2F%2Fzourir.com%2F&lt=22780&evt=pageLoad&sv=1&rn=325639

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 03 Jul 2024 20:39:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 65AB6E644F24486D80464F15860B136C Ref B: PHL30EDGE0108 Ref C: 2024-07-03T20:39:06Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 409e6a74-8d7f-465e-87b0-cc6eb99f3a76.json Show response
tr.snapchat.com/config/com/ Frame B86B 100 B
406 B 317ms
117ms Fetch
application/json 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/config/com/409e6a74-8d7f-465e-87b0-cc6eb99f3a76.json?v=3.21.1-2407011851

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

0de7beadf73727d4f4f2b1fe7383e5a8f5481ca4dc3c0d0cfc13ac41818630b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
accept: application/json
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
observe-browsing-topics: ?1
content-type: application/json
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 46
access-control-allow-credentials: true
alt-svc: clear, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100

GET
H2 200 i
tr.snapchat.com/cm/ Frame 99F6 0
0 351ms
97ms Document
text/html 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=409e6a74-8d7f-465e-87b0-cc6eb99f3a76&u_scsid=eb1417a7-746b-4bd5-aae7-4c7fe0065c73&u_sclid=a69a23c7-03e7-44c1-ade9-7a78cb96ab03

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: clear h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 672
content-type: text/html
date: Wed, 03 Jul 2024 20:39:07 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
x-envoy-upstream-service-time: 0

GET
H2 200 token_create.js Show response
ct.pinterest.com/static/ct/ Frame B86B 4 KB
2 KB 75ms
74ms Script
application/javascript 23.62.168.244
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/static/ct/token_create.js

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.ea1c939c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.62.168.244 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-62-168-244.deploy.static.akamaitechnologies.com

Software

Resource Hash

cd56592299c1c670fb97ef28bcb50048508c01879ecb23b71364aecc0483e202

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:06 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.5a68dc17.1720039146.6c412c20
etag: "19c94b308deaf8fbf050b4fca2fa21b7"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=7200
content-length: 2108

GET
H2 200 ct.html
ct.pinterest.com/ Frame 8206 0
0 227ms
104ms Document
text/html 23.62.168.244
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/ct.html

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.ea1c939c.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.62.168.244 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-62-168-244.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

akamai-grn: 0.5a68dc17.1720039147.6c412de8
alt-svc: h3=":443"; ma=600
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Wed, 03 Jul 2024 20:39:07 GMT
pinterest-version: cac24a94a4695e758e25b435c5c0c6dca81d437a
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
vary: Accept-Encoding
x-cdn: akamai
x-envoy-upstream-service-time: 0
x-pinterest-rid: 4937290068368341

GET
H2 200 showads.js Show response
ads.anura.io/ 0
351 B 175ms
43ms XHR
application/javascript 108.139.29.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.anura.io/showads.js?650586601078
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.29.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-79.jfk50.r.cloudfront.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 10:31:16 GMT
content-encoding: gzip
via: 1.1 8cdf4e2d4f4070992665477c4dbca0c0.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: JFK50-P2
age: 36471
vary: Accept-Encoding
x-cache: Hit from cloudfront
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: application/javascript; charset=utf-8
x-amz-cf-id: Rx7HKWYhEpKrt5pR-hU09GgeqViJGf0dsUAN-avMRoL8t4eKzyvIgg==

POST
H2 200 p
tr.snapchat.com/ Frame B86B 0
261 B 173ms
85ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 03 Jul 2024 20:39:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 4
access-control-allow-credentials: true
alt-svc: clear, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
82 KB 60ms
60ms Script
application/javascript 2607:f8b0:400d:c04::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c04::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9e842557f7fb049d901149d9e111cd2f2e776542ba459f1120f8ac4e277301be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84106
x-xss-protection: 0
last-modified: Wed, 03 Jul 2024 19:50:59 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 03 Jul 2024 20:39:07 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 3 KB
2 KB 210ms
47ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1720039147229&cv=11&fst=1720039147229&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d3f11459f92236af794af16fa56915206bc59152147d617cd17e82d0cdf8091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1641
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/ 3 KB
2 KB 194ms
55ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/?random=1720039147253&cv=11&fst=1720039147253&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c430b3931b64a350b97d02d4ce07246316a68cebae7104de5ad390dd75d5cd1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1644
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 3 KB
2 KB 145ms
55ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1720039147302&cv=11&fst=1720039147302&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-700319321

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0e347c05d8b7288819c4498c2e2330f29956313ef44832c9821183159fafd7bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1641
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 3 KB
2 KB 115ms
51ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1720039147329&cv=11&fst=1720039147329&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-813495030

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5e3f963603cf93611ee16b37d0d50aa3b0846cb84e9ed11ac4ed49ef0a677ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1641
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 3 KB
2 KB 84ms
52ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1720039147360&cv=11&fst=1720039147360&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e13a62a662fd325037e57101607410a1be21190a1aab39174558b3ba81940d4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1643
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 3 KB
2 KB 47ms
47ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1720039147392&cv=11&fst=1720039147392&bg=ffffff&guid=ON&async=1&gtm=45be4710v9188725454za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-865435318

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccf6be6d8b52d8ecc073623d1f271e948a4d778d57f869577ad158f4a335773c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1648
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 click Show response
www.lmbahsj2.com/sdk/ 85 B
457 B 62ms
61ms Fetch
application/json 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/sdk/click?effp=98b6c7bdae565d337056d78448a9a1f5&sec_ch_ua_platform=Win32&sec_ch_ua_platform_version=10.0.0&sec_ch_ua_model=&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&oid=9&affid=233&__cc=&async=json&__qp=pkey1%7Cpkey2%7Cpkey3%7Cpkey%7Csourceid%7Csid%7Ccmpid%7Ccrtid%7Coid%7Caffid%7C_ef_transaction_id%7Cutm_medium%7Cutm_source%7Cutm_content&__rf=https%3A%2F%2Fzourir.com%2F&__efckuq=58
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b172de94defc613d21828dbf2e9b8a60bf9e6622fd1df983c233d5f7b8985034

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:07 GMT
via: 1.1 google
server: nginx
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
x-eflow-request-id: 2f86ffbc-772b-4494-a9d9-3c87b6481782
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 61ms
60ms Ping
application/json 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-DOSKZL216&batch_time=1720039147437
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 1x1.gif
a.mgid.com/ Frame B86B 43 B
269 B 42ms
42ms Image
image/gif 2606:4700:1::6813:854c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.mgid.com/1x1.gif?id=608665&type=c&tg=&r=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&nv=1&clid=&d=1720039147445

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:1::6813:854c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:07 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif
cf-ray: 89d9aedf9d050cb1-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 3 KB
2 KB 47ms
47ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1720039147467&cv=11&fst=1720039147467&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-857412364

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a8caaf3fceabc362e89de5ccc24eedf86dce7ea645a4c7b95de0e77c2260774e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1640
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/ 3 KB
2 KB 44ms
44ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/?random=1720039147502&cv=11&fst=1720039147502&bg=ffffff&guid=ON&async=1&gtm=45be4710za200zb9137104487&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9bd6e815812e6989227ffaa3c51badfda50321ee387d6e41a3e47bd39ba74380

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1654
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11388547050/ 3 KB
2 KB 44ms
44ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11388547050/?random=1720039147534&cv=11&fst=1720039147534&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11388547050

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c267662fa1a35abcc1546cdb0bdd49d3f210fe221478eccb76c68616dc5576e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1641
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/ 3 KB
2 KB 46ms
45ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/?random=1720039147562&cv=11&fst=1720039147562&bg=ffffff&guid=ON&async=1&gtm=45be4710v9188392713za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-755089552

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2046c1237ec7fbcaa2a5210df08f361169127c43a76350fcd5b05d09875fb52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1649
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11380533681/ 3 KB
2 KB 46ms
46ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11380533681/?random=1720039147591&cv=11&fst=1720039147591&bg=ffffff&guid=ON&async=1&gtm=45be4710v9168885163za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11380533681

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

617b56069cd833082ad32aa6b694be4fa02a4a40b51b74842fcf3b6921a4fddd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1652
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 response.json Show response
script.anura.io/ 141 B
480 B 238ms
146ms XHR
application/json 54.205.80.0
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/response.json?534482667711

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.205.80.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-205-80-0.compute-1.amazonaws.com

Software

nginx /

Resource Hash

793437869be95e830b245651f9eac807e12c81997a5fa0ab19b233384b202666

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
access-control-allow-methods: POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/ 3 KB
2 KB 44ms
44ms Script
text/javascript 2607:f8b0:400d:c03::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/?random=1720039147687&cv=11&fst=1720039147687&bg=ffffff&guid=ON&async=1&gtm=45be4710za200zb9137104487&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c03::9d Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c190ac517acb41d9912fbc0c8a16b759d7b49892945c82e7337187a1ca0c8894

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1648
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p
tr6.snapchat.com/ Frame B86B 0
46 B 179ms
72ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr6.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 03 Jul 2024 20:39:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1
via: 1.1 google, 1.1 google
server: API Gateway
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 162ms
47ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1720039147229&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLUIAFlfbham9_QEvIhSBLyD1tX-YImsz1ouWFb5EXsUYKkFoC&random=749712337&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/865435318/ 42 B
64 B 163ms
48ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865435318/?random=1720039147392&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710v9188725454za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLhzbH92jNthjOVomA23HPbcg-ZcQ0oPHnlsyFrVmKUjm5IaT6&random=3936790292&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/813495030/ 42 B
64 B 161ms
47ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/813495030/?random=1720039147329&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLVKLfvv_Ywbz5VgOyOPKF6vEilwCXJZq9o5B8jalVyn4bZpTv&random=1456261647&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 79ms
79ms Ping
application/json 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-DOSKZL216&batch_time=1720039147713
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866179376/ 42 B
64 B 153ms
49ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866179376/?random=1720039147360&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooL0h0Bf_3rKEbOR6H0ieDjLYDR5AA6GLA8X6-_PokZ7c_MkNyR&random=2716385001&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866176763/ 42 B
64 B 145ms
42ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866176763/?random=1720039147253&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLWDsujkq-9FxZCY90DdVPyL-6jMZ7aQgDYWJxUe6JokvafoFw&random=705681036&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/700319321/ 42 B
64 B 152ms
49ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/700319321/?random=1720039147302&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooL5bApz54PIidf4Sbw9Vf_mqJwN_3ZTnirHDWQMeBzDd5KH2cr&random=2888409254&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
trc.pushnami.com/api/push/ 2 B
168 B 117ms
117ms Fetch
text/html 107.21.125.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.21.125.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-21-125-170.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded
accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
key: 5fa1b4cbe02a560012bcbdf7
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Wed, 03 Jul 2024 20:39:07 GMT
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
content-length: 2
content-type: text/html; charset=utf-8

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 156ms
42ms Preflight 107.21.125.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.21.125.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-107-21-125-170.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/857412364/ 42 B
64 B 45ms
45ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/857412364/?random=1720039147467&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLi35QI4-kyeC0QC2ab3kSWd6eqGIuRgspLjWd38C4ywhR6sOK&random=2920822396&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10910338944/ 42 B
64 B 42ms
42ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10910338944/?random=1720039147502&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200zb9137104487&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLo8jSF2pzXLfux-J_oYYixiAK-WzGPXd-BdIuekjGBc-Fy80P&random=639549678&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/11388547050/ 42 B
64 B 51ms
51ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11388547050/?random=1720039147534&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLCeC_BsvCXK6pKwAH-XyTl8rafX0dIkdcvZ8YgA63Yv6e8I9v&random=3504537875&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/755089552/ 42 B
64 B 48ms
48ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/755089552/?random=1720039147562&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710v9188392713za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLRcRC65RMjOWibD8dQtMTn49jWbCr8XG_fRPBseEulu4mENm6&random=1208802760&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/11380533681/ 42 B
64 B 49ms
49ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11380533681/?random=1720039147591&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710v9168885163za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooL3zjRSPwIB739YjV_ZxvX8gps6rsDR6VTwDtgxZ9O-enmopG9&random=2451923028&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/848879802/ 42 B
64 B 47ms
46ms Image
image/gif 2607:f8b0:400d:c00::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848879802/?random=1720039147687&cv=11&fst=1720036800000&bg=ffffff&guid=ON&async=1&gtm=45be4710za200zb9137104487&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&ref=https%3A%2F%2Fzourir.com%2F&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1524523556.1720039146&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLTDyz4iHzOCcl_VO950gsoz6rLl7bXBsttGZ3lconKGY-pPXE&random=787695750&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c00::93 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:07 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p
tr.snapchat.com/ Frame B86B 0
45 B 72ms
71ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 03 Jul 2024 20:39:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 51ms
51ms Ping
application/json 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-DOSKZL216&batch_time=1720039147862
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H2 200 puba7383c50c7f3ca7bdbf0c5cfa256a231
rum-http-intake.logs.datadoghq.com/v1/input/ 0
0 90ms
88ms Ping
application/json 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-http-intake.logs.datadoghq.com/v1/input/puba7383c50c7f3ca7bdbf0c5cfa256a231?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Amsql-lre-webapp%2Cversion%3A1.1.0%20d-DOSKZL216&batch_time=1720039147908
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H2 200 favicon.ico
refinance.quickenloans.com/ 114 KB
23 KB 67ms
66ms Other
text/html 2606:4700::6812:d2b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/favicon.ico

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

86100ed087e0c70b96f721d9d6ba1a4764ff2b55c3846b659a453438eacfca56

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 03 Jul 2024 20:39:08 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
age: 277
x-powered-by: Express
x-xss-protection: 1; mode=block
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 89d9aee3b84972a1-EWR
expires: Thu, 04 Jul 2024 00:39:08 GMT

OPTIONS
H2 200 unip
trc.taboola.com/1074476/log/3/ Frame 0
0 50ms
50ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=1560&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1720039148122&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:08 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 17362
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039148.136129,VS0,VE18
x-vcl-time-ms: 18

OPTIONS
H2 200 unip
trc.taboola.com/1390358/log/3/ Frame 0
0 63ms
63ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=1561&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1720039148124&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:08 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 20959
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039148.144596,VS0,VE22
x-vcl-time-ms: 22

OPTIONS
H2 200 unip
trc.taboola.com/1467390/log/3/ Frame 0
0 55ms
54ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=1562&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1720039148125&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:08 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 21110
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039148.144557,VS0,VE22
x-vcl-time-ms: 22

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame B86B 0
442 B 46ms
45ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=1560&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1720039148122&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 20
date: Wed, 03 Jul 2024 20:39:08 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 18752
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039148.188084,VS0,VE20
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame B86B 0
118 B 52ms
51ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=1561&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1720039148124&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 19
date: Wed, 03 Jul 2024 20:39:08 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 17327
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039148.203528,VS0,VE19
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame B86B 0
234 B 50ms
49ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=1562&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1720039148125&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 22
date: Wed, 03 Jul 2024 20:39:08 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 20149
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039148.195769,VS0,VE22
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 unip
trc.taboola.com/1074476/log/3/ Frame 0
0 68ms
67ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=4564&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1720039151127&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:11 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 20745
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039151.155835,VS0,VE22
x-vcl-time-ms: 22

OPTIONS
H2 200 unip
trc.taboola.com/1390358/log/3/ Frame 0
0 68ms
67ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=4565&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1720039151128&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:11 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 20629
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039151.155794,VS0,VE22
x-vcl-time-ms: 22

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame B86B 0
101 B 47ms
47ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=4564&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1720039151127&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 18
date: Wed, 03 Jul 2024 20:39:11 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 17298
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039151.208802,VS0,VE18
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame B86B 0
63 B 48ms
47ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=4565&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1720039151128&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 19
date: Wed, 03 Jul 2024 20:39:11 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 17507
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039151.208767,VS0,VE19
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame B86B 0
437 B 48ms
47ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=4566&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1720039151129&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 22
date: Wed, 03 Jul 2024 20:39:11 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 20127
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-ewr18144-EWR
pragma: no-cache
server: nginx
x-timer: S1720039151.200737,VS0,VE22
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 unip
trc.taboola.com/1467390/log/3/ Frame 0
0 58ms
58ms Preflight 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=4566&scd=0&ssd=1&est=1720039146562&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1720039151129&mrir=u&vi=1720039146558&ref=https%3A%2F%2Fzourir.com%2F&cv=20240703-8-RELEASE&ler=other
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Wed, 03 Jul 2024 20:39:11 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 17669
x-served-by: cache-ewr18176-EWR
x-service-version: v1
x-timer: S1720039151.155752,VS0,VE18
x-vcl-time-ms: 18

POST
H2 204 collect Show response
analytics.google.com/g/ 0
54 B 42ms
41ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je4710v9169491831za200zb9137104487&_p=1720039144924&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=1646401858.1720039146&ul=en-us&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=3&sid=1720039146&sct=1&seg=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D233%26pkey2%3D42163%26pkey3%3D15f54c267ed34328b5071d48bda76b75%26pkey%3D445499539%26sourceid%3Daffl_everflow_ql-lre_9_233%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D233%26_ef_transaction_id%3D15f54c267ed34328b5071d48bda76b75%26utm_medium%3Daffiliate%26utm_source%3DDirect%2BAgents%252C%2BInc%26utm_content%3D&dr=https%3A%2F%2Fzourir.com%2F&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=scroll&epn.percent_scrolled=90&_et=6&tfd=27959&_z=fetch
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://refinance.quickenloans.com/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 03 Jul 2024 20:39:11 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cs-cdn.deviceatlas.com
URL: https://cs-cdn.deviceatlas.com/dacs.js

Domain: cdn.mortgage.quickenloans.com
URL: https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js

Verdicts & Comments Add Verdict or Comment

97 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

84 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 21:48:45	Name: X-AB Value: 0931215d128346ad979bb099e4b17240
.liadm.com/j	1970-01-21 07:23:19	Name: lidid Value: dac6d1eb-2024-46d9-bd54-27293b0e05d2
.t.co/	1970-01-21 07:23:19	Name: muc Value: 36edc727-fbb7-47ba-8205-68444351e2cd
.t.co/	1970-01-21 07:23:19	Name: muc_ads Value: 36edc727-fbb7-47ba-8205-68444351e2cd
.trkfocus.com/	1969-12-31 23:59:59	Name: st Value: aQkB7E8HIDqLCni2v7o15BqXXvaSJVoHVqe1dMD61ok57HaSDcqndw==
.trkfocus.com/	1970-01-21 07:23:19	Name: tfl Value: XYM+1rZL8CxAzOc9hiQFVBqXXvaSJVoHVqe1dMD61ok57HaSDcqndw==
.trkfocus.com/	1970-01-20 22:30:31	Name: c31895 Value: aQkB7E8HIDrxREbczeaheGch2J4EByrO1LG6Oc+CioaclQXiGiYkEQ==
www.lmbahsj2.com/	1970-01-20 21:48:45	Name: uniqueClick_FGXLG Value: ff56766d-217a-49dd-ad4c-dfafc115631f:1720039127
.quickenloans.com/	1970-01-21 06:32:55	Name: visitorId Value: 4ef9191f-9991-44db-9c82-45b28be483fa
refinance.quickenloans.com/	1970-01-21 06:32:55	Name: visitorId Value: 4ef9191f-9991-44db-9c82-45b28be483fa
refinance.quickenloans.com/	1970-01-20 21:57:23	Name: contentTarget Value: %7B%22sourceId%22%3A%22affl_everflow_ql-lre_9_233%22%7D
.lowermybills.com/	1970-01-20 21:47:20	Name: __cf_bm Value: 6HLHkgjSCE.6bhewhvAmOofdBrYvI0YUzQnV90mPDvM-1720039144-1.0.1.1-E9F3emUBCqcOAV4SwU3oVAFVdccbuWg0HxLaBDhj7GCdJFffiFWwzsHfsUHdaoBmx97bGv6EIXY3KI3oc.eN7g
.demdex.net/	1970-01-21 02:06:31	Name: demdex Value: 32315905616649428111521780889758458144
refinance.quickenloans.com/	1970-01-20 21:47:20	Name: _dd_s Value: rum=1&id=91b8bd74-cdf6-4cda-82e3-e27111cf9d0d&created=1720039146096&expire=1720040046096
.quickenloans.com/	1970-01-20 23:56:55	Name: _gcl_au Value: 1.1.1524523556.1720039146
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
.quickenloans.com/	1970-01-21 07:23:19	Name: _ga Value: GA1.1.1646401858.1720039146
.quickenloans.com/	1970-01-21 07:23:19	Name: _ga_RXLL9Z7XBK Value: GS1.1.1720039146.1.1.1720039146.60.0.0
.adsrvr.org/	1970-01-21 06:32:55	Name: TDID Value: 6e805a18-75d1-4593-a363-688617fb7498
refinance.quickenloans.com/	1970-01-20 21:57:23	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiOGM0ODE3NjctMjI3ZC01NjAyLTg3OTAtMjdmZTYzMGM4YTkyIiwidmlzaXRvcklkIjoiNGVmOTE5MWYtOTk5MS00NGRiLTljODItNDViMjhiZTQ4M2ZhIiwic2Vzc2lvbklkIjoiNTA1NTAwOGYtZDM3NS00YmJiLWJiMTUtYjVjYTJjMDg3YzExIiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiIyMzMiLCJwa2V5MiI6IjQyMTYzIiwicGtleTMiOiIxNWY1NGMyNjdlZDM0MzI4YjUwNzFkNDhiZGE3NmI3NSIsInBrZXkiOiI0NDU0OTk1MzkiLCJzb3VyY2VJZCI6ImFmZmxfZXZlcmZsb3dfcWwtbHJlXzlfMjMzIiwic2lkIjoiOSIsImNtcGlkIjoiOSIsImNydGlkIjoiIiwib2lkIjoiOSIsImFmZmlkIjoiMjMzIiwiX2VmX3RyYW5zYWN0aW9uX2lkIjoiMTVmNTRjMjY3ZWQzNDMyOGI1MDcxZDQ4YmRhNzZiNzUiLCJ1dG1fbWVkaXVtIjoiYWZmaWxpYXRlIiwidXRtX3NvdXJjZSI6IkRpcmVjdCBBZ2VudHMsIEluYyIsInV0bV9jb250ZW50IjoiIiwiYWdlIjpudWxsLCJkZXZpY2UiOm51bGwsImZvcmNlTmFtZXMiOm51bGwsImZvcmNlSXAiOm51bGwsImZvcmNlVGVzdElkcyI6bnVsbCwiaW5xdWlyeUlkIjpudWxsLCJpbnF1aXJ5U2lnbmF0dXJlIjpudWxsLCJpc1Rlc3QiOm51bGwsImxldmVsT2ZFZHVjYXRpb24iOm51bGwsIm1vaWQiOm51bGwsInByb3BlcnR5U3RhdGVDb2RlIjpudWxsLCJyZXNvbHV0aW9uIjoiIiwidHRUcmFjZUlkIjpudWxsLCJwcm92aWRlcklkIjpudWxsLCJxbHMiOm51bGwsInN0aWQiOm51bGwsIm92a2V5IjpudWxsLCJvdnJhdyI6bnVsbCwib3ZtdGMiOm51bGwsIm1vcnRnYWdlQmFsYW5jZVJhbmdlIjpudWxsLCJkYXRlTm93IjoxNzIwMDM5MTQ0OTg0LCJyYW5kb21OdW1iZXIiOjQwNDE1LCJtYXJrZXRpbmdPZmZlcklkIjpudWxsLCJ0aW1lT25Gb3JtU3RhcnRUaW1lIjoiMjAyNC0wNy0wM1QyMDozOTowNi4wODlaIiwib3JpZ2luUmVxdWVzdGVkVXJpIjoiaHR0cHM6Ly9yZWZpbmFuY2UucXVpY2tlbmxvYW5zLmNvbSIsInByZXNlbnRhdGlvbk5hbWUiOiIyOTE5NDk2X1FMX0xSRV9MYW5kaW5nX25ld1Rlc3RpbW9uaWFsVjIiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vcmVmaW5hbmNlLnF1aWNrZW5sb2Fucy5jb20vP3BrZXkxPTIzMyZwa2V5Mj00MjE2MyZwa2V5Mz0xNWY1NGMyNjdlZDM0MzI4YjUwNzFkNDhiZGE3NmI3NSZwa2V5PTQ0NTQ5OTUzOSZzb3VyY2VpZD1hZmZsX2V2ZXJmbG93X3FsLWxyZV85XzIzMyZzaWQ9OSZjbXBpZD05JmNydGlkPSZvaWQ9OSZhZmZpZD0yMzMmX2VmX3RyYW5zYWN0aW9uX2lkPTE1ZjU0YzI2N2VkMzQzMjhiNTA3MWQ0OGJkYTc2Yjc1JnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9RGlyZWN0K0FnZW50cyUyQytJbmMmdXRtX2NvbnRlbnQ9IiwidmVydGljYWxOYW1lIjoiTVNRTF9MUkVfTEFORElORyIsInJlZmVycmluZ1VyaSI6Imh0dHBzOi8vem91cmlyLmNvbS8iLCJmbG93SWQiOiJNU1FMX0xSRV9XSEFNX0xBTkRJTkdfVkVSVElDQUxfRkxPV18xIiwidGVzdElkIjoyMTczMTcyLCJjbGllbnRJcEFkZHJlc3MiOiIyNjAwOjgwMzphODg6MzA4Mjo6ODIiLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI2LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJib3QiOmZhbHNlLCJpYXQiOjE3MjAwMzkxNDZ9.nDbCkbYcWxJuUbKYEYSmuBkMAT7ElbFnQjGEjkZVVKhv8ml6qKYkReVHva5se-cCzS95f9CB22mTCzgNEdhKD5apQuLG2V-uS2DrUQSA8RflHfgZ7q2Ks1tfmrXsYv15lbi_itZXnTKXB-E40A4bw07kWZWXa38jsVxtHeknvJH2_9_BigW85Ia2ONeGE4XBY6k0i-xwsNQcN_mUIwhSEanVwmrIRekTGQnxPLGxsk037r_4N8cazQQ3mhRy_rPSsN5IWrmdwCYcFTqlI1p716VdabJYkJqBUmFMDbfvFXvq_2UxG83akYDw2zeoz7x0vvOTm2p548qrSSQprhRfCjXm_2E3dHlwst8_xJjOGrnHGFz55TUVL4vPGRJ3cTLzsAGy-JTDFcj7NQ0zSqi92V36f5NMxR9YnJQfpFzxCz6SIBJ7Wmkief958W0T3uQbnD-7ls0xI3nRlxDhQRZ6iCTz6qv8tOMBBlbqdx8rReeD_qR5Vo6RqFnOf9KKezWGAnHR-PJgIZdauz_5hu9czI-6J2fgWYtiKEXxuQQshBn07YfP9u1_n16vtwzoXIEUiqMlHbluMuiLwrEQExgqeb45H1PymwrdPFW30j36meDPgt2s1H0eD2Zpv0Bycuw-Xr6wdWzlcGBUafHsiu5hkzSfBWcgCJuZj1cttLbgMLQYO1S6wyVt7NvPqCz43PWUl6L3ssy6iVBCELhMIinqgM_yELR8YxhIwDCqPGut9rTwmd7O_Nkdt3SoOzX2ZdOZfsMZnq8su6rbQz_PWPTrs8KHZ8sLe5ltB3ngNcsGkCJNkcAxnHGt6HlR4NNgqAFSvw0ElqvXCpsQFJVm6I78hDY2VueVGZczt2YnE_8qzUhlZqnP9SBxT8ZQjp-PptXt532neowS09p-Yil353UP4dlEl_8I7D3W-Y2c0bPa-DPzA_d0NU1V5DpYVWrw3vT7WroEeYbhWrP8gYm5kZyQlG-d-ekOpPp60NOiW62esn_edl3LNn8puwKYH8MeDy3HMYLcKxbZjPVzUfKC48bupU2PgixA7jItVMtZGYjYHu58DAdekjwWQ3hbEjhKVT82PPZlbC4VMUnDbKNC8ZeswaazsxiTAY7XbWHRSz6bPtQyneX8wm5TeChZX3CJhqkfl2-arhIOT8C7K99JJbeL_QdvRFCfe26BlmogokuGzm0fsSC0QkZMeVXQ3GIEgouRoWrqan25rdP5-x3d9tgTm0KSjk4iiNBLfj2gl9AfjwIB6NMeUJq1hgNWkygP9LUcBi4Q_RAGdgDydB5C9GhiRL2YNd3cgemP-E-tUp7b7j60j0uv3HlTlafkScw0tCGYdHGgy4-oGus-vBTGJ4hhbQ
.quickenloans.com/	1970-01-21 07:23:19	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 179643557%7CMCIDTS%7C19908%7CMCMID%7C32123023136735247551536565546179470824%7CMCAAMLH-1720643946%7C7%7CMCAAMB-1720643946%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1720046346s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.5.0
.adnxs.com/	1970-01-20 23:56:55	Name: XANDR_PANID Value: qOPm62fAIKZAeIxikFoDTo9NyKRR8RbMyQ9P9Vfo2_nYW--YLdI_PQVV9UmWrKK2SYY9PjQjm_hwAap2ayM7EEkn70iFCyE30j77Rq8ApTI.
.adnxs.com/	1970-01-21 07:23:19	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 23:56:55	Name: uuid2 Value: 8041705718402632460
.demdex.net/	1970-01-21 02:06:31	Name: dextp Value: 21-1-1720039146414\|771-1-1720039146515
.media6degrees.com/	1970-01-21 02:06:31	Name: acs Value: 014020i0j0k1sg2ep6xzt10xzt10xzt10
.quickenloans.com/	1970-01-20 23:56:55	Name: _fbp Value: fb.1.1720039146616.991983745440789824
.media6degrees.com/	1970-01-21 02:06:31	Name: clid Value: 2sg2ep601170qnp8x7yst3780000000155010r01701
.media6degrees.com/	1970-01-21 02:06:31	Name: sglst Value: 44xl00bh01np387le
.mortgage.quickenloans.com/	1970-01-20 21:47:20	Name: __cf_bm Value: hc13A7rg4xX1jflUmIPH2ZtRfx0WqGjwxkJsI.9OXv4-1720039146-1.0.1.1-ta4WPcvul2MvmjsJZqpfm6OYNsR4O53AnFpaGUcuWzoUBeyrmvu8Y1N0QtJDTes04SHz.kAKtzpVn7lJ86hbWg
.quickenloans.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .quickenloans.com
.quickenloans.com/	1970-01-21 07:23:19	Name: _lc2_fpi Value: ddc3c751f117--01j1x5515gyma6jcf9n4ke732m
.quickenloans.com/	1970-01-21 07:23:19	Name: _lc2_fpi_meta Value: {%22w%22:1720039146673}
.agkn.com/	1970-01-21 06:32:55	Name: ab Value: 0001%3AeZFRBB6Derrb1tzYf8uB7%2BPoa%2BaooLta
.quickenloans.com/	1970-01-21 07:23:19	Name: mbox Value: session#32123023136735247551536565546179470824-aBhqfM#1720041006
.quickenloans.com/	1970-01-20 21:47:20	Name: mboxEdgeCluster Value: 34
.quickenloans.com/	1970-01-20 21:47:20	Name: kndctr_5D60123F5245B13E0A490D45_AdobeOrg_cluster Value: va6
.quickenloans.com/	1970-01-21 07:16:07	Name: kndctr_5D60123F5245B13E0A490D45_AdobeOrg_identity Value: CiYzMjEyMzAyMzEzNjczNTI0NzU1MTUzNjU2NTU0NjE3OTQ3MDgyNFIQCIGJytKHMhgBKgNWQTYwA_ABgYnK0ocy
.dpm.demdex.net/	1970-01-21 02:06:31	Name: dpm Value: 32315905616649428111521780889758458144
.doubleclick.net/	1970-01-21 07:23:19	Name: IDE Value: AHWqTUkCsOUqmKl8dCqXU2m6yEzvt6ZFX4HsouJJC6KGckjYR6rXvQD2FcS3oAiDafs
.quickenloans.com/	1970-01-21 07:17:05	Name: _scid Value: 7ea8e280-c1e5-4578-b99e-3ad3f60a06a1
.quickenloans.com/	1970-01-21 07:17:05	Name: _scid_r Value: 7ea8e280-c1e5-4578-b99e-3ad3f60a06a1
.taboola.com/	1970-01-21 06:32:55	Name: receive-cookie-deprecation Value: 1
.quickenloans.com/	1970-01-20 21:48:45	Name: _uetsid Value: 4afaa7e0397c11ef8d9d8f0186735c79
.quickenloans.com/	1970-01-21 07:08:55	Name: _uetvid Value: 4afbf6d0397c11ef857589e78044b50e
.mgid.com/	1970-01-20 21:47:20	Name: __cf_bm Value: XtdBjdy2OmKUM5BG5wYfwPEJCJekImQMZBeLNWrcZYs-1720039146-1.0.1.1-oY4HUAEk60CbS32J4jQLEMaW0fwTATNyjzH3kVpA7BrYwwq3vciWynqWq3AYQNXTB0_.aGq70c4CQ7Yjtzk5gQ
.refinance.quickenloans.com/	1970-01-20 23:56:55	Name: MgidSensorNVis Value: 1
.refinance.quickenloans.com/	1970-01-20 23:56:55	Name: MgidSensorHref Value: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content=
.pmsrv.co/	1970-01-20 23:58:43	Name: _pmedia_opt-out Value: 1
.pinterest.com/	1970-01-21 06:32:55	Name: ar_debug Value: 1
.refinance.quickenloans.com/	1970-01-21 06:32:55	Name: _pin_unauth Value: dWlkPU16azVOREUwTjJZdE1ETTVOQzAwWlRNMUxUaGtNMlV0WlRBM1l6RTBOR1JtT0RGaQ
.bing.com/	1970-01-21 07:08:55	Name: MUID Value: 2B91BCA5F389662E2777A814F24B6786
.bat.bing.com/	1970-01-20 21:57:23	Name: MR Value: 0
.taboola.com/	1970-01-21 06:32:55	Name: t_gid Value: 2a03fb00-ae6c-4476-8610-2c1fcae9c66e-tuctd7f3c6a
.taboola.com/	1970-01-21 06:32:55	Name: t_pt_gid Value: 2a03fb00-ae6c-4476-8610-2c1fcae9c66e-tuctd7f3c6a
.casalemedia.com/	1970-01-21 06:32:55	Name: CMID Value: ZoW26tHM66wAAE.gAYRRDwAA
.casalemedia.com/	1970-01-20 23:56:55	Name: CMPS Value: 1330
.casalemedia.com/	1970-01-20 23:56:55	Name: CMPRO Value: 1330
.rubiconproject.com/	1970-01-21 06:32:55	Name: audit_p Value: 1\|e1rhtx8SGocqIdqrYOyQAZ3SYQAuBd9KyjEqLAAaHXHCWWOn7PymVimltZSFg5w1MNOOoVuI2+mM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLu1Gqb7uoh/T8iEa1YFJkBRv8HZdLVP4OabA96B4ySo2mcgiaIwjeYE5jPYX1GOk3NbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.rubiconproject.com/	1970-01-21 06:32:55	Name: khaos Value: LY6AWBT2-A-55B1
.rubiconproject.com/	1970-01-21 06:32:55	Name: khaos_p Value: LY6AWBT2-A-55B1
.rubiconproject.com/	1970-01-21 06:32:55	Name: audit Value: 1\|e1rhtx8SGocqIdqrYOyQAZ3SYQAuBd9KyjEqLAAaHXHCWWOn7PymVimltZSFg5w1MNOOoVuI2+mM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLu1Gqb7uoh/T8iEa1YFJkBRv8HZdLVP4OabA96B4ySo2mcgiaIwjeYE5jPYX1GOk3NbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.liadm.com/	1970-01-21 07:23:19	Name: lidid Value: dac6d1eb-2024-46d9-bd54-27293b0e05d2
.revjet.com/	1970-01-21 07:23:19	Name: trx Value: 5139363640881874397
.snapchat.com/	1970-01-21 07:08:55	Name: sc_at Value: v2\|H4sIAAAAAAAAAE3GwQ3AMAgEsImQjkAP0W2CKFNk+Hzrl5FJ211CJMUNLWUd8syK4uz5lEcdr8YCLNXj/IoLBiEQxEAAAAA=
www.lmbahsj2.com/	1970-01-20 21:48:45	Name: uniqueClick Value: 137c2248-de22-4f13-97b0-8109a4448c39:1720039147
www.lmbahsj2.com/	1970-01-20 23:56:55	Name: transaction_id Value: 15f54c267ed34328b5071d48bda76b75\|15f54c267ed34328b5071d48bda76b75
.mgid.com/	1970-01-21 06:32:55	Name: muidn Value: o637_a_8_MDd
.pubmatic.com/	1970-01-20 23:56:55	Name: KRTBCOOKIE_377 Value: 22918-6e805a18-75d1-4593-a363-688617fb7498&KRTB&22926-6e805a18-75d1-4593-a363-688617fb7498&KRTB&23031-6e805a18-75d1-4593-a363-688617fb7498
.pubmatic.com/	1970-01-20 22:30:31	Name: PugT Value: 1720039146
.quickenloans.com/	1970-01-20 21:57:23	Name: _ScCbts Value: %5B%5D
.tapad.com/	1970-01-20 23:13:43	Name: TapAd_TS Value: 1720039147594
.tapad.com/	1970-01-20 23:13:43	Name: TapAd_DID Value: 9a663a28-4f84-42ed-b8b4-d05f4c9a1494
.tapad.com/	1970-01-20 23:13:43	Name: TapAd_3WAY_SYNCS Value:
.quickenloans.com/	1970-01-20 22:30:31	Name: ef_witness Value: 1
.quickenloans.com/	1970-01-20 22:30:31	Name: ef_affid Value: 233
.quickenloans.com/	1970-01-20 22:30:31	Name: ef_tid_c_o_9 Value: 15f54c267ed34328b5071d48bda76b75
.quickenloans.com/	1970-01-20 22:30:31	Name: ef_tid_c_a_1 Value: 15f54c267ed34328b5071d48bda76b75
.quickenloans.com/	1970-01-21 07:17:05	Name: _sctr Value: 1%7C1720000800000
.bidswitch.net/	1970-01-21 06:32:55	Name: tuuid Value: 09826d2c-767f-49fb-9d80-3a654678f87c
.bidswitch.net/	1970-01-21 06:32:55	Name: c Value: 1720039147
.bidswitch.net/	1970-01-21 06:32:55	Name: tuuid_lu Value: 1720039148
.adsrvr.org/	1970-01-21 06:32:55	Name: TDCPM Value: CAESFwoIYXBwbmV4dXMSCwj8wIT2xuqNPRAFEhUKBmdvb2dsZRILCLjvgffG6o09EAUSFgoHcnViaWNvbhILCJbihPbG6o09EAUSFQoGY2FzYWxlEgsIxpuC98bqjT0QBRIXCghwdWJtYXRpYxILCIywxfnG6o09EAUSGAoJYmlkc3dpdGNoEgsI1vn5_sbqjT0QBRgFOAFCBCICCAE.
.refinance.quickenloans.com/	1970-01-20 21:47:20	Name: __cf_bm Value: nrg9JMCkRZY.cLrxMzJ5nyp.h_F6b0TcwDPzRhs4zrg-1720039148-1.0.1.1-8zzw4G5.iDcssL.OUggHAqcc8_dvBtC1ncqcDnDxf7uDeEtBPyopatiqTJ26z.K63RwoxU7wcYj3FKyz0hmYVA

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cs-cdn.deviceatlas.com/dacs.js Message: Failed to load resource: net::ERR_CONNECTION_CLOSED
other	error	URL: https://refinance.quickenloans.com/?pkey1=233&pkey2=42163&pkey3=15f54c267ed34328b5071d48bda76b75&pkey=445499539&sourceid=affl_everflow_ql-lre_9_233&sid=9&cmpid=9&crtid=&oid=9&affid=233&_ef_transaction_id=15f54c267ed34328b5071d48bda76b75&utm_medium=affiliate&utm_source=Direct+Agents%2C+Inc&utm_content= Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mgid.com
action.dstillery.com
action.media6degrees.com
adobedc.demdex.net
ads.anura.io
ads.revjet.com
analytics.google.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
bat.bing.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cm.g.doubleclick.net
connect.facebook.net
content.lowermybills.com
content.refinance.quickenloans.com
cs-cdn.deviceatlas.com
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
fonts.cdnfonts.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
insight.adsrvr.org
match.adsrvr.org
pix.revjet.com
pixel.rubiconproject.com
psp.pushnami.com
quicken.demdex.net
refinance.quickenloans.com
rp.liadm.com
rp4.liadm.com
rum-http-intake.logs.datadoghq.com
s.pinimg.com
sc-static.net
script.anura.io
simage2.pubmatic.com
somni.rocketmortgage.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
stats.g.doubleclick.net
storage.googleapis.com
t.co
tr.snapchat.com
tr6.snapchat.com
trackpixel.refinance.quickenloans.com
trc.pushnami.com
trc.taboola.com
trkfocus.com
trkmrk.com
url.us.m.mimecastprotect.com
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
x.bidswitch.net
zourir.com
cdn.mortgage.quickenloans.com
cs-cdn.deviceatlas.com
104.18.36.155
104.36.113.107
107.21.125.170
108.138.129.160
108.139.29.79
15.204.44.87
151.101.65.44
173.194.66.157
18.164.124.33
18.164.124.56
18.173.219.101
18.210.69.85
18.232.203.164
192.3.45.74
2001:4860:4802:34::181
205.139.111.12
23.62.168.244
2600:1408:ec00:289::1931
2600:1408:ec00:886::1e80
2600:1f18:24e6:b902:71fe:3cd6:642e:a4e1
2600:1f18:730:b110:ad0a:6457:c7a4:96de
2600:9000:23cb:0:8:8845:1500:93a1
2600:9000:2514:8200:a:8e7d:9900:93a1
2606:4700:1::6813:854c
2606:4700:3036::ac43:b89e
2606:4700:4400::6812:2412
2606:4700::6810:5049
2606:4700::6812:1ef5
2606:4700::6812:c2b
2606:4700::6812:d2b
2607:f8b0:400d:c00::5e
2607:f8b0:400d:c00::93
2607:f8b0:400d:c03::9d
2607:f8b0:400d:c04::61
2607:f8b0:400d:c04::9c
2607:f8b0:400d:c0e::cf
2607:f8b0:400d:c0f::5f
2620:1ec:c11::237
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
2a04:4e42:400::300
3.163.245.4
3.209.149.25
3.216.97.11
35.190.43.134
35.201.76.131
35.211.178.172
51.81.49.47
52.201.12.52
52.206.87.211
52.223.40.198
54.205.80.0
63.140.39.130
63.140.39.9
68.67.160.184
69.173.146.5
72.21.81.130
74.125.192.156
02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9
0a2f032261be668c4ebdb28502c882682bfda90aca02a30325678fedb8cfa90d
0de7beadf73727d4f4f2b1fe7383e5a8f5481ca4dc3c0d0cfc13ac41818630b3
0e347c05d8b7288819c4498c2e2330f29956313ef44832c9821183159fafd7bf
1847b6eb065d9c498ca655abf36ce3daccfb7f20eba97bcacdf7278320e457c0
18aba4f0a8e697735a4382e45658d39d3d8979292fea2fa1c17e2f4d3b7006be
196dc3440f8ca1afa96fb9d6fa5dbcf885ef098b9760a1a515f41f5c6b53f9b2
1a6435ec41848bb2da51f6c469d1168e15993000f11a96638cbd488b06ba3ad4
1b983bac0271f4bee7ca9d457a7ed6fe0d8d8c2381ee478903afdc3428a4563a
22a7c0f21be2b8240a32adb4e3b490724a69eee63bf02e47615f6d001c0f81f6
255ba74255fbca81c035cceb9c1a9ab9be2849ab7a8a39f28deea6fe19a79e51
28c197dfc2c26b6d901bc0efdf6439b77bf10a2a1f98a3acc5d65abaf788c27b
29502f440e5e16b564bbd6922c08e44a959ef72aff8c4e41d9ecb57cb3bc2e06
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
2ebc3cd1d0af023685181ad52ed67b334bad44ea95407db09b40c2de15fcc165
324b7ec9e04334641dcfb98066f7d0afdcb237395e6f89afda2e809eb738f0a0
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
437565448cf65bc008ecf3420fba411dcb0de63fd31e0a3ed0d9423d7d1a6c65
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
45d2c055791d072ed388bb395f90aaebf2425189bbd03942b8f60855ba4f6988
4c5e7d4ce4eeb1e758d9e6d2f0921ee74a5678da15c290fc4745b877365828fb
4d2816f1f714364675a3a4ff25db96f2a5677b6cce94e150e61250bfdde4d258
4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b
5436f0e9041e12e7200c44df4cef7591c4a295b714257721df003a7836c1904f
55cbdff52a4ce0061ff5347c7003f6086224a8f5b5d7d3afa3feb420ec8585b5
5612e07185add6333ccf39345089eedafce9235ae2770f3e3c93e88805532780
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58c372996464132cf3b5a9b6daa5830ec34697a9990e78f2c781fbe3c9d3803e
58ecbfa481697f15a58c0a6b3b406cb86b8e672cac1d3b3156a789df07d86460
592f244a454b1fabb9420ddc74002f325b0ebfc4d912815f45a4585b0685da8f
617b56069cd833082ad32aa6b694be4fa02a4a40b51b74842fcf3b6921a4fddd
63bae03aa97278acb1d6f7863e593999bbdc5d280d2fa5a3050f234ce5eee850
64a6e8d00c22b320355dc737581468bfe44b606aecbfe2fc7d2d57ea4c1c2ad8
6c0aae3d1aa01a726f26a61cfbf8d497b8f31407acb85bb384bf0604b79861f7
71ca1526b583a6283752d155fada0ed1a64f1ea43cf17d88f4d39cfc315cc7d9
72c1bab19ae1dc60cc73c71c0a8f59777c85913e59e2b4487cd11e70bd928c23
76b65310895e8341f3804e1f3d436a0910928874964daf20f6e2d7a8a69553f4
78e29b268c01b538dbbcdc8092318bd0a71036997182bcc04e89d71e4f8fb7d9
793437869be95e830b245651f9eac807e12c81997a5fa0ab19b233384b202666
7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3
7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
86100ed087e0c70b96f721d9d6ba1a4764ff2b55c3846b659a453438eacfca56
899c415d3ec88c9d57d8a270492594334e24549976bf0852131bfea0a5aefcde
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f6b883d93b2767c0d04efeeeb65ac92a170c1d966fefc635586d233e5f318cc
962f8da44a5e7f4416402f6bc4a7165ab26cef621f6c24cb74f5e8db5fdc5f9e
971b2673f92ee01c1b6e98372fdefdd4f0a83714167783eba0671fa0d966f9f7
9a2b61aadc50a578eeef4543776bc42810a97a88470a39659be5b9b27c51be90
9bd6e815812e6989227ffaa3c51badfda50321ee387d6e41a3e47bd39ba74380
9d3f11459f92236af794af16fa56915206bc59152147d617cd17e82d0cdf8091
9e842557f7fb049d901149d9e111cd2f2e776542ba459f1120f8ac4e277301be
9fd0bb540bd3576344a289390fed47f224d154e118644a89fa2dd0245ee6956e
a476128af7a13f7a6e18c1640e2bf92faaa68537186204f6fc8456d83760ed70
a8caaf3fceabc362e89de5ccc24eedf86dce7ea645a4c7b95de0e77c2260774e
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b172de94defc613d21828dbf2e9b8a60bf9e6622fd1df983c233d5f7b8985034
b2046c1237ec7fbcaa2a5210df08f361169127c43a76350fcd5b05d09875fb52
b5187f214868ccaf0cab0a1ad7167b3f0d10d914ccabb4fd2729cad9101bb55e
b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
c190ac517acb41d9912fbc0c8a16b759d7b49892945c82e7337187a1ca0c8894
c267662fa1a35abcc1546cdb0bdd49d3f210fe221478eccb76c68616dc5576e5
c338d337018765cff13a76b6984e86924b163c980ae75b6165cb37ea13962820
c430b3931b64a350b97d02d4ce07246316a68cebae7104de5ad390dd75d5cd1d
c5e3f963603cf93611ee16b37d0d50aa3b0846cb84e9ed11ac4ed49ef0a677ad
ccf6be6d8b52d8ecc073623d1f271e948a4d778d57f869577ad158f4a335773c
cd35d03cc363c21dafc6bb78ba34fa54cc77ff6f6060814039c36e97bb69cfcd
cd56592299c1c670fb97ef28bcb50048508c01879ecb23b71364aecc0483e202
d23d5715ffe428ffa9ce297fba04eb9ba463cbc6478269f0c53ceeeada3c95c6
d8cbc596bdee9ceb0f3b176892acfb59f5535b3ab2f7f3da519a9c59a7389531
e13a62a662fd325037e57101607410a1be21190a1aab39174558b3ba81940d4f
e2125edb15f1bd4d39e295d65696a672d4333505e5f2d66a576c0f30eec249b3
e396e7a333fb85cf7ade2cb26a23c33f8ec13d63a723a72b5df0512cbdfdfc96
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea29aec9d81ce2ee8f9b3a93930d765a9fad14e9573e82fcde73153239b63019
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
efc6ca568cdf9d36f57664a37cceeab3585bb68a764e331c7c81e240e8d18137
f21ce40b16925c76f891adf9aff87c84e535e6263acf1bcc7d1427fca0431d2f
f6b982382b9995d6359fc0868e8b3e7f5323d1cf89462d2e3b6f6e02c7048f29
fcc3c439edc63318783aed993f9d2a5be255270297b5453bceb2384d9993886c
fe3008f7e6675d3979dffb4c0cbe7bd433f03feda8ba2e00bc849b726b246186
fef95b324850099ff32808fb88cbf0af034d69cc4558110ea65e3b323fc17d0e

refinance.quickenloans.com Open in urlscan Pro 2606:4700::6812:d2b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

150 Requests

93 %HTTPS

43 %IPv6

45 Domains

64 Subdomains

50 IPs

2 Countries

2375 kBTransfer

7362 kBSize

84 Cookies

21 Outgoing links

Page URL History

Redirected requests

150 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700::6812:d2b Public Scan

Screenshot
Live screenshot

Full Image

150
Requests

93 %
HTTPS

43 %
IPv6

45
Domains

64
Subdomains

50
IPs

2
Countries

2375 kB
Transfer

7362 kB
Size

84
Cookies

150 HTTP transactions
0 data transactions