halliburton.savings.beneplace.com Open in urlscan Pro
104.18.7.126 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://e.email.workingadvantage.com/click?EaHVzc2Fpbi5hbGhheWtAaGFsbGlidXJ0b24uY29t/CeyJtaWQiOiIxNzIxOTQwNjk3MDI0ZDViMGNlNWM4YzgxIiw...
Effective URL:
https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-...
Submission: On August 04 via manual (August 4th 2024, 11:18:01 am UTC) from IN — Scanned from DE

Summary HTTP 129 Redirects Behaviour Indicators

Summary

This website contacted 17 IPs in 3 countries across 12 domains to perform 129 HTTP transactions. The main IP is 104.18.7.126, located in and belongs to CLOUDFLARENET, US. The main domain is halliburton.savings.beneplace.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 1st 2023. Valid for: a year.

This is the only time halliburton.savings.beneplace.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	96.47.24.171 96.47.24.171	46263 (EDIALOG) (EDIALOG)
2 56	104.18.7.126 104.18.7.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	23.35.236.237 23.35.236.237	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
3	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
4	172.217.18.106 172.217.18.106	15169 (GOOGLE) (GOOGLE)
4	2001:4860:480... 2001:4860:4802:38::178	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
3	142.250.181.232 142.250.181.232	15169 (GOOGLE) (GOOGLE)
3	2602:816:5001... 2602:816:5001::39	54113 (FASTLY) (FASTLY)
6	162.247.241.14 162.247.241.14	23467 (NEWRELIC-...) (NEWRELIC-AS-1)
6	216.58.206.46 216.58.206.46	15169 (GOOGLE) (GOOGLE)
2	216.239.32.36 216.239.32.36	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
129	17

1 96.47.24.171 (United States) 1 redirects

ASN46263 (EDIALOG, US)
PTR: mx1.bm16.maas.zetaglobal.net

e.email.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

56 104.18.7.126 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

halliburton.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
controlpanel.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
auth.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.35.236.237 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-237.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.18.106 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f106.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.181.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2602:816:5001::39 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 162.247.241.14 (Portland, United States)

ASN23467 (NEWRELIC-AS-1, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 216.58.206.46 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s10-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.239.32.36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	beneplace.com 2 redirects halliburton.savings.beneplace.com controlpanel.savings.beneplace.com — Cisco Umbrella Rank: 505921 auth.savings.beneplace.com — Cisco Umbrella Rank: 175792	2 MB
14	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 104 region1.google-analytics.com — Cisco Umbrella Rank: 3123	21 KB
10	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 521	173 KB
9	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	284 KB
6	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 441	3 KB
6	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 567	240 KB
3	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 1453	24 KB
3	gstatic.com fonts.gstatic.com	14 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	14 KB
3	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 410	30 KB
2	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 554	7 KB
1	workingadvantage.com 1 redirects e.email.workingadvantage.com — Cisco Umbrella Rank: 373136	444 B
129	12

	Domain	Requested by
39	halliburton.savings.beneplace.com	1 redirects halliburton.savings.beneplace.com auth.savings.beneplace.com
10	auth.savings.beneplace.com	1 redirects halliburton.savings.beneplace.com auth.savings.beneplace.com
10	www.google-analytics.com	halliburton.savings.beneplace.com auth.savings.beneplace.com
10	assets.adobedtm.com	halliburton.savings.beneplace.com assets.adobedtm.com auth.savings.beneplace.com
9	www.googletagmanager.com	halliburton.savings.beneplace.com auth.savings.beneplace.com
7	controlpanel.savings.beneplace.com
6	bam.nr-data.net	halliburton.savings.beneplace.com js-agent.newrelic.com auth.savings.beneplace.com
6	maps.googleapis.com	halliburton.savings.beneplace.com auth.savings.beneplace.com
4	region1.google-analytics.com	halliburton.savings.beneplace.com auth.savings.beneplace.com
3	js-agent.newrelic.com	halliburton.savings.beneplace.com auth.savings.beneplace.com
3	fonts.gstatic.com	halliburton.savings.beneplace.com auth.savings.beneplace.com
3	cdnjs.cloudflare.com	halliburton.savings.beneplace.com auth.savings.beneplace.com
3	cdn.jsdelivr.net	halliburton.savings.beneplace.com auth.savings.beneplace.com
2	cdn.cookielaw.org	auth.savings.beneplace.com halliburton.savings.beneplace.com
1	e.email.workingadvantage.com	1 redirects
129	15

This site contains no links.

Subject Issuer	Validity	Valid
beneplace.com Cloudflare Inc ECC CA-3	`2023-12-01` - `2024-11-30`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
upload.video.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-03-21` - `2025-04-22`	a year	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2024-03-01` - `2024-12-31`	10 months	crt.sh

This page contains 2 frames:

Frame: https://auth.savings.beneplace.com/auth/authorize?subdomain=halliburton&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3Futm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
Frame ID: 886047F993996C9F2EC85F753F92B2DC
Requests: 129 HTTP requests in this frame

Frame: https://halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/8c81cb09042c/main.js
Frame ID: B8D8A2FA96D409103BECA43D2E7335DD
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Halliburton EXTRAS US

Page URL History Show full URLs

https://e.email.workingadvantage.com/click?EaHVzc2Fpbi5hbGhheWtAaGFsbGlidXJ0b24uY29t/CeyJtaWQiOiIxNzIxOTQwNjk3MDI... HTTP 302
https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_sour... Page URL
https://auth.savings.beneplace.com/auth/authorize?subdomain=halliburton&response_type=code&client_id=9ezalirn45... HTTP 302
https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_... Page URL
https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

129
Requests

87 %
HTTPS

47 %
IPv6

12
Domains

15
Subdomains

17
IPs

3
Countries

2633 kB
Transfer

19979 kB
Size

12
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://e.email.workingadvantage.com/click?EaHVzc2Fpbi5hbGhheWtAaGFsbGlidXJ0b24uY29t/CeyJtaWQiOiIxNzIxOTQwNjk3MDI0ZDViMGNlNWM4YzgxIiwiY3QiOiJlYmctd2FnMy05YzNjMjA1M2JhOTc5YjgyYjRlMDM1MWI1NWIzNWY2YS0xIiwicmQiOiJoYWxsaWJ1cnRvbi5jb20ifQ/VaHR0cHM6Ly9oYWxsaWJ1cnRvbi5zYXZpbmdzLmJlbmVwbGFjZS5jb20vaG9tZQ/SWkhfZWJnd2FfTkRCQU0wNzI1MjAyNGMxMzQ1Mzk5YjE/LZWIy/qP0RMSz04d2hja2E1b3E0aDA1Y2dkanpsZDE3Z256JnV0bV9tZWRpdW09SnVseS0yNS0yMDI0LVQtTW9iaWxlJnV0bV9zb3VyY2U9ZW1haWwmY29udl9zb3VyY2U9emV0YSZ1dG1fY2FtcGFpZ249aG9tZS1saW5rLW1hcmtldHBsYWNl/gZqK6vg/s2q5fe56576 HTTP 302
https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace Page URL
https://auth.savings.beneplace.com/auth/authorize?subdomain=halliburton&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace HTTP 302
https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace Page URL
https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://e.email.workingadvantage.com/click?EaHVzc2Fpbi5hbGhheWtAaGFsbGlidXJ0b24uY29t/CeyJtaWQiOiIxNzIxOTQwNjk3MDI0ZDViMGNlNWM4YzgxIiwiY3QiOiJlYmctd2FnMy05YzNjMjA1M2JhOTc5YjgyYjRlMDM1MWI1NWIzNWY2YS0xIiwicmQiOiJoYWxsaWJ1cnRvbi5jb20ifQ/VaHR0cHM6Ly9oYWxsaWJ1cnRvbi5zYXZpbmdzLmJlbmVwbGFjZS5jb20vaG9tZQ/SWkhfZWJnd2FfTkRCQU0wNzI1MjAyNGMxMzQ1Mzk5YjE/LZWIy/qP0RMSz04d2hja2E1b3E0aDA1Y2dkanpsZDE3Z256JnV0bV9tZWRpdW09SnVseS0yNS0yMDI0LVQtTW9iaWxlJnV0bV9zb3VyY2U9ZW1haWwmY29udl9zb3VyY2U9emV0YSZ1dG1fY2FtcGFpZ249aG9tZS1saW5rLW1hcmtldHBsYWNl/gZqK6vg/s2q5fe56576 HTTP 302
https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace

Request Chain 26

https://halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/8c81cb09042c/main.js

Request Chain 38

https://auth.savings.beneplace.com/auth/authorize?subdomain=halliburton&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace HTTP 302
https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace

129 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

home Show response
halliburton.savings.beneplace.com/
Redirect Chain

https://e.email.workingadvantage.com/click?EaHVzc2Fpbi5hbGhheWtAaGFsbGlidXJ0b24uY29t/CeyJtaWQiOiIxNzIxOTQwNjk3MDI0ZDViMGNlNWM4YzgxIiwiY3QiOiJlYmctd2FnMy05YzNjMjA1M2JhOTc5YjgyYjRlMDM1MWI1NWIzNWY2YS0...
https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace

10 KB
4 KB

249ms
182ms

Document
text/html

104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09420eac6f4fcbab51950283f400b15844673c67df8a8a68c06117e3f074e488

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ade24c70b4c2c1a-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Sun, 04 Aug 2024 11:17:54 GMT
last-modified: Thu, 01 Aug 2024 11:57:00 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sun, 04 Aug 2024 11:17:53 GMT
Keep-Alive: timeout=1, max=100
Location: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
Server: Apache
Strict-Transport-Security: max-age=60
X-Powered-By: PHP/8.2.8

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 678 KB
158 KB 447ms
40ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 90e76d97d19465bb3b2bd5fbdaa93518630280f5f64d785b90a96014aa6cd7b3

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
last-modified: Thu, 11 Jul 2024 18:43:50 GMT
server: AkamaiNetStorage
etag: "02171df11e91f5ac03f2f6af3c794a0b:1720723430.040336"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 161226
expires: Sun, 04 Aug 2024 12:17:54 GMT

GET
H3 200 new-relic-integration.js Show response
halliburton.savings.beneplace.com/assets/new-relic/ 51 KB
18 KB 167ms
166ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 11:56:59 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66ab780b-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8ade24c83cbe2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
30 KB 157ms
49ms Stylesheet
text/css 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 04 Aug 2024 11:17:54 GMT
x-content-type-options: nosniff
content-encoding: br
age: 2201487
x-jsd-version: 5.2.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 30336
x-served-by: cache-fra-eddf8230122-FRA, cache-mxp6944-MXP
x-jsd-version-type: version
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 245 KB
80 KB 170ms
78ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

eafdf66ee8117e41e04b43481535359c3ab4c52ac5bc6666d54795f41db35597

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81825
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 98ms
53ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 997576
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NQObhHuyoE626HgWjzchR7NZ%2FZh6B%2FD50QmJpeIc5xpgHhoA1uvRtlVTbcKxUlWz3hPNCkaWkMSYM21gDWx3Kh5g1vv6CfyiuvgtoFMYX7P%2FSDluMbhAvDZl%2FTf8ACxBSikPik5c"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ade24c87b2abb3b-FRA
expires: Fri, 25 Jul 2025 11:17:54 GMT

GET
H3 200 runtime.01accaad30283396.js Show response
halliburton.savings.beneplace.com/ 4 KB
2 KB 159ms
158ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/runtime.01accaad30283396.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1de678cb37557d62e21e23abeb8664c0d148287e43d7d907125f301874260681

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab77ff-e4f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://halliburton.savings.beneplace.com, https://halliburton.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24c83cc02c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.907166355836bac1.js Show response
halliburton.savings.beneplace.com/ 141 KB
47 KB 198ms
197ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/polyfills.907166355836bac1.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7fc858728287b5149cb2dce3f0e551674926497f5e788a8d5dc6e79b617e24b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab77ff-234da"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://halliburton.savings.beneplace.com, https://halliburton.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24c83cc12c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.fed71c9ab40863dc.js Show response
halliburton.savings.beneplace.com/ 163 KB
54 KB 187ms
186ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/scripts.fed71c9ab40863dc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1ef0577267ffcb026254a1a22d23ff6cafa02203c87c1664bc5b7910eaa34d6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66ab77ff-28d5f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8ade24cc697a2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.b9e0a75afcec51a7.js Show response
halliburton.savings.beneplace.com/ 5 MB
1 MB 553ms
552ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/main.b9e0a75afcec51a7.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40bbb0c8b5536a6f8c659830e49e517586af333fc9b7e46bd969b17c98abc33b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab77ff-4e797f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://halliburton.savings.beneplace.com, https://halliburton.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24c83cc42c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 261 KB
87 KB 155ms
60ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ac17e9722598278b05be1a998bf7d2fc4b1273b8bcecee2534303e2064ee809c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 88385
x-xss-protection: 0
last-modified: Sun, 04 Aug 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 78ms
78ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Sun, 04 Aug 2024 12:17:55 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 81ms
81ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Sun, 04 Aug 2024 12:17:55 GMT

GET
H3 200 styles.8c6bd9ec4e9f57b5.css
halliburton.savings.beneplace.com/ 96 KB
16 KB 185ms
185ms Stylesheet
text/css 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/styles.8c6bd9ec4e9f57b5.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5cfc3f3713b33443b41b23c86118231cfd4d92829c1e6ca39ac9b323b1b170c1

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66ab77ff-17ffe"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-cache-status: HIT
cf-ray: 8ade24cc697d2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 135ms
41ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:16:56 GMT
x-content-type-options: nosniff
age: 417659
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Jul 2025 15:16:56 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 131ms
51ms XHR
application/json 172.217.18.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f106.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://halliburton.savings.beneplace.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 306 KB
101 KB 61ms
60ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

769bf90363961dee5b5a48d84c16951aa8e6d941081993402901a26056279e46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 103795
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 133ms
39ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 04 Aug 2024 10:29:07 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2928
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 04 Aug 2024 12:29:07 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 141ms
46ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je47v0v9112553684z878847533za200zb78847533&_p=1722770274592&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&cid=1009705747.1722770276&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1722770275&sct=1&seg=0&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace&dt=Beneplace%20Team%20Discounts&en=page_view&_fv=1&_nsi=1&_ss=1&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace&up.pb_site_name=halliburton&up.page_path=%2Fhome&up.user_id_value=&up.zip_code=NaN&tfd=2424
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Aug 2024 11:17:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
233 B 48ms
47ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=679384952&t=pageview&_s=1&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace&ul=de-de&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=2138686192&gjid=1232350012&cid=1009705747.1722770276&tid=UA-2876877-9&_gid=623908046.1722770276&_r=1&_slc=1&gtm=45He47v0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=95250752&npa=1&z=740422340

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 04 Aug 2024 11:17:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 286 KB
96 KB 58ms
58ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

fa8583341b2121030244f5497c9b67873d0d85da270b4b3f72fb55c6d6232d63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 98173
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 04 Aug 2024 11:17:55 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 50ms
50ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je47v0v9126564266za200&_p=1722770274592&gcd=13l3l3l2l3&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&ul=de-de&sr=1600x1200&cid=1009705747.1722770276&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace&dt=Beneplace%20Team%20Discounts&sid=1722770275&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2684
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Aug 2024 11:17:55 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
halliburton.savings.beneplace.com/api/ 10 KB
3 KB 173ms
173ms XHR
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/info

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5de31500554858bd4baad01afb66efe85aba9da441bd463310684e9197c69745

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-154047de55655a11----1722770276623
traceparent: 00-622870a05c08de6fbfc39820570df200-154047de55655a11-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjE1NDA0N2RlNTU2NTVhMTEiLCJ0ciI6IjYyMjg3MGEwNWMwOGRlNmZiZmMzOTgyMDU3MGRmMjAwIiwidGkiOjE3MjI3NzAyNzY2MjMsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24d50cf92c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H3 200 marketplace-styles.css Show response
halliburton.savings.beneplace.com/api/halliburton/ 26 KB
5 KB 296ms
296ms XHR
text/css 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/halliburton/marketplace-styles.css

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1d68580b903f9b2f5045e4bcbc234b7858793739338ccd4a253f9c8ee4af441

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-461faa69908c3e8c----1722770276624
traceparent: 00-507920c0ed1d6557be3fc3ebd139c300-461faa69908c3e8c-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjQ2MWZhYTY5OTA4YzNlOGMiLCJ0ciI6IjUwNzkyMGMwZWQxZDY1NTdiZTNmYzNlYmQxMzljMzAwIiwidGkiOjE3MjI3NzAyNzY2MjQsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"695f-2Y6Z5bZXDwSDED9YWSxh/S0yAoE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24d50cfc2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H3 200 colors.css Show response
halliburton.savings.beneplace.com/api/halliburton/ 3 KB
804 B 205ms
205ms XHR
text/css 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/halliburton/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b27e06a67889a5c7e5fc03814301d24a8f02491e7a475436067020c67439e108

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-09b55a39c35b5ffc----1722770276625
traceparent: 00-e11ad442955613af88d23150512d5300-09b55a39c35b5ffc-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjA5YjU1YTM5YzM1YjVmZmMiLCJ0ciI6ImUxMWFkNDQyOTU1NjEzYWY4OGQyMzE1MDUxMmQ1MzAwIiwidGkiOjE3MjI3NzAyNzY2MjUsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"aa0-YlFr1w//dRE6tHzC1l/UX4oCaXY"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24d50cfe2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H3

200

main.js Show response
halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/8c81cb09042c/ Frame B8D8
Redirect Chain

https://halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/8c81cb09042c/main.js?

8 KB
4 KB

50ms
50ms

Script
application/javascript

104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/8c81cb09042c/main.js?

Protocol

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0182aa7812ef63ddf614cd2b8eaee8edf8b354ef1446d567f7eb9440e03aac4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray: 8ade24d55d602c1a-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/8c81cb09042c/main.js?
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray: 8ade24d50d002c1a-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
24 KB 150ms
47ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=300
x-amz-request-id: KCH9RH5FRDQ1MQWB
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 23581
x-amz-id-2: SwIXrCN+bqnTHrmTla1kiLWEtaclAsQOy5G/5owFKKJpFGqEX229N5jwqR7xjDWadt8OnQHM5fU=
x-served-by: cache-mxp6928-MXP
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 55

GET
H3 200 favicon.ico
halliburton.savings.beneplace.com/ 9 KB
3 KB 191ms
191ms Other
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9e69f591372b40a53ae6fb4b7358830aea67cb93e3b29d666b10e49163a5d0a

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 01 Aug 2024 11:57:00 GMT
server: cloudflare
cf-cache-status: REVALIDATED
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 8ade24d50d042c1a-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 8ade24c70b4c2c1a Show response
halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame B8D8 0
433 B 71ms
65ms XHR
text/plain 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/h/b/jsd/r/8ade24c70b4c2c1a

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 8ade24d61e362c1a-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 halliburton Show response
halliburton.savings.beneplace.com/api/controls/ 997 B
908 B 198ms
197ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/controls/halliburton

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-3a2dcdbdb74067ab----1722770276802
traceparent: 00-2816c6966fb4af261e3bba152a252700-3a2dcdbdb74067ab-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjNhMmRjZGJkYjc0MDY3YWIiLCJ0ciI6IjI4MTZjNjk2NmZiNGFmMjYxZTNiYmExNTJhMjUyNzAwIiwidGkiOjE3MjI3NzAyNzY4MDIsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:17:56 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24d62e402c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:55 GMT

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 151 B
746 B 398ms
324ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=3613&ck=0&s=60cf53323b66ef57&ref=https://halliburton.savings.beneplace.com/home&af=err,xhr,stn,ins,spa&be=1367&fe=2065&dc=2063&perf=%7B%22timing%22:%7B%22of%22:1722770273196,%22n%22:0,%22f%22:1119,%22dn%22:1120,%22dne%22:1138,%22c%22:1138,%22s%22:1138,%22ce%22:1186,%22rq%22:1186,%22rp%22:1367,%22rpe%22:1371,%22di%22:2070,%22ds%22:3429,%22de%22:3430,%22dc%22:3430,%22l%22:3431,%22le%22:3432%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 889400be70a8ed911d67aa43a14fb97973de76e03724d4c82c002e25a168ecad

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Sun, 04 Aug 2024 11:17:57 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://halliburton.savings.beneplace.com
access-control-expose-headers: Date
Vary: Accept-Encoding
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 8ade24d69e1a4504-TXL
timing-allow-origin: https://halliburton.savings.beneplace.com

GET
H3 401 dlk-compare Show response
halliburton.savings.beneplace.com/api/known/ 182 B
514 B 164ms
164ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/known/dlk-compare?guid=8whcka5oq4h05cgdjzld17gnz

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

170287bbbfc14739c9b3aa6ce30abb0669d418f01118028f4b06c198fdbdde1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-77ee0e9322f4cae7----1722770277029
traceparent: 00-2dde97e1d1a9c9ee9e32b49a56625a00-77ee0e9322f4cae7-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6Ijc3ZWUwZTkzMjJmNGNhZTciLCJ0ciI6IjJkZGU5N2UxZDFhOWM5ZWU5ZTMyYjQ5YTU2NjI1YTAwIiwidGkiOjE3MjI3NzAyNzcwMjksInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by
etag: W/"b6-lGFIUF59ZyAYAhOl/ILN9N2OvBU"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cf-ray: 8ade24d78ff52c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
content-length: 182
alt-svc: h3=":443"; ma=86400

GET
H3 200 info
halliburton.savings.beneplace.com/api/ 12 KB
4 KB 890ms
889ms XHR
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?DLK=8whcka5oq4h05cgdjzld17gnz&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-6de4dbe18f9a841b----1722770277032
traceparent: 00-8b54f713f841560e07f17664b9660700-6de4dbe18f9a841b-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjZkZTRkYmUxOGY5YTg0MWIiLCJ0ciI6IjhiNTRmNzEzZjg0MTU2MGUwN2YxNzY2NGI5NjYwNzAwIiwidGkiOjE3MjI3NzAyNzcwMzIsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24d79ffd2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:56 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 40ms
40ms Image
image/gif 216.58.206.46
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=679384952&t=pageview&_s=1&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&ul=de-de&de=UTF-8&dt=Halliburton%20EXTRAS%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=1009705747.1722770276&tid=UA-2876877-9&_gid=623908046.1722770276&gtm=45He47v0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=95250752&npa=1&z=266752340

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Aug 2024 16:11:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68774
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 halliburtonus-favicon.ico
controlpanel.savings.beneplace.com/uploads/ 1 KB
969 B 211ms
190ms Other
image/x-icon 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/halliburtonus-favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8992b32b76b6d4c47938315ad482c15ec237d30c1ab1eef52dc4f0abf2a8d353

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Fri, 05 Oct 2018 11:11:44 GMT
server: cloudflare
content-encoding: br
etag: W/"5bb746f0-47e"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=2592000, s-maxage=600
cf-ray: 8ade24d7c82e2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 halliburtonus-favicon.ico
controlpanel.savings.beneplace.com/uploads/ 1 KB
0 212ms
212ms Other
image/x-icon 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/halliburtonus-favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8992b32b76b6d4c47938315ad482c15ec237d30c1ab1eef52dc4f0abf2a8d353

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Fri, 05 Oct 2018 11:11:44 GMT
server: cloudflare
etag: W/"5bb746f0-47e"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=2592000, s-maxage=600
cf-ray: 8ade24d7c82e2c1a-FRA
alt-svc: h3=":443"; ma=86400

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
421 B 342ms
341ms XHR
image/gif 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=4020&ck=0&s=60cf53323b66ef57&ref=https://halliburton.savings.beneplace.com/
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Sun, 04 Aug 2024 11:17:57 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://halliburton.savings.beneplace.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 8ade24d8ab0a4504-TXL
Content-Length: 24

GET
H3

200

sign-in Show response
auth.savings.beneplace.com/halliburton/
Redirect Chain

https://auth.savings.beneplace.com/auth/authorize?subdomain=halliburton&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-...
https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redir...

10 KB
3 KB

163ms
163ms

Document
text/html

104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/main.b9e0a75afcec51a7.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

985eb618cae8b52a098d3688213e3eba551127dc5672a2b5d86c8d963662c6dd

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ade24de78972c1a-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Sun, 04 Aug 2024 11:17:58 GMT
last-modified: Thu, 01 Aug 2024 12:03:14 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.beneplace.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8ade24dd3f052c1a-FRA
content-type: text/html; charset=utf-8
date: Sun, 04 Aug 2024 11:17:58 GMT
expires: Sun, 04 Aug 2024 11:17:57 GMT
location: /halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 678 KB
0 0ms
0ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 90e76d97d19465bb3b2bd5fbdaa93518630280f5f64d785b90a96014aa6cd7b3

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
last-modified: Thu, 11 Jul 2024 18:43:50 GMT
server: AkamaiNetStorage
etag: "02171df11e91f5ac03f2f6af3c794a0b:1720723430.040336"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 161226
expires: Sun, 04 Aug 2024 12:17:54 GMT

GET
H3 200 new-relic-integration.js Show response
auth.savings.beneplace.com/assets/new-relic/ 51 KB
18 KB 161ms
159ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 12:03:13 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66ab7981-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8ade24df89f02c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
0 2ms
2ms Stylesheet
text/css 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/
Origin: https://auth.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2201487
x-jsd-version: 5.2.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 30336
x-served-by: cache-fra-eddf8230122-FRA, cache-mxp6944-MXP
x-jsd-version-type: version
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 245 KB
80 KB 66ms
62ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

eafdf66ee8117e41e04b43481535359c3ab4c52ac5bc6666d54795f41db35597

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81825
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
0 2ms
2ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 997576
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NQObhHuyoE626HgWjzchR7NZ%2FZh6B%2FD50QmJpeIc5xpgHhoA1uvRtlVTbcKxUlWz3hPNCkaWkMSYM21gDWx3Kh5g1vv6CfyiuvgtoFMYX7P%2FSDluMbhAvDZl%2FTf8ACxBSikPik5c"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ade24c87b2abb3b-FRA
expires: Fri, 25 Jul 2025 11:17:54 GMT

GET
H3 200 runtime.13338c5d9c83d0b6.js Show response
auth.savings.beneplace.com/ 1 KB
1 KB 159ms
159ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/runtime.13338c5d9c83d0b6.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

779700103eaa215226d17491070dd24cc4e6ae6533a0f3a4071140805119b45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
Origin: https://auth.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 12:03:07 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab797b-488"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com, https://auth.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24df89f42c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.c9fbd39a06fd6489.js Show response
auth.savings.beneplace.com/ 122 KB
42 KB 548ms
547ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/polyfills.c9fbd39a06fd6489.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66e1743db2ebf35df542d5426deacd3e99faa65b8e95711c1d7f5377475d7a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
Origin: https://auth.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 12:03:07 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab797b-1e711"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com, https://auth.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24df89f52c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.fed71c9ab40863dc.js Show response
auth.savings.beneplace.com/ 163 KB
54 KB 344ms
344ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/scripts.fed71c9ab40863dc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1ef0577267ffcb026254a1a22d23ff6cafa02203c87c1664bc5b7910eaa34d6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 12:03:07 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66ab797b-28d5f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8ade24e09b312c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.480f26c9288f4e47.js Show response
auth.savings.beneplace.com/ 2 MB
444 KB 166ms
165ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/main.480f26c9288f4e47.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6585b05025d3a761f2c06d67418579ca425cc1011969acfbb097a7374822025d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
Origin: https://auth.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 12:03:07 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab797b-1c130d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com, https://auth.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24df89f62c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 261 KB
0 1ms
1ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ac17e9722598278b05be1a998bf7d2fc4b1273b8bcecee2534303e2064ee809c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
last-modified: Sun, 04 Aug 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88385
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
205 B 45ms
42ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Sun, 04 Aug 2024 12:17:58 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
214 B 47ms
43ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Sun, 04 Aug 2024 12:17:58 GMT

GET
H3 200 styles.835e5d0e9714cffa.css
auth.savings.beneplace.com/ 39 KB
8 KB 394ms
393ms Stylesheet
text/css 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/styles.835e5d0e9714cffa.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c6bfcfb1ba199b8a9cffc09a48ca4e9eaf43d3b71c9dce5cf8c52a702ebe73d

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 12:03:07 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
age: 435
etag: W/"66ab797b-9cf4"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-cache-status: HIT
cf-ray: 8ade24e09b352c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
0 1ms
1ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.beneplace.com/
Origin: https://auth.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:16:56 GMT
x-content-type-options: nosniff
age: 417659
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Jul 2025 15:16:56 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 306 KB
0 0ms
0ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

769bf90363961dee5b5a48d84c16951aa8e6d941081993402901a26056279e46

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 103795
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
0 1ms
1ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 10:29:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2928
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 04 Aug 2024 12:29:07 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 47ms
47ms XHR
text/plain 216.58.206.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1505843739&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.beneplace.com%2Fhalliburton%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_campaign%3Dhome-link-marketplace%26redirect_uri%3Dhttps%253A%252F%252Fhalliburton.savings.beneplace.com%252Fhome%253FDLK%253D8whcka5oq4h05cgdjzld17gnz%2526utm_medium%253DJuly-25-2024-T-Mobile%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace&dr=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&ul=de-de&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1009705747.1722770276&tid=UA-2876877-9&_gid=623908046.1722770276&_slc=1&gtm=45He47v0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=95250752&npa=1&z=377586619

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 04 Aug 2024 11:17:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
0 48ms
47ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je47v0v9112553684z878847533za200zb78847533&_p=1722770278309&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&cid=1009705747.1722770276&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1722770275&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.beneplace.com%2Fhalliburton%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_campaign%3Dhome-link-marketplace%26redirect_uri%3Dhttps%253A%252F%252Fhalliburton.savings.beneplace.com%252Fhome%253FDLK%253D8whcka5oq4h05cgdjzld17gnz%2526utm_medium%253DJuly-25-2024-T-Mobile%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace&dr=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fauth.savings.beneplace.com%2Fhalliburton%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_campaign%3Dhome-link-marketplace%26redirect_uri%3Dhttps%253A%252F%252Fhalliburton.savings.beneplace.com%252Fhome%253FDLK%253D8whcka5oq4h05cgdjzld17gnz%2526utm_medium%253DJuly-25-2024-T-Mobile%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace&up.pb_site_name=auth&up.page_path=%2Fhalliburton%2Fsign-in&up.user_id_value=&up.zip_code=NaN&tfd=602
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Aug 2024 11:17:58 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 286 KB
0 0ms
0ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

fa8583341b2121030244f5497c9b67873d0d85da270b4b3f72fb55c6d6232d63

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 98173
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 51ms
51ms XHR
application/json 172.217.18.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f106.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://auth.savings.beneplace.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3 200 system-wide Show response
halliburton.savings.beneplace.com/api/notifications/ 2 B
749 B 230ms
184ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/notifications/system-wide

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e46e243659-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

GET
H3 200 info Show response
halliburton.savings.beneplace.com/api/ 12 KB
4 KB 249ms
203ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c45fc4335486895c928c284fc894777b09172f5264671a3409814a22fe1a7ef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"2e2c-v+yAFNsPK9+OrEgp9Q3UsDXUxiY"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e46e2a3659-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

GET
H3 200 info Show response
halliburton.savings.beneplace.com/api/ 12 KB
4 KB 416ms
167ms XHR
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c45fc4335486895c928c284fc894777b09172f5264671a3409814a22fe1a7ef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e5bfd63659-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

GET
H3 200 halliburton Show response
halliburton.savings.beneplace.com/api/controls/ 997 B
1 KB 357ms
312ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/controls/halliburton

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e46e263659-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

GET
H3 200 marketplace-styles.css Show response
halliburton.savings.beneplace.com/api/halliburton/ 26 KB
5 KB 330ms
286ms XHR
text/css 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/halliburton/marketplace-styles.css

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1d68580b903f9b2f5045e4bcbc234b7858793739338ccd4a253f9c8ee4af441

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"695f-2Y6Z5bZXDwSDED9YWSxh/S0yAoE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e46e223659-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
0 0ms
0ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2602:816:5001::39 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Sun, 04 Aug 2024 11:17:56 GMT
x-amz-request-id: KCH9RH5FRDQ1MQWB
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 23581
x-amz-id-2: SwIXrCN+bqnTHrmTla1kiLWEtaclAsQOy5G/5owFKKJpFGqEX229N5jwqR7xjDWadt8OnQHM5fU=
x-served-by: cache-mxp6928-MXP
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 55

GET
H3 200 favicon.ico
auth.savings.beneplace.com/ 10 KB
3 KB 164ms
163ms Other
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

985eb618cae8b52a098d3688213e3eba551127dc5672a2b5d86c8d963662c6dd

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 01 Aug 2024 12:03:14 GMT
server: cloudflare
cf-cache-status: HIT
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 8ade24e43f6d2c1a-FRA
alt-svc: h3=":443"; ma=86400

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 151 B
722 B 190ms
190ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1133&ck=0&s=768ce00dcaa9e97a&ref=https://auth.savings.beneplace.com/halliburton/sign-in&af=err,xhr,stn,ins,spa&be=373&fe=747&dc=746&perf=%7B%22timing%22:%7B%22of%22:1722770277925,%22n%22:0,%22r%22:1,%22re%22:210,%22f%22:210,%22dn%22:210,%22dne%22:210,%22c%22:210,%22s%22:210,%22ce%22:210,%22rq%22:211,%22rp%22:373,%22rpe%22:377,%22di%22:560,%22ds%22:1118,%22de%22:1120,%22dc%22:1120,%22l%22:1120,%22le%22:1121%7D,%22navigation%22:%7B%22rc%22:1%7D%7D
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 889400be70a8ed911d67aa43a14fb97973de76e03724d4c82c002e25a168ecad

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Sun, 04 Aug 2024 11:17:59 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://auth.savings.beneplace.com
access-control-expose-headers: Date
Vary: Accept-Encoding
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 8ade24e43e1144f2-TXL
timing-allow-origin: https://auth.savings.beneplace.com

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
414 B 183ms
182ms XHR
image/gif 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1329&ck=0&s=768ce00dcaa9e97a&ref=https://auth.savings.beneplace.com/halliburton/sign-in
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Sun, 04 Aug 2024 11:17:59 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://auth.savings.beneplace.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 8ade24e568ac44f2-TXL
Content-Length: 24

GET
H3 200 auth Show response
halliburton.savings.beneplace.com/api/navigation/halliburton/auth_footer/US/ 952 B
1 KB 184ms
184ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/navigation/halliburton/auth_footer/US/auth

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0ae4e130d9b9d6cffb84f4f5a1c69f619b17adbe90d2b6d8c7e25e4e5732fa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3b8-kAj77BiN0aoq+yBxgi9H1U8Vk60"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e5bfdb3659-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

GET
H3 200 onetrust Show response
halliburton.savings.beneplace.com/api/platform/options/ 505 B
1 KB 174ms
174ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/platform/options/onetrust

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

272b57b0c1521a35d2bc91f5b5c560c69e9dfd19631f60344473fd041236dba3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f9-Kr7PpbVfhwU6XhszSqAL/52koPg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e6d93d3659-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

POST
H3 200 known
auth.savings.beneplace.com/auth/ 671 B
1 KB 208ms
207ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/auth/known?subdomain=halliburton

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/halliburton/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https:%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-86b87a22e8de0bb9----1722770279491
traceparent: 00-8da23c776c4c0448f5fef71f46e17500-86b87a22e8de0bb9-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6Ijg2Yjg3YTIyZThkZTBiYjkiLCJ0ciI6IjhkYTIzYzc3NmM0YzA0NDhmNWZlZjcxZjQ2ZTE3NTAwIiwidGkiOjE3MjI3NzAyNzk0OTEsInRrIjoiODg4MzEifX0=
Content-Type: application/json

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"29f-0/VlsDpaY6+g0U8GY1dAcqI4jCk"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e6fb382c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

GET
H3 200 info Show response
halliburton.savings.beneplace.com/api/ 12 KB
4 KB 155ms
155ms XHR
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c45fc4335486895c928c284fc894777b09172f5264671a3409814a22fe1a7ef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24e6f9643659-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:58 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 216.58.206.46
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1505843739&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.beneplace.com%2Fhalliburton%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_campaign%3Dhome-link-marketplace%26redirect_uri%3Dhttps%3A%252F%252Fhalliburton.savings.beneplace.com%252Fhome%253FDLK%253D8whcka5oq4h05cgdjzld17gnz%2526utm_medium%253DJuly-25-2024-T-Mobile%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace&dr=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&ul=de-de&de=UTF-8&dt=Halliburton%20EXTRAS%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1009705747.1722770276&tid=UA-2876877-9&_gid=623908046.1722770276&gtm=45He47v0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=95250752&npa=1&z=1910657763

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Aug 2024 16:11:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68776
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 halliburtonus-favicon.ico
controlpanel.savings.beneplace.com/uploads/ 1 KB
0 0ms
0ms Other
image/x-icon 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/halliburtonus-favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8992b32b76b6d4c47938315ad482c15ec237d30c1ab1eef52dc4f0abf2a8d353

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Fri, 05 Oct 2018 11:11:44 GMT
server: cloudflare
etag: W/"5bb746f0-47e"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=2592000, s-maxage=600
cf-ray: 8ade24d7c82e2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 halliburtonus-favicon.ico
controlpanel.savings.beneplace.com/uploads/ 1 KB
0 0ms
0ms Other
image/x-icon 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/halliburtonus-favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8992b32b76b6d4c47938315ad482c15ec237d30c1ab1eef52dc4f0abf2a8d353

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Fri, 05 Oct 2018 11:11:44 GMT
server: cloudflare
etag: W/"5bb746f0-47e"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=2592000, s-maxage=600
cf-ray: 8ade24d7c82e2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 141ms
58ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 04 Aug 2024 11:17:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Wbr2pAeg61Hfi+2FuD0cYA==
age: 12919
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6882
x-ms-lease-status: unlocked
last-modified: Thu, 01 Aug 2024 19:30:11 GMT
server: cloudflare
etag: 0x8DCB2605C9885B3
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: a81b3871-601e-001c-060c-e54b9d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8ade24e86a9339df-FRA

GET
H3 200 Primary Request home Show response
halliburton.savings.beneplace.com/ 9 KB
3 KB 165ms
165ms Document
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/main.480f26c9288f4e47.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9e69f591372b40a53ae6fb4b7358830aea67cb93e3b29d666b10e49163a5d0a

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.beneplace.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ade24e84cf82c1a-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Sun, 04 Aug 2024 11:17:59 GMT
last-modified: Thu, 01 Aug 2024 11:57:00 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2 200 RCeae189b6ffaa4d18a4348fba9835c4f9-source.min.js
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/7bcb76e3d897/ 379 B
493 B 43ms
43ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/7bcb76e3d897/RCeae189b6ffaa4d18a4348fba9835c4f9-source.min.js
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
content-encoding: gzip
last-modified: Thu, 11 Jul 2024 18:43:51 GMT
server: AkamaiNetStorage
etag: "702dbc881c17599ce6dd1b1403cd4dae:1720723431.688127"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 231
expires: Sun, 04 Aug 2024 12:17:59 GMT

GET 06093138-9592-4701-aeee-caf98c73d41a.json
cdn.cookielaw.org/consent/06093138-9592-4701-aeee-caf98c73d41a/ 0
0

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 678 KB
0 0ms
0ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 90e76d97d19465bb3b2bd5fbdaa93518630280f5f64d785b90a96014aa6cd7b3

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
last-modified: Thu, 11 Jul 2024 18:43:50 GMT
server: AkamaiNetStorage
etag: "02171df11e91f5ac03f2f6af3c794a0b:1720723430.040336"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 161226
expires: Sun, 04 Aug 2024 12:17:54 GMT

GET
H3 200 new-relic-integration.js Show response
halliburton.savings.beneplace.com/assets/new-relic/ 51 KB
0 167ms
166ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 11:56:59 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66ab780b-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8ade24c83cbe2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
0 0ms
0ms Stylesheet
text/css 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2201487
x-jsd-version: 5.2.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 30336
x-served-by: cache-fra-eddf8230122-FRA, cache-mxp6944-MXP
x-jsd-version-type: version
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 js Show response
maps.googleapis.com/maps/api/ 245 KB
80 KB 69ms
69ms Script
text/javascript 172.217.18.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f106.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

eafdf66ee8117e41e04b43481535359c3ab4c52ac5bc6666d54795f41db35597

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81825
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
0 2ms
2ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 997576
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NQObhHuyoE626HgWjzchR7NZ%2FZh6B%2FD50QmJpeIc5xpgHhoA1uvRtlVTbcKxUlWz3hPNCkaWkMSYM21gDWx3Kh5g1vv6CfyiuvgtoFMYX7P%2FSDluMbhAvDZl%2FTf8ACxBSikPik5c"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8ade24c87b2abb3b-FRA
expires: Fri, 25 Jul 2025 11:17:54 GMT

GET
H3 200 runtime.01accaad30283396.js Show response
halliburton.savings.beneplace.com/ 4 KB
0 159ms
158ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/runtime.01accaad30283396.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1de678cb37557d62e21e23abeb8664c0d148287e43d7d907125f301874260681

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab77ff-e4f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://halliburton.savings.beneplace.com, https://halliburton.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24c83cc02c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.907166355836bac1.js Show response
halliburton.savings.beneplace.com/ 141 KB
0 198ms
197ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/polyfills.907166355836bac1.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7fc858728287b5149cb2dce3f0e551674926497f5e788a8d5dc6e79b617e24b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab77ff-234da"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://halliburton.savings.beneplace.com, https://halliburton.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24c83cc12c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.fed71c9ab40863dc.js Show response
halliburton.savings.beneplace.com/ 163 KB
0 187ms
186ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/scripts.fed71c9ab40863dc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1ef0577267ffcb026254a1a22d23ff6cafa02203c87c1664bc5b7910eaa34d6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66ab77ff-28d5f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8ade24cc697a2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.b9e0a75afcec51a7.js Show response
halliburton.savings.beneplace.com/ 5 MB
0 553ms
552ms Script
application/javascript 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/main.b9e0a75afcec51a7.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40bbb0c8b5536a6f8c659830e49e517586af333fc9b7e46bd969b17c98abc33b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
etag: W/"66ab77ff-4e797f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://halliburton.savings.beneplace.com, https://halliburton.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8ade24c83cc42c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 261 KB
0 0ms
0ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ac17e9722598278b05be1a998bf7d2fc4b1273b8bcecee2534303e2064ee809c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
last-modified: Sun, 04 Aug 2024 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88385
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
219 B 42ms
41ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Sun, 04 Aug 2024 12:17:59 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
219 B 40ms
40ms Script
application/x-javascript 23.35.236.237
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.236.237 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-237.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:59 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Sun, 04 Aug 2024 12:17:59 GMT

GET
H3 200 styles.8c6bd9ec4e9f57b5.css
halliburton.savings.beneplace.com/ 96 KB
0 185ms
185ms Stylesheet
text/css 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/styles.8c6bd9ec4e9f57b5.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5cfc3f3713b33443b41b23c86118231cfd4d92829c1e6ca39ac9b323b1b170c1

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Thu, 01 Aug 2024 11:56:47 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66ab77ff-17ffe"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-cache-status: HIT
cf-ray: 8ade24cc697d2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
0 0ms
0ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
Origin: https://halliburton.savings.beneplace.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:16:56 GMT
x-content-type-options: nosniff
age: 417659
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Jul 2025 15:16:56 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 306 KB
0 0ms
0ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

769bf90363961dee5b5a48d84c16951aa8e6d941081993402901a26056279e46

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 103795
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
0 0ms
0ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 10:29:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2928
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 04 Aug 2024 12:29:07 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 48ms
47ms XHR
text/plain 216.58.206.46
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=68988819&t=pageview&_s=1&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3F%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26known_email%3Dhussain.alhayk%2540halliburton.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D8whcka5oq4h05cgdjzld17gnz%26known_email_contact%3Dhussain.alhayk%2540halliburton.com&dr=https%3A%2F%2Fauth.savings.beneplace.com%2F&ul=de-de&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=1009705747.1722770276&tid=UA-2876877-9&_gid=623908046.1722770276&_slc=1&gtm=45He47v0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=95250752&npa=1&z=1182646243

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 04 Aug 2024 11:18:00 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
0 47ms
47ms Fetch
text/plain 216.239.32.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je47v0v9112553684z878847533za200zb78847533&_p=1722770279888&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&cid=1009705747.1722770276&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1722770275&sct=1&seg=1&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3F%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26known_email%3Dhussain.alhayk%2540halliburton.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D8whcka5oq4h05cgdjzld17gnz%26known_email_contact%3Dhussain.alhayk%2540halliburton.com&dr=https%3A%2F%2Fauth.savings.beneplace.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3F%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26known_email%3Dhussain.alhayk%2540halliburton.com%26known_user_type%3Dknown_set_confirmed%26known_user%3Dtrue%26known_user_guid%3D8whcka5oq4h05cgdjzld17gnz%26known_email_contact%3Dhussain.alhayk%2540halliburton.com&up.pb_site_name=halliburton&up.page_path=%2Fhome&up.user_id_value=&up.zip_code=NaN&tfd=314
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.32.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Aug 2024 11:18:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 286 KB
0 0ms
0ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

fa8583341b2121030244f5497c9b67873d0d85da270b4b3f72fb55c6d6232d63

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:55 GMT
content-encoding: br
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 98173
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 04 Aug 2024 11:17:55 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 52ms
52ms XHR
application/json 172.217.18.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f106.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:18:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://halliburton.savings.beneplace.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
halliburton.savings.beneplace.com/api/ 10 KB
3 KB 214ms
213ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/info

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5de31500554858bd4baad01afb66efe85aba9da441bd463310684e9197c69745

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
tracestate: 88831@nr=0-1-2647367-1120218725-1a42fb1d38ebb144----1722770280145
traceparent: 00-c6b1f70d5f32c39cf19fd53a87897100-1a42fb1d38ebb144-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjFhNDJmYjFkMzhlYmIxNDQiLCJ0ciI6ImM2YjFmNzBkNWYzMmMzOWNmMTlmZDUzYTg3ODk3MTAwIiwidGkiOjE3MjI3NzAyODAxNDUsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:18:00 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"28bc-Q9Qx2KVbJeYrYDwqoxC6hUCcgaA"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24eb0ff82c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:59 GMT

GET
H3 200 marketplace-styles.css Show response
halliburton.savings.beneplace.com/api/halliburton/ 26 KB
5 KB 382ms
382ms XHR
text/css 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/halliburton/marketplace-styles.css

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1d68580b903f9b2f5045e4bcbc234b7858793739338ccd4a253f9c8ee4af441

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
tracestate: 88831@nr=0-1-2647367-1120218725-b7543d90c496770f----1722770280146
traceparent: 00-1a977a0bc3b8e15b6ff241955fc0f200-b7543d90c496770f-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImI3NTQzZDkwYzQ5Njc3MGYiLCJ0ciI6IjFhOTc3YTBiYzNiOGUxNWI2ZmYyNDE5NTVmYzBmMjAwIiwidGkiOjE3MjI3NzAyODAxNDYsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:18:00 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"695f-2Y6Z5bZXDwSDED9YWSxh/S0yAoE"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24eb0ffa2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:59 GMT

GET
H3 200 colors.css Show response
halliburton.savings.beneplace.com/api/halliburton/ 3 KB
804 B 175ms
175ms XHR
text/css 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/halliburton/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b27e06a67889a5c7e5fc03814301d24a8f02491e7a475436067020c67439e108

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
tracestate: 88831@nr=0-1-2647367-1120218725-75150de4d5573c0a----1722770280146
traceparent: 00-5d469099b3d34c4f7f87a506835d9d00-75150de4d5573c0a-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6Ijc1MTUwZGU0ZDU1NzNjMGEiLCJ0ciI6IjVkNDY5MDk5YjNkMzRjNGY3Zjg3YTUwNjgzNWQ5ZDAwIiwidGkiOjE3MjI3NzAyODAxNDYsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:18:00 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"aa0-YlFr1w//dRE6tHzC1l/UX4oCaXY"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24eb0ffc2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:59 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
0 0ms
0ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2602:816:5001::39 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Sun, 04 Aug 2024 11:17:56 GMT
x-amz-request-id: KCH9RH5FRDQ1MQWB
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 23581
x-amz-id-2: SwIXrCN+bqnTHrmTla1kiLWEtaclAsQOy5G/5owFKKJpFGqEX229N5jwqR7xjDWadt8OnQHM5fU=
x-served-by: cache-mxp6928-MXP
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 55

GET
H3 200 favicon.ico
halliburton.savings.beneplace.com/ 9 KB
0 0ms
0ms Other
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9e69f591372b40a53ae6fb4b7358830aea67cb93e3b29d666b10e49163a5d0a

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:56 GMT
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Thu, 01 Aug 2024 11:57:00 GMT
server: cloudflare
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 8ade24d50d042c1a-FRA
alt-svc: h3=":443"; ma=86400

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 151 B
741 B 214ms
214ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=483&ck=0&s=60cf53323b66ef57&ref=https://halliburton.savings.beneplace.com/home&af=err,xhr,stn,ins,spa&be=166&fe=282&dc=278&perf=%7B%22timing%22:%7B%22of%22:1722770279704,%22n%22:0,%22f%22:1,%22dn%22:1,%22dne%22:1,%22c%22:1,%22s%22:1,%22ce%22:1,%22rq%22:2,%22rp%22:166,%22rpe%22:169,%22di%22:266,%22ds%22:443,%22de%22:444,%22dc%22:447,%22l%22:447,%22le%22:448%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 889400be70a8ed911d67aa43a14fb97973de76e03724d4c82c002e25a168ecad

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Sun, 04 Aug 2024 11:18:00 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://halliburton.savings.beneplace.com
access-control-expose-headers: Date
Vary: Accept-Encoding
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
CF-Ray: 8ade24eb4a9c44fe-TXL
timing-allow-origin: https://halliburton.savings.beneplace.com

GET
H3 200 halliburton Show response
halliburton.savings.beneplace.com/api/controls/ 997 B
905 B 190ms
190ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/controls/halliburton

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?&utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&known_email=hussain.alhayk%40halliburton.com&known_user_type=known_set_confirmed&known_user=true&known_user_guid=8whcka5oq4h05cgdjzld17gnz&known_email_contact=hussain.alhayk%40halliburton.com
tracestate: 88831@nr=0-1-2647367-1120218725-1bcea37d20dc07c9----1722770280362
traceparent: 00-65664792c440fe30e7c3ee329fc53000-1bcea37d20dc07c9-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjFiY2VhMzdkMjBkYzA3YzkiLCJ0ciI6IjY1NjY0NzkyYzQ0MGZlMzBlN2MzZWUzMjlmYzUzMDAwIiwidGkiOjE3MjI3NzAyODAzNjIsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:18:00 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24ec698e2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:59 GMT

POST
H/1.1 200
OK NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
421 B 211ms
210ms XHR
image/gif 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=703&ck=0&s=60cf53323b66ef57&ref=https://halliburton.savings.beneplace.com/home
Requested by: Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

Date: Sun, 04 Aug 2024 11:18:00 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://halliburton.savings.beneplace.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 8ade24ec9d7544fe-TXL
Content-Length: 24

GET
H3 200 onetrust Show response
halliburton.savings.beneplace.com/api/platform/options/ 505 B
730 B 179ms
179ms XHR
application/json 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/platform/options/onetrust

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

272b57b0c1521a35d2bc91f5b5c560c69e9dfd19631f60344473fd041236dba3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-2435fe44edfd4637----1722770280572
traceparent: 00-4ada87cb863b5a65d5fb6db0b3469500-2435fe44edfd4637-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjI0MzVmZTQ0ZWRmZDQ2MzciLCJ0ciI6IjRhZGE4N2NiODYzYjVhNjVkNWZiNmRiMGIzNDY5NTAwIiwidGkiOjE3MjI3NzAyODA1NzIsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:18:00 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f9-Kr7PpbVfhwU6XhszSqAL/52koPg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24edbae82c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:59 GMT

GET
H3 200 info Show response
halliburton.savings.beneplace.com/api/ 12 KB
4 KB 162ms
161ms XHR
text/html 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://halliburton.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c45fc4335486895c928c284fc894777b09172f5264671a3409814a22fe1a7ef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://halliburton.savings.beneplace.com/home?utm_medium=July-25-2024-T-Mobile&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-ed07f6b20cad4868----1722770280573
traceparent: 00-947444ea570bd0a2fe76767bbf2db700-ed07f6b20cad4868-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImVkMDdmNmIyMGNhZDQ4NjgiLCJ0ciI6Ijk0NzQ0NGVhNTcwYmQwYTJmZTc2NzY3YmJmMmRiNzAwIiwidGkiOjE3MjI3NzAyODA1NzMsInRrIjoiODg4MzEifX0=

Response headers

date: Sun, 04 Aug 2024 11:18:00 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://halliburton.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8ade24edbaeb2c1a-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sun, 04 Aug 2024 11:17:59 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 216.58.206.46
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=68988819&t=pageview&_s=1&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3Futm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace&dr=https%3A%2F%2Fauth.savings.beneplace.com%2F&ul=de-de&de=UTF-8&dt=Halliburton%20EXTRAS%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1009705747.1722770276&tid=UA-2876877-9&_gid=623908046.1722770276&gtm=45He47v0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=95250752&npa=1&z=37465663

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Aug 2024 16:11:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68777
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
41ms Image
image/gif 216.58.206.46
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=68988819&t=pageview&_s=1&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&dr=https%3A%2F%2Fauth.savings.beneplace.com%2F&ul=de-de&de=UTF-8&dt=Halliburton%20EXTRAS%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=1009705747.1722770276&tid=UA-2876877-9&_gid=623908046.1722770276&gtm=45He47v0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=95250752&npa=1&z=600346640

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Aug 2024 16:11:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 68777
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 halliburtonus-favicon.ico
controlpanel.savings.beneplace.com/uploads/ 1 KB
0 0ms
0ms Other
image/x-icon 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/halliburtonus-favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8992b32b76b6d4c47938315ad482c15ec237d30c1ab1eef52dc4f0abf2a8d353

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Fri, 05 Oct 2018 11:11:44 GMT
server: cloudflare
etag: W/"5bb746f0-47e"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=2592000, s-maxage=600
cf-ray: 8ade24d7c82e2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 halliburtonus-favicon.ico
controlpanel.savings.beneplace.com/uploads/ 1 KB
0 0ms
0ms Other
image/x-icon 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/halliburtonus-favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8992b32b76b6d4c47938315ad482c15ec237d30c1ab1eef52dc4f0abf2a8d353

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Fri, 05 Oct 2018 11:11:44 GMT
server: cloudflare
etag: W/"5bb746f0-47e"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=2592000, s-maxage=600
cf-ray: 8ade24d7c82e2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 halliburtonus-favicon.ico
controlpanel.savings.beneplace.com/uploads/ 1 KB
0 1ms
1ms Other
image/x-icon 104.18.7.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/halliburtonus-favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.7.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8992b32b76b6d4c47938315ad482c15ec237d30c1ab1eef52dc4f0abf2a8d353

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sun, 04 Aug 2024 11:17:57 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Fri, 05 Oct 2018 11:11:44 GMT
server: cloudflare
etag: W/"5bb746f0-47e"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=2592000, s-maxage=600
cf-ray: 8ade24d7c82e2c1a-FRA
alt-svc: h3=":443"; ma=86400

GET authorize
auth.savings.beneplace.com/auth/ 0
0

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
0 0ms
0ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: halliburton.savings.beneplace.com
URL: https://halliburton.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1505aa0792421f831935f4761a95f31462a3dd097c8bd00ad8e9c765c8065517

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://halliburton.savings.beneplace.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 04 Aug 2024 11:17:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Wbr2pAeg61Hfi+2FuD0cYA==
age: 12919
content-length: 6882
x-ms-lease-status: unlocked
last-modified: Thu, 01 Aug 2024 19:30:11 GMT
server: cloudflare
etag: 0x8DCB2605C9885B3
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: a81b3871-601e-001c-060c-e54b9d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8ade24e86a9339df-FRA

GET 06093138-9592-4701-aeee-caf98c73d41a.json
cdn.cookielaw.org/consent/06093138-9592-4701-aeee-caf98c73d41a/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je47v0v9112553684za200zb78847533&_p=1722770274592&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&cid=1009705747.1722770276&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&sid=1722770275&sct=1&seg=0&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3FDLK%3D8whcka5oq4h05cgdjzld17gnz%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace&dt=Beneplace%20Team%20Discounts&_s=2&tfd=5104

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je47v0v9126564266za200&_p=1722770274592&gcd=13l3l3l2l3&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&ul=de-de&sr=1600x1200&cid=1009705747.1722770276&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&_s=2&dl=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&dt=Halliburton%20EXTRAS%20US&sid=1722770275&sct=1&seg=1&en=page_view&_ee=1&_et=1159&tfd=5105

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=5105&ck=0&s=60cf53323b66ef57&ref=https://halliburton.savings.beneplace.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=5106&ck=0&s=60cf53323b66ef57&ref=https://halliburton.savings.beneplace.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=5106&ck=0&s=60cf53323b66ef57&ref=https://halliburton.savings.beneplace.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=5106&ck=0&s=60cf53323b66ef57&ref=https://halliburton.savings.beneplace.com/

Domain: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/consent/06093138-9592-4701-aeee-caf98c73d41a/06093138-9592-4701-aeee-caf98c73d41a.json

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je47v0v9112553684za200zb78847533&_p=1722770278309&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&cid=1009705747.1722770276&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1722770275&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.beneplace.com%2Fhalliburton%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_campaign%3Dhome-link-marketplace%26redirect_uri%3Dhttps%253A%252F%252Fhalliburton.savings.beneplace.com%252Fhome%253FDLK%253D8whcka5oq4h05cgdjzld17gnz%2526utm_medium%253DJuly-25-2024-T-Mobile%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace&dr=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&dt=Beneplace%20Team%20Discounts&en=scroll&ep.userId=&epn.percent_scrolled=90&_et=1&tfd=1950

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je47v0v9112553684za200zb78847533&_p=1722770278309&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&cid=1009705747.1722770276&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=3&sid=1722770275&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.beneplace.com%2Fhalliburton%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_campaign%3Dhome-link-marketplace%26redirect_uri%3Dhttps%3A%252F%252Fhalliburton.savings.beneplace.com%252Fhome%253FDLK%253D8whcka5oq4h05cgdjzld17gnz%2526utm_medium%253DJuly-25-2024-T-Mobile%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace&dr=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&dt=Halliburton%20EXTRAS%20US&en=user_engagement&ep.userId=&_et=1347&tfd=1951

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je47v0v9126564266za200&_p=1722770278309&gcd=13l3l3l2l3&npa=1&dma_cps=syphamo&dma=1&tag_exp=95250752&ul=de-de&sr=1600x1200&cid=1009705747.1722770276&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAI&dl=https%3A%2F%2Fauth.savings.beneplace.com%2Fhalliburton%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-25-2024-T-Mobile%26utm_campaign%3Dhome-link-marketplace%26redirect_uri%3Dhttps%253A%252F%252Fhalliburton.savings.beneplace.com%252Fhome%253FDLK%253D8whcka5oq4h05cgdjzld17gnz%2526utm_medium%253DJuly-25-2024-T-Mobile%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace&dr=https%3A%2F%2Fhalliburton.savings.beneplace.com%2F&dt=Beneplace%20Team%20Discounts&sid=1722770275&sct=1&seg=1&_s=1&tfd=1951

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1952&ck=0&s=768ce00dcaa9e97a&ref=https://auth.savings.beneplace.com/halliburton/sign-in

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1952&ck=0&s=768ce00dcaa9e97a&ref=https://auth.savings.beneplace.com/halliburton/sign-in

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1953&ck=0&s=768ce00dcaa9e97a&ref=https://auth.savings.beneplace.com/halliburton/sign-in

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1953&ck=0&s=768ce00dcaa9e97a&ref=https://auth.savings.beneplace.com/halliburton/sign-in

Domain: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/auth/authorize?subdomain=halliburton&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-25-2024-T-Mobile&utm_campaign=home-link-marketplace&redirect_uri=https%3A%2F%2Fhalliburton.savings.beneplace.com%2Fhome%3Futm_medium%3DJuly-25-2024-T-Mobile%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace

Domain: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/consent/06093138-9592-4701-aeee-caf98c73d41a/06093138-9592-4701-aeee-caf98c73d41a.json

Verdicts & Comments Add Verdict or Comment

205 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.beneplace.com/	1970-01-20 22:32:52	Name: __cf_bm Value: 0f1v7y_Z17DP74T6VOUXO4xDeowFFLa28d4bI9NSCh8-1722770274-1.0.1.1-OCdWFZGUSIfVIb87Y8rgPg7ta1bA6RB8Ldq0nZth_RG8tBHyzsDY88mEfZxLjNbKpnNvaXBST3DsYKkYj2G0Cg
.beneplace.com/	1969-12-31 23:59:59	Name: _cfuvid Value: yxcp1xZc8klXO65AX5uYyaNtdoquGAQajOw_VVihxUI-1722770274542-0.0.1.1-604800000
.beneplace.com/	1970-01-20 22:34:16	Name: _gid Value: GA1.2.623908046.1722770276
.beneplace.com/	1970-01-20 22:32:50	Name: _gat_UA-2876877-9 Value: 1
.beneplace.com/	1970-01-21 07:18:26	Name: cf_clearance Value: XMdFyuFkyKBMApId5oZVWrqaQ4NmN.QoEKT96jY7nrY-1722770276-1.0.1.1-GL2oiQ7a8SM36qZ5NWftU7eGm2wL.QEiE36KghVYZqoWMqiyqQ4c4pNI7DrDgQcLgdKHY7_Jf.140hTtIlNdiA
.savings.beneplace.com/	1970-01-21 08:08:50	Name: split_test_groups Value: {}
auth.savings.beneplace.com/	1969-12-31 23:59:59	Name: known_guid Value: 8whcka5oq4h05cgdjzld17gnz
auth.savings.beneplace.com/	1969-12-31 23:59:59	Name: user_guid Value: 8whcka5oq4h05cgdjzld17gnz
auth.savings.beneplace.com/	1970-01-21 00:40:30	Name: auth_server Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI4dmt6M3FhYmtiYmZ3a3J0czAwNjNjcm0iLCJyZW1lbWJlck1lIjp0cnVlLCJpYXQiOjE3MjI3NzAyNzksImV4cCI6MTczMDQzMDI3OX0.VFk2JVqJmLNiacG75_jcV8izEzVkcI00A5-VZuPePIk
.beneplace.com/	1970-01-21 08:08:50	Name: _ga_FD2X5ZMELR Value: GS1.1.1722770275.1.1.1722770280.0.0.0
.beneplace.com/	1970-01-21 08:08:50	Name: _ga Value: GA1.2.1009705747.1722770276
.beneplace.com/	1970-01-21 08:08:50	Name: _ga_2K753Z6D0L Value: GS1.2.1722770275.1.1.1722770280.0.0.0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://halliburton.savings.beneplace.com/api/known/dlk-compare?guid=8whcka5oq4h05cgdjzld17gnz Message: Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
auth.savings.beneplace.com
bam.nr-data.net
cdn.cookielaw.org
cdn.jsdelivr.net
cdnjs.cloudflare.com
controlpanel.savings.beneplace.com
e.email.workingadvantage.com
fonts.gstatic.com
halliburton.savings.beneplace.com
js-agent.newrelic.com
maps.googleapis.com
region1.google-analytics.com
www.google-analytics.com
www.googletagmanager.com
auth.savings.beneplace.com
bam.nr-data.net
cdn.cookielaw.org
region1.google-analytics.com
104.17.24.14
104.18.7.126
142.250.181.232
162.247.241.14
172.217.18.106
2001:4860:4802:34::36
2001:4860:4802:38::178
216.239.32.36
216.58.206.46
23.35.236.237
2602:816:5001::39
2606:4700::6812:572a
2a00:1450:4001:827::200a
2a00:1450:4001:82a::2003
2a00:1450:4001:82f::2008
2a04:4e42::485
96.47.24.171
0182aa7812ef63ddf614cd2b8eaee8edf8b354ef1446d567f7eb9440e03aac4d
05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9
09420eac6f4fcbab51950283f400b15844673c67df8a8a68c06117e3f074e488
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
1505aa0792421f831935f4761a95f31462a3dd097c8bd00ad8e9c765c8065517
170287bbbfc14739c9b3aa6ce30abb0669d418f01118028f4b06c198fdbdde1d
1de678cb37557d62e21e23abeb8664c0d148287e43d7d907125f301874260681
272b57b0c1521a35d2bc91f5b5c560c69e9dfd19631f60344473fd041236dba3
2c6bfcfb1ba199b8a9cffc09a48ca4e9eaf43d3b71c9dce5cf8c52a702ebe73d
40bbb0c8b5536a6f8c659830e49e517586af333fc9b7e46bd969b17c98abc33b
462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
5cfc3f3713b33443b41b23c86118231cfd4d92829c1e6ca39ac9b323b1b170c1
5de31500554858bd4baad01afb66efe85aba9da441bd463310684e9197c69745
6585b05025d3a761f2c06d67418579ca425cc1011969acfbb097a7374822025d
66e1743db2ebf35df542d5426deacd3e99faa65b8e95711c1d7f5377475d7a5c
769bf90363961dee5b5a48d84c16951aa8e6d941081993402901a26056279e46
779700103eaa215226d17491070dd24cc4e6ae6533a0f3a4071140805119b45f
7fc858728287b5149cb2dce3f0e551674926497f5e788a8d5dc6e79b617e24b9
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
889400be70a8ed911d67aa43a14fb97973de76e03724d4c82c002e25a168ecad
8992b32b76b6d4c47938315ad482c15ec237d30c1ab1eef52dc4f0abf2a8d353
90e76d97d19465bb3b2bd5fbdaa93518630280f5f64d785b90a96014aa6cd7b3
9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
985eb618cae8b52a098d3688213e3eba551127dc5672a2b5d86c8d963662c6dd
a9e69f591372b40a53ae6fb4b7358830aea67cb93e3b29d666b10e49163a5d0a
ac17e9722598278b05be1a998bf7d2fc4b1273b8bcecee2534303e2064ee809c
b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b
b27e06a67889a5c7e5fc03814301d24a8f02491e7a475436067020c67439e108
bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23
c0ae4e130d9b9d6cffb84f4f5a1c69f619b17adbe90d2b6d8c7e25e4e5732fa3
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
c1ef0577267ffcb026254a1a22d23ff6cafa02203c87c1664bc5b7910eaa34d6
c45fc4335486895c928c284fc894777b09172f5264671a3409814a22fe1a7ef5
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b
cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d
d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eafdf66ee8117e41e04b43481535359c3ab4c52ac5bc6666d54795f41db35597
f1d68580b903f9b2f5045e4bcbc234b7858793739338ccd4a253f9c8ee4af441
fa8583341b2121030244f5497c9b67873d0d85da270b4b3f72fb55c6d6232d63
fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

halliburton.savings.beneplace.com Open in urlscan Pro 104.18.7.126 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

129 Requests

87 %HTTPS

47 %IPv6

12 Domains

15 Subdomains

17 IPs

3 Countries

2633 kBTransfer

19979 kBSize

12 Cookies

0 Outgoing links

Page URL History

Redirected requests

129 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

halliburton.savings.beneplace.com Open in urlscan Pro
104.18.7.126 Public Scan

Screenshot
Live screenshot

Full Image

129
Requests

87 %
HTTPS

47 %
IPv6

12
Domains

15
Subdomains

17
IPs

3
Countries

2633 kB
Transfer

19979 kB
Size

12
Cookies

129 HTTP transactions
2 data transactions