studentloans.citizensone.com Open in urlscan Pro
173.209.247.165 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sailthru.perkspot.com/click/21567988.98009/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xMzkyNDcxP21lcmN...
Effective URL:
https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b...
Submission: On September 22 via api (September 22nd 2020, 4:40:36 pm UTC) from US

Summary HTTP 234 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 52 IPs in 7 countries across 41 domains to perform 234 HTTP transactions. The main IP is 173.209.247.165, located in San Francisco, United States and belongs to SRS-6-Z-7381, US. The main domain is studentloans.citizensone.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on December 2nd 2019. Valid for: a year.

This is the only time studentloans.citizensone.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citizens Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	162.208.117.53 162.208.117.53	11403 (NYINTERNET) (NYINTERNET)
2 16	23.96.203.178 23.96.203.178	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	152.199.21.2 152.199.21.2	15133 (EDGECAST) (EDGECAST)
2	2620:1ec:29::10 2620:1ec:29::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	143.204.94.58 143.204.94.58	16509 (AMAZON-02) (AMAZON-02)
1	99.84.158.177 99.84.158.177	16509 (AMAZON-02) (AMAZON-02)
1 3	2a00:1450:400... 2a00:1450:400c:c07::9d	15169 (GOOGLE) (GOOGLE)
1	99.84.144.19 99.84.144.19	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
1	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
1 24	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
24	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1 3	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
4	99.83.154.140 99.83.154.140	16509 (AMAZON-02) (AMAZON-02)
7	2a00:1450:400... 2a00:1450:4001:814::2002	15169 (GOOGLE) (GOOGLE)
1 2	104.18.71.113 104.18.71.113	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	104.18.70.113 104.18.70.113	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	75.101.164.61 75.101.164.61	14618 (AMAZON-AES) (AMAZON-AES)
6	74.125.133.157 74.125.133.157	15169 (GOOGLE) (GOOGLE)
2	52.236.186.210 52.236.186.210	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	104.16.53.111 104.16.53.111	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 31	173.209.247.165 173.209.247.165	7381 (SRS-6-Z-7381) (SRS-6-Z-7381)
6	18.197.253.20 18.197.253.20	16509 (AMAZON-02) (AMAZON-02)
2	23.77.209.175 23.77.209.175	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1 3	34.247.153.209 34.247.153.209	16509 (AMAZON-02) (AMAZON-02)
1 3	52.209.239.68 52.209.239.68	16509 (AMAZON-02) (AMAZON-02)
2	2a02:26f0:6c0... 2a02:26f0:6c00:2bf::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	99.84.144.40 99.84.144.40	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
2	15.188.154.177 15.188.154.177	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
14	2a00:1450:400... 2a00:1450:4001:81a::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	54.76.90.77 54.76.90.77	16509 (AMAZON-02) (AMAZON-02)
17	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
6	74.201.20.82 74.201.20.82	10912 (INTERNAP-BLK) (INTERNAP-BLK)
3	23.210.248.189 23.210.248.189	16625 (AKAMAI-AS) (AKAMAI-AS)
1	99.86.7.124 99.86.7.124	16509 (AMAZON-02) (AMAZON-02)
2 4	216.58.208.38 216.58.208.38	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::6816:653	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3 4	37.252.172.250 37.252.172.250	29990 (ASN-APPNEX) (ASN-APPNEX)
1	23.210.250.44 23.210.250.44	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a02:26f0:10c... 2a02:26f0:10c:58e::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.73.94.193 52.73.94.193	14618 (AMAZON-AES) (AMAZON-AES)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	38.133.127.127 38.133.127.127	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
2	99.86.7.96 99.86.7.96	16509 (AMAZON-02) (AMAZON-02)
9	130.211.25.196 130.211.25.196	15169 (GOOGLE) (GOOGLE)
234	52

1 162.208.117.53 (New York, United States) 1 redirects

ASN11403 (NYINTERNET, US)
PTR: 162.208.117.53.static.nyinternet.net

sailthru.perkspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 23.96.203.178 (Chicago, United States) 2 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

email.perkspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
chubb.perkspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.21.2 (United States)

ASN15133 (EDGECAST, US)

hello.myfonts.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:29::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

psprods3ep.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.94.58 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-58.fra50.r.cloudfront.net

ak.sail-horizon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.158.177 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-158-177.txl52.r.cloudfront.net

cdn.rollbar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c07::9d (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.144.19 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-144-19.txl52.r.cloudfront.net

cdn.heapanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.130 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 99.83.154.140 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: aa7557bb34ea5624b.awsglobalaccelerator.com

api.sail-personalize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:814::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.71.113 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

assets.zendesk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ekr.zdassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.18.70.113 (United States)

ASN13335 (CLOUDFLARENET, US)

static.zdassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 75.101.164.61 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-75-101-164-61.compute-1.amazonaws.com

heapanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 74.125.133.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wo-in-f157.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.236.186.210 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.53.111 (United States)

ASN13335 (CLOUDFLARENET, US)

perkspot.zendesk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 173.209.247.165 (San Francisco, United States) 2 redirects

ASN7381 (SRS-6-Z-7381, US)

partner.citizensone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
studentloans.citizensone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.197.253.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.77.209.175 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)

www.citizensbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:234:59:254c:406:2366:268c (United States) 1 redirects

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.247.153.209 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.209.239.68 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

citizensbank.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:2bf::1931 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.144.40 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-144-40.txl52.r.cloudfront.net

cdn.merklesearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.154.177 (Paris, France)

ASN16509 (AMAZON-02, US)

smetrics.citizensbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.90.77 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

citizensbank.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 74.201.20.82 (United States)

ASN10912 (INTERNAP-BLK, US)

citizens.inq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.248.189 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-189.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.7.124 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-7-124.fra6.r.cloudfront.net

t.a3cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.208.38 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s12-in-f38.1e100.net

8253365.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
8022851.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:653 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.glassboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.252.172.250 (Ascension Island) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:58e::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.73.94.193 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

report.citizen.glassboxdigital.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.133.127.127 (United States)

ASN22075 (AS-OUTBRAIN, US)

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.7.96 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-7-96.fra6.r.cloudfront.net

segment.a3cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 130.211.25.196 (Mountain View, United States)

ASN15169 (GOOGLE, US)

mediav3.inq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
35	doubleclick.net 3 redirects stats.g.doubleclick.net googleads.g.doubleclick.net bid.g.doubleclick.net 8253365.fls.doubleclick.net 8022851.fls.doubleclick.net	45 KB
31	citizensone.com 2 redirects partner.citizensone.com studentloans.citizensone.com	1 MB
24	google.de www.google.de	2 KB
24	google.com 1 redirects www.google.com	2 KB
17	perkspot.com 3 redirects sailthru.perkspot.com email.perkspot.com chubb.perkspot.com	615 KB
16	googletagmanager.com www.googletagmanager.com	554 KB
15	inq.com citizens.inq.com mediav3.inq.com	818 KB
10	zdassets.com static.zdassets.com ekr.zdassets.com	565 KB
6	demdex.net 2 redirects dpm.demdex.net citizensbank.demdex.net	7 KB
6	ensighten.com nexus.ensighten.com	128 KB
6	google-analytics.com www.google-analytics.com	38 KB
5	googleadservices.com 1 redirects www.googleadservices.com	45 KB
4	adnxs.com 3 redirects secure.adnxs.com ib.adnxs.com	4 KB
4	citizensbank.com www.citizensbank.com smetrics.citizensbank.com	5 KB
4	sail-personalize.com api.sail-personalize.com	914 B
4	heapanalytics.com cdn.heapanalytics.com heapanalytics.com	41 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	facebook.net connect.facebook.net	109 KB
3	a3cloud.net t.a3cloud.net segment.a3cloud.net	5 KB
3	pinterest.com ct.pinterest.com	1019 B
3	zendesk.com 1 redirects assets.zendesk.com perkspot.zendesk.com	2 KB
2	facebook.com www.facebook.com	356 B
2	licdn.com snap.licdn.com	3 KB
2	outbrain.com amplify.outbrain.com tr.outbrain.com	3 KB
2	gstatic.com www.gstatic.com	20 KB
2	pinimg.com s.pinimg.com	18 KB
2	twitter.com 1 redirects platform.twitter.com analytics.twitter.com	987 B
2	visualstudio.com dc.services.visualstudio.com	187 B
2	azureedge.net psprods3ep.azureedge.net	16 KB
1	glassboxdigital.io report.citizen.glassboxdigital.io	940 B
1	glassboxcdn.com cdn.glassboxcdn.com	92 KB
1	omtrdc.net citizensbank.tt.omtrdc.net	475 B
1	google.ch www.google.ch	577 B
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	t.co t.co	449 B
1	merklesearch.com cdn.merklesearch.com	3 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	msecnd.net az416426.vo.msecnd.net	37 KB
1	rollbar.com cdn.rollbar.com	22 KB
1	sail-horizon.com ak.sail-horizon.com	43 KB
1	myfonts.net hello.myfonts.net	91 B
234	41

	Domain	Requested by
29	studentloans.citizensone.com	chubb.perkspot.com studentloans.citizensone.com citizens.inq.com
24	www.google.de	chubb.perkspot.com studentloans.citizensone.com
24	www.google.com	1 redirects chubb.perkspot.com studentloans.citizensone.com
22	googleads.g.doubleclick.net	www.googleadservices.com
16	www.googletagmanager.com	chubb.perkspot.com nexus.ensighten.com www.googletagmanager.com
15	chubb.perkspot.com	1 redirects chubb.perkspot.com
9	mediav3.inq.com	citizens.inq.com mediav3.inq.com chubb.perkspot.com
9	static.zdassets.com	chubb.perkspot.com assets.zendesk.com static.zdassets.com
6	citizens.inq.com	studentloans.citizensone.com mediav3.inq.com
6	nexus.ensighten.com	studentloans.citizensone.com nexus.ensighten.com
6	bid.g.doubleclick.net	www.googleadservices.com
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com chubb.perkspot.com studentloans.citizensone.com
5	www.googleadservices.com	1 redirects www.googletagmanager.com nexus.ensighten.com
4	api.sail-personalize.com	cdn.rollbar.com
3	connect.facebook.net	nexus.ensighten.com connect.facebook.net
3	ct.pinterest.com	s.pinimg.com studentloans.citizensone.com
3	citizensbank.demdex.net	1 redirects studentloans.citizensone.com nexus.ensighten.com
3	dpm.demdex.net	1 redirects studentloans.citizensone.com
3	heapanalytics.com	chubb.perkspot.com
3	stats.g.doubleclick.net	1 redirects chubb.perkspot.com az416426.vo.msecnd.net
2	segment.a3cloud.net
2	ib.adnxs.com	2 redirects
2	8022851.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.facebook.com
2	px.ads.linkedin.com	1 redirects
2	snap.licdn.com	nexus.ensighten.com snap.licdn.com
2	secure.adnxs.com	1 redirects
2	8253365.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	smetrics.citizensbank.com	nexus.ensighten.com studentloans.citizensone.com
2	www.gstatic.com	nexus.ensighten.com www.gstatic.com
2	s.pinimg.com	nexus.ensighten.com s.pinimg.com
2	www.citizensbank.com	studentloans.citizensone.com
2	partner.citizensone.com	2 redirects
2	perkspot.zendesk.com	assets.zendesk.com static.zdassets.com
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	psprods3ep.azureedge.net	chubb.perkspot.com
1	tr.outbrain.com
1	www.linkedin.com	1 redirects
1	report.citizen.glassboxdigital.io	cdn.glassboxcdn.com
1	amplify.outbrain.com	nexus.ensighten.com
1	cdn.glassboxcdn.com	nexus.ensighten.com
1	t.a3cloud.net	nexus.ensighten.com
1	analytics.twitter.com	platform.twitter.com
1	citizensbank.tt.omtrdc.net	nexus.ensighten.com
1	www.google.ch	studentloans.citizensone.com
1	cm.everesttech.net	1 redirects
1	t.co	studentloans.citizensone.com
1	cdn.merklesearch.com	nexus.ensighten.com
1	static.ads-twitter.com	studentloans.citizensone.com
1	platform.twitter.com	1 redirects
1	ekr.zdassets.com	assets.zendesk.com
1	assets.zendesk.com	1 redirects
1	az416426.vo.msecnd.net	chubb.perkspot.com
1	cdn.heapanalytics.com	chubb.perkspot.com
1	cdn.rollbar.com	chubb.perkspot.com
1	ak.sail-horizon.com	chubb.perkspot.com
1	hello.myfonts.net	chubb.perkspot.com
1	email.perkspot.com	1 redirects
1	sailthru.perkspot.com	1 redirects
234	59

This site contains links to these domains. Also see Links.

Domain
www.citizensbank.com
www.citizensstudentloans.com
www.facebook.com
www.twitter.com
www.linkedin.com
www.amazon.com
www.citizensone.com
studentaid.ed.gov
www.studentaid.ed.gov
www.loanconsolidation.ed.gov

Subject Issuer	Validity	Valid
*.perkspot.com Go Daddy Secure Certificate Authority - G2	`2020-07-29` - `2021-08-02`	a year	crt.sh
hello.myfonts.net DigiCert SHA2 Secure Server CA	`2019-06-03` - `2021-06-07`	2 years	crt.sh
*.azureedge.net Microsoft Azure TLS Issuing CA 02	`2020-09-09` - `2021-09-04`	a year	crt.sh
ak.sail-horizon.com Amazon	`2020-02-07` - `2021-03-07`	a year	crt.sh
cdn.rollbar.com Amazon	`2020-06-11` - `2021-07-11`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
cdn.heapanalytics.com Amazon	`2019-10-22` - `2020-11-22`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
sni1e6ffgl.wpc.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
www.google.de GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
api.sail-personalize.com Amazon	`2020-06-30` - `2021-07-30`	a year	crt.sh
ssl911790.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2020-05-20` - `2020-11-26`	6 months	crt.sh
*.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
heapanalytics.com Amazon	`2020-01-21` - `2021-02-21`	a year	crt.sh
in.applicationinsights.azure.com Microsoft IT TLS CA 4	`2020-04-30` - `2022-04-30`	2 years	crt.sh
perkspot.zendesk.com Cloudflare Inc ECC CA-3	`2020-07-17` - `2021-07-17`	a year	crt.sh
studentloans.citizensbank.com DigiCert SHA2 Extended Validation Server CA	`2019-12-02` - `2021-01-15`	a year	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2020-09-09` - `2021-10-11`	a year	crt.sh
www.citizensbank.com DigiCert SHA2 Extended Validation Server CA	`2019-12-18` - `2020-11-06`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.pinterest.com DigiCert SHA2 High Assurance Server CA	`2020-07-16` - `2021-08-04`	a year	crt.sh
cdn.merklesearch.com Entrust Certification Authority - L1K	`2017-08-28` - `2020-10-29`	3 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
smetrics.citizensbank.com DigiCert SHA2 High Assurance Server CA	`2020-04-19` - `2021-07-22`	a year	crt.sh
*.google.ch GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
www.google.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.inq.com GeoTrust RSA CA 2018	`2019-10-30` - `2021-12-08`	2 years	crt.sh
*.a3cloud.net Amazon	`2020-05-15` - `2021-06-15`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
*.googleadservices.com GTS CA 1O1	`2020-08-26` - `2020-11-18`	3 months	crt.sh
glassboxcdn.com Cloudflare Inc ECC CA-3	`2020-06-01` - `2021-06-01`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2020-03-09` - `2021-06-08`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
citizen.glassboxdigital.io Amazon	`2020-01-16` - `2021-02-16`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh

This page contains 14 frames:

Primary Page: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Frame ID: 7B9C6985FAB6A6FCABE9BD8C5A49A806
Requests: 202 HTTP requests in this frame

Frame: https://static.zdassets.com/ekr/asset_composer.js
Frame ID: 7643D01E4B554E78A000BD0881CC2107
Requests: 3 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: ED597ADF80BCDDB1F72FCF9D9316B78E
Requests: 1 HTTP requests in this frame

Frame: https://static.zdassets.com/web_widget/latest/preload.55392e8c9a3b8090a3f2.js
Frame ID: 57686FC8717153C3181252E5598A63E0
Requests: 9 HTTP requests in this frame

Frame: https://citizensbank.demdex.net/dest5.html?d_nsid=0
Frame ID: 8940B63A3DD3A9DC425CAAE93BCE65A6
Requests: 1 HTTP requests in this frame

Frame: https://8253365.fls.doubleclick.net/activityi;dc_pre=CILS0v6Z_esCFejIuwgd9JQC-w;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=49737134053424323854608100952882325239;u2=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;u3=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500
Frame ID: A9F6ABEA2862518F20A5D3808076EAC2
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: DF6A1EAE8AB484EE255E273BBA5A3CD0
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 948D2BEE7B620846E9E37E306EEBC4BC
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: E4E1FD2737A7F9AE87C7AAA25D34771F
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: EACFBB695ADAD7A998A1B1DC991D8B86
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 46074107691AE1D369400F75EBE9EA8A
Requests: 1 HTTP requests in this frame

Frame: https://studentloans.citizensone.com/inqChat.html?IFRAME
Frame ID: A5D179451BAAF3DEEED4C323A534BFC0
Requests: 7 HTTP requests in this frame

Frame: https://8022851.fls.doubleclick.net/activityi;dc_pre=CMKT4_6Z_esCFc3juwgdvo8Oig;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500
Frame ID: DA3DD1036244D4EDA2CA613450C16633
Requests: 1 HTTP requests in this frame

Frame: https://citizens.inq.com/tagserver/postToServer.min.htm?codeVersion=1600791370744
Frame ID: A80CD89545288DBB0CFC70D9D1216E24
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://sailthru.perkspot.com/click/21567988.98009/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZ... HTTP 302
https://email.perkspot.com/e/v3/click/offer/1392471?merchantName=CitizensOneStudentLoans&assetType=Smal... HTTP 302
https://chubb.perkspot.com/auth/email?sid=ed401383-f673-4ad3-9b78-93c5175f59da&auth=7e3c13051a53d89aa2f... HTTP 302
https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast Page URL
http://partner.citizensone.com/perkspot HTTP 302
https://partner.citizensone.com/perkspot HTTP 302
https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendi... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /adnxs\.(?:net|com)/i

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/nexus\.ensighten\.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

234
Requests

100 %
HTTPS

36 %
IPv6

41
Domains

59
Subdomains

52
IPs

7
Countries

4264 kB
Transfer

10464 kB
Size

29
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: https://www.citizensbank.com/customer-service/siterequirements.aspx
Title: Learn more

Search URL Search Domain Scan URL

URL: https://www.citizensstudentloans.com/citizensOne/educationrefinanceeligibility?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Title: Or Apply Now

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#lending-partnerships
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#lending-getmyrate
Title: †

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=https%3a%2f%2fstudentloans.citizensone.com%2flr%2fCombo

Search URL Search Domain Scan URL

URL: http://www.twitter.com/intent/tweet?status=Refinance+your+student+loans+and+save.+Customers+have+saved+an+average+of+%24253+per+month+or+%243%2c168+per+year.*

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https%3a%2f%2fstudentloans.citizensone.com%2flr%2fCombo

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#eligibility-criteria
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#savings-erl-averagemonthly
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#lending-loanbenefits
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#rate-lowest
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensstudentloans.com/citizensOne/student?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Title: Get Started

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#lending-multiyearapproval
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#lending-educationfee
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#lending-loyaltydiscount
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#lending-cosigner
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/student-lending/DisclosureHub.aspx#eligibility-erl
Title: †

Search URL Search Domain Scan URL

URL: https://www.citizensstudentloans.com/citizensone/login
Title: Login here

Search URL Search Domain Scan URL

URL: https://www.amazon.com/gc-legal
Title: amazon/gc-legal

Search URL Search Domain Scan URL

URL: http://www.citizensone.com/student-loans/access-my-student-loan.html
Title: http://www.citizensone.com/student-loans/access-my-student-loan.html

Search URL Search Domain Scan URL

URL: https://studentaid.ed.gov/sa/repay-loans/forgiveness-cancellation
Title: studentaid.ed.gov/sa/repay-loans/forgiveness-cancellation

Search URL Search Domain Scan URL

URL: http://www.studentaid.ed.gov/types/loans/federal-vs-private
Title: www.studentaid.ed.gov/types/loans/federal-vs-private

Search URL Search Domain Scan URL

URL: http://www.loanconsolidation.ed.gov/
Title: www.loanconsolidation.ed.gov

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sailthru.perkspot.com/click/21567988.98009/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xMzkyNDcxP21lcmNoYW50TmFtZT1DaXRpemVuc09uZVN0dWRlbnRMb2FucyZhc3NldFR5cGU9U21hbGwyMTU2Nzk4OC8mZW1haWw9bXJoZWFkJTQwY2h1YmIuY29tJmVtYWlsQmxhc3RJZD0yMTU2Nzk4OCZlbnRpdHlFbWFpbFR5cGVDb2RlPXdlZWtseWJsYXN0JnVzZXJJZD0xMTU3NDk5NiZjb21tdW5pdHlpZD04MDgmYXV0aD02M2YzZWRiOTMwMjg0ZTRhYThhNTJkM2NiZDViOWQ2NyZjb21tdW5pdHluYW1lPUNodWJiJnJlY29tbWlkPTlHVkhTUVpXQzM0OVMzWVZWUFExOVYzUzQ/5b688b2c95a7a11d301df4bcB2d917053 HTTP 302
https://email.perkspot.com/e/v3/click/offer/1392471?merchantName=CitizensOneStudentLoans&assetType=Small21567988/&email=mrhead%40chubb.com&emailBlastId=21567988&entityEmailTypeCode=weeklyblast&userId=11574996&communityid=808&auth=63f3edb930284e4aa8a52d3cbd5b9d67&communityname=Chubb&recommid=9GVHSQZWC349S3YVVPQ19V3S4 HTTP 302
https://chubb.perkspot.com/auth/email?sid=ed401383-f673-4ad3-9b78-93c5175f59da&auth=7e3c13051a53d89aa2f5cae2c2128461&redirectUrl=%2foffer%2f1392471%2fnone%3futm_medium%3demail%26utm_id%3dweeklyblast&furtherRedirect= HTTP 302
https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast Page URL
http://partner.citizensone.com/perkspot HTTP 302
https://partner.citizensone.com/perkspot HTTP 302
https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://sailthru.perkspot.com/click/21567988.98009/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xMzkyNDcxP21lcmNoYW50TmFtZT1DaXRpemVuc09uZVN0dWRlbnRMb2FucyZhc3NldFR5cGU9U21hbGwyMTU2Nzk4OC8mZW1haWw9bXJoZWFkJTQwY2h1YmIuY29tJmVtYWlsQmxhc3RJZD0yMTU2Nzk4OCZlbnRpdHlFbWFpbFR5cGVDb2RlPXdlZWtseWJsYXN0JnVzZXJJZD0xMTU3NDk5NiZjb21tdW5pdHlpZD04MDgmYXV0aD02M2YzZWRiOTMwMjg0ZTRhYThhNTJkM2NiZDViOWQ2NyZjb21tdW5pdHluYW1lPUNodWJiJnJlY29tbWlkPTlHVkhTUVpXQzM0OVMzWVZWUFExOVYzUzQ/5b688b2c95a7a11d301df4bcB2d917053 HTTP 302
https://email.perkspot.com/e/v3/click/offer/1392471?merchantName=CitizensOneStudentLoans&assetType=Small21567988/&email=mrhead%40chubb.com&emailBlastId=21567988&entityEmailTypeCode=weeklyblast&userId=11574996&communityid=808&auth=63f3edb930284e4aa8a52d3cbd5b9d67&communityname=Chubb&recommid=9GVHSQZWC349S3YVVPQ19V3S4 HTTP 302
https://chubb.perkspot.com/auth/email?sid=ed401383-f673-4ad3-9b78-93c5175f59da&auth=7e3c13051a53d89aa2f5cae2c2128461&redirectUrl=%2foffer%2f1392471%2fnone%3futm_medium%3demail%26utm_id%3dweeklyblast&furtherRedirect= HTTP 302
https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Request Chain 23

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=361657025&utmhn=chubb.perkspot.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=You%27re%20on%20your%20way%20to%20saving%20at%20Citizens%20One%20Student%20Loans%20%7C%20Welcome%20to%20Your%20Chubb%20Discount%20Program&utmhid=1489865547&utmr=-&utmp=%2Foffer%2F1392471%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&utmht=1600792819461&utmac=UA-652375-6&utmcc=__utma%3D267775964.913213870.1600792819.1600792819.1600792819.1%3B%2B__utmz%3D267775964.1600792819.1.1.utmcid%3Dweeklyblast%7Cutmccn%3D(not%2520set)%7Cutmcmd%3Demail%3B&utmjid=764338307&utmredir=3&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=913213870.1600792819&jid=764338307&_v=5.7.2dc&z=361657025 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=913213870.1600792819&jid=764338307&_v=5.7.2dc&z=361657025&slf_rd=1&random=4284271330

Request Chain 32

https://assets.zendesk.com/embeddable_framework/main.js HTTP 301
https://static.zdassets.com/ekr/asset_composer.js

Request Chain 77

https://platform.twitter.com/oct.js HTTP 301
https://static.ads-twitter.com/oct.js

Request Chain 78

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1600792826131 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1600792826131

Request Chain 79

https://citizensbank.demdex.net/event?d_nsid=0&d_rtbd=json&d_jsonv=1&d_dst=1&d_cb=CZAAMCallback HTTP 302
https://citizensbank.demdex.net/firstevent?d_nsid=0&d_rtbd=json&d_jsonv=1&d_dst=1&d_cb=CZAAMCallback

Request Chain 98

https://cm.everesttech.net/cm/dd?d_uuid=49745402664019729664610683948844734608 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2oo_gAABhQ_yVL0

Request Chain 110

https://www.googleadservices.com/pagead/conversion/942049220/wcm?cc=ZZ&dn=18668882487&cl=s9I-CP7Jj3sQxI-awQM&ref=https%3A%2F%2Fchubb.perkspot.com%2F&ct_eid=2 HTTP 302
https://www.google.ch/pagead/attribution/wcm?cc=ZZ&dn=18668882487&cl=s9I-CP7Jj3sQxI-awQM

Request Chain 157

https://8253365.fls.doubleclick.net/activityi;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=49737134053424323854608100952882325239;u2=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;u3=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500 HTTP 302
https://8253365.fls.doubleclick.net/activityi;dc_pre=CILS0v6Z_esCFejIuwgd9JQC-w;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=49737134053424323854608100952882325239;u2=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;u3=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500

Request Chain 179

https://secure.adnxs.com/seg?add=10100&redir=&t=1 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D10100%26redir%3D%26t%3D1

Request Chain 209

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=583769&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&time=1600792827512 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D583769%26url%3Dhttps%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo%253FWT.mc_id%253DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%2526b2boffer%253Damazon500%26time%3D1600792827512%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=583769&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&time=1600792827512&liSync=true

Request Chain 215

https://8022851.fls.doubleclick.net/activityi;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500 HTTP 302
https://8022851.fls.doubleclick.net/activityi;dc_pre=CMKT4_6Z_esCFc3juwgdvo8Oig;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500

Request Chain 218

https://ib.adnxs.com/getuid?//segment.a3cloud.net/px.png?uid=$UID&cid=AM-141554&sid=48988147&url=https%3A//chubb.perkspot.com/&vars=%257B%2522event%2522%253A%2522data%2522%252C%2522message%2522%253A%257B%2522MCID%2522%253A%2522Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%2522%252C%2522mcvisid%2522%253A%252249737134053424323854608100952882325239%2522%257D%257D HTTP 302
https://segment.a3cloud.net/px.png?uid=1409149246837196894&cid=AM-141554&sid=48988147&url=https://chubb.perkspot.com/&vars=%7B%22event%22%3A%22data%22%2C%22message%22%3A%7B%22MCID%22%3A%22Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%22%2C%22mcvisid%22%3A%2249737134053424323854608100952882325239%22%7D%7D

Request Chain 219

https://ib.adnxs.com/getuid?//segment.a3cloud.net/px.png?uid=$UID&cid=AM-141554&sid=48988147&url=https%3A//chubb.perkspot.com/&vars= HTTP 302
https://segment.a3cloud.net/px.png?uid=1409149246837196894&cid=AM-141554&sid=48988147&url=https://chubb.perkspot.com/&vars=

234 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set none Show response
chubb.perkspot.com/offer/1392471/
Redirect Chain

https://sailthru.perkspot.com/click/21567988.98009/aHR0cHM6Ly9lbWFpbC5wZXJrc3BvdC5jb20vZS92My9jbGljay9vZmZlci8xMzkyNDcxP21lcmNoYW50TmFtZT1DaXRpemVuc09uZVN0dWRlbnRMb2FucyZhc3NldFR5cGU9U21hbGwyMTU2Nz...
https://email.perkspot.com/e/v3/click/offer/1392471?merchantName=CitizensOneStudentLoans&assetType=Small21567988/&email=mrhead%40chubb.com&emailBlastId=21567988&entityEmailTypeCode=weeklyblast&user...
https://chubb.perkspot.com/auth/email?sid=ed401383-f673-4ad3-9b78-93c5175f59da&auth=7e3c13051a53d89aa2f5cae2c2128461&redirectUrl=%2foffer%2f1392471%2fnone%3futm_medium%3demail%26utm_id%3dweeklyblas...
https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

32 KB
12 KB

357ms
356ms

Document
text/html

23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

4b3953dedfbdbed644b9cac32a0891c1d7d186f61c6c66fc6a4403802213b863

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Host: chubb.perkspot.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: sailthru_hid=1e19406ad460d8bb6b01f7d418c3fad15b688b2c95a7a11d301df4bc7cd45881eca17d0a0500f115878546ba; sailthru_bid=21567988.98009; PerkSpot4=75DA8CF1D143A35DF97CD8A7E6A6FB7EA7CE0927200FC680067EDAB3FF4A4137DAEF0121A4CA6E84E01F8AEA681BA00A7F6A0F4FA7FB5441AC7CEC84799BB9CB90ACE5E71B309726950ED24FA109236AA08414F1621AF085D6BACBCA9E8F2455EAF6C489698B24ACAE862B6DF349084F2F4BFDBE647E9631CD8B56D2FBEFBBB48569403CBBD79CB1CF944C9E631ADCD6AF91CFB7A488D7915431AD4B74414DAA5644138C6A145A730CED1AD123A01F4B223A012B66D847FF0337CE0E954D0156; SessionHolder=fab08196-9589-49bc-9afc-7e41a5e3585f; ps_sid=fab08196-9589-49bc-9afc-7e41a5e3585f; ARRAffinity=7356aa0d8e0bca6412e8e2ea64f55f9f44f8e3449e40dad68df27adc30804c7e
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: private
Content-Length: 11152
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Set-Cookie: SessionHolder=fab08196-9589-49bc-9afc-7e41a5e3585f; expires=Tue, 22-Sep-2020 17:00:19 GMT; path=/; secure; HttpOnly ps_sid=fab08196-9589-49bc-9afc-7e41a5e3585f; expires=Tue, 22-Sep-2020 17:00:19 GMT; path=/; secure; HttpOnly SessionHolder=fab08196-9589-49bc-9afc-7e41a5e3585f; expires=Tue, 22-Sep-2020 17:00:19 GMT; path=/; secure; HttpOnly ps_sid=fab08196-9589-49bc-9afc-7e41a5e3585f; expires=Tue, 22-Sep-2020 17:00:19 GMT; path=/; secure; HttpOnly
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
X-Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Security-Policy: frame-ancestors *.perkspot.com
Date: Tue, 22 Sep 2020 16:40:18 GMT

Redirect headers

Cache-Control: private
Content-Length: 202
Content-Type: text/html; charset=utf-8
Location: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Set-Cookie: PerkSpot4=75DA8CF1D143A35DF97CD8A7E6A6FB7EA7CE0927200FC680067EDAB3FF4A4137DAEF0121A4CA6E84E01F8AEA681BA00A7F6A0F4FA7FB5441AC7CEC84799BB9CB90ACE5E71B309726950ED24FA109236AA08414F1621AF085D6BACBCA9E8F2455EAF6C489698B24ACAE862B6DF349084F2F4BFDBE647E9631CD8B56D2FBEFBBB48569403CBBD79CB1CF944C9E631ADCD6AF91CFB7A488D7915431AD4B74414DAA5644138C6A145A730CED1AD123A01F4B223A012B66D847FF0337CE0E954D0156; domain=perkspot.com; path=/ SessionHolder=fab08196-9589-49bc-9afc-7e41a5e3585f; expires=Tue, 22-Sep-2020 17:00:18 GMT; path=/; secure; HttpOnly ps_sid=fab08196-9589-49bc-9afc-7e41a5e3585f; expires=Tue, 22-Sep-2020 17:00:18 GMT; path=/; secure; HttpOnly ARRAffinity=7356aa0d8e0bca6412e8e2ea64f55f9f44f8e3449e40dad68df27adc30804c7e;Path=/;HttpOnly;Domain=chubb.perkspot.com
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
X-Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Security-Policy: frame-ancestors *.perkspot.com
Date: Tue, 22 Sep 2020 16:40:18 GMT

GET
H2 200 2b1ecf
hello.myfonts.net/count/ 0
91 B 31ms
29ms Stylesheet
text/css 152.199.21.2
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hello.myfonts.net/count/2b1ecf
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.2 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mil/6CBA) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
last-modified: Fri, 17 Apr 2020 15:38:14 GMT
server: ECAcc (mil/6CBA)
age: 13224245
etag: "3364556309"
status: 200
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 0
expires: Tue, 22 Sep 2020 16:40:18 GMT

GET
H/1.1 200
OK core
chubb.perkspot.com/Content/css/ 198 KB
54 KB 146ms
144ms Stylesheet
text/css 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/Content/css/core?v=20.9.16425.1

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

94c6483dadce933e499cc7f0a7cbd22d2565bbaf160f19086d55bd2e2df69f7b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Sep 2020 16:40:18 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Expires: -1
Cache-Control: no-cache
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 55078
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK perxcss.css
chubb.perkspot.com/Content/sass/ 465 KB
51 KB 148ms
146ms Stylesheet
text/css 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/Content/sass/perxcss.css?v=20.9.16425.1

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

20ef197859e006fc1ab760c273d2e83ced00ca2427a5591428c5a44e0e1f6eaf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Encoding: gzip
ETag: "809579f84190d61:0"
Last-Modified: Mon, 21 Sep 2020 18:06:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Date: Tue, 22 Sep 2020 16:40:18 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 51922
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK community-css
chubb.perkspot.com/ 39 KB
8 KB 185ms
184ms Stylesheet
text/css 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/community-css

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

8bc6ca4b67c7d69332d254cec745f729ecfd2b46a2fd2c106fb75d3efcf0e9eb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: private
Date: Tue, 22 Sep 2020 16:40:18 GMT
Content-Disposition: attachment; filename=global.css
Content-Length: 7930
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK insights Show response
chubb.perkspot.com/bundles/ 4 KB
3 KB 142ms
141ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/bundles/insights?v=BYC8KfJNNFadC6mBN8WA9SN_bH3bqkPFtSQg0hXgWI01

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

5efd1cdc9fe57d8ee4c5ee8839c2deb5a4c0a6f0eae362825bf0c94785c01632

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:18 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 22 Sep 2020 16:40:19 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 22 Sep 2021 16:40:19 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 2610
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H2 200 logo_808.png
psprods3ep.azureedge.net/cdn.perkspot.com/images/communities/ 4 KB
5 KB 19ms
17ms Image
image/png 2620:1ec:29::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://psprods3ep.azureedge.net/cdn.perkspot.com/images/communities/logo_808.png
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:29::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fea5907b6d4d94746b87daa3c6309433c554f4d2f677f073baa22950d7143985

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-meta-createdby: not-implemented
date: Tue, 22 Sep 2020 16:40:18 GMT
x-amz-meta-uploader: S3StorageService
x-azure-ref-originshield: 0fihqXwAAAABJeb07xFz4SqgqklfIcfkeTE9OMjFFREdFMDExNAA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
x-amz-request-id: 004EF9C4E0D137E9
x-cache: TCP_HIT
status: 200
content-length: 4468
x-amz-id-2: ESi1hzUAH3YiHJu3eVAbWClPTmWLYvxKCWVBzeWuJvVApVB8scPYL8nNYIf/eEyIxON8sqZSDG4=
last-modified: Wed, 04 Apr 2018 21:28:33 GMT
server: AmazonS3
etag: "e7b0d90e0304637f992a8c1638b95261"
x-azure-ref: 08yhqXwAAAACyjqz1T4QhTJHGguWysgipQlJVMzBFREdFMDQwOQA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
content-type: image/png
cache-control: public, max-age=18000
accept-ranges: bytes

GET
H2 200 logo_39665.png
psprods3ep.azureedge.net/cdn.perkspot.com/images/merchants/ 11 KB
12 KB 21ms
20ms Image
image/png 2620:1ec:29::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://psprods3ep.azureedge.net/cdn.perkspot.com/images/merchants/logo_39665.png
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:29::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 46ed1fd8925fb4fc35e5fefb2ce99b1e3b47fc9333adc4cdc4d4b3f785b8fbc0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-meta-createdby: not-implemented
date: Tue, 22 Sep 2020 16:40:18 GMT
x-amz-meta-uploader: api
x-azure-ref-originshield: 0yt5oXwAAAADUd9bGRoy2SLZltA/L03AxTE9OMjFFREdFMDIyMgA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
x-amz-request-id: 9C36BD59946776A9
x-cache: TCP_HIT
status: 200
content-length: 11450
x-amz-id-2: aM8opVweTQLcSEeJfCGGgzo1jlRVNGyIBCa8VXgujgTl3Pu+z2BlG16LDXuw+v1OWgWvh1MOXCA=
last-modified: Wed, 18 Oct 2017 14:26:49 GMT
server: AmazonS3
etag: "e7375b3ec794c3b2504259dc862178b8"
x-azure-ref: 08yhqXwAAAAC6a338zXGQRJ2e+lFDccWrQlJVMzBFREdFMDQwOQA3MDdkMDFjYy1lNDQ0LTQxOWItODc1OS0wOGMyN2U0MmQyNTY=
content-type: image/png
cache-control: public, max-age=86400
accept-ranges: bytes

GET
H/1.1 200
OK jquery Show response
chubb.perkspot.com/bundles/ 801 KB
304 KB 146ms
145ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/bundles/jquery?v=1si8wJJ0zRT9XDRYtIFv7trxf1jf1rnrG_ltX1HyFUI1

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

e4ad38d69381a4568f8bd3b11b3f97b4df3dd13ef99bda66e10c6a90f8827693

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 22 Sep 2020 16:40:19 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 22 Sep 2021 16:40:19 GMT
Cache-Control: public
Transfer-Encoding: chunked
Date: Tue, 22 Sep 2020 16:40:18 GMT
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK jqueryval Show response
chubb.perkspot.com/bundles/ 40 KB
16 KB 149ms
149ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/bundles/jqueryval?v=YzRBe6gfD164-CLYW2zoB8py-eOZPLHUgoPct44VgDo1

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

40f2d552c0db3ead874ec52bf624d9ec88007d8b659cd7189fecc3ff19d3d248

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:18 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 22 Sep 2020 16:40:19 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 22 Sep 2021 16:40:19 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 15663
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK bootstrap Show response
chubb.perkspot.com/bundles/ 41 KB
14 KB 151ms
149ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/bundles/bootstrap?v=7jtbseVPa_P_wxk-ANB0JbEiqz4vMc1fIXNwp0ieQEk1

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

60035f8d3292fc0b3155089baabc76fce2178f8d104ef606e4e31cbe0a2803b2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:18 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 22 Sep 2020 16:40:19 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 22 Sep 2021 16:40:19 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 14262
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK modernizr Show response
chubb.perkspot.com/bundles/ 11 KB
6 KB 142ms
140ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/bundles/modernizr?v=K-FFpFNtIXPUlQamnX3qHX_A5r7TM2xbAgcuEmpm3O41

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

9f0fab72c8a1fea1df1d6c5d128115031a8c44ccbc7f37e314acee6acb98779b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:19 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 22 Sep 2020 16:40:19 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 22 Sep 2021 16:40:19 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 5284
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK perkspot.interstitial Show response
chubb.perkspot.com/bundles/ 285 B
754 B 140ms
138ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/bundles/perkspot.interstitial?v=t7AmW2sLYmtuXd_Ef0RYYqquwW8mSfQBRb6_PPlosA41

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

89c69b70386c8e4a1be1f0dfe4b485807c2ac88bfe195de3a254a855f36d8c0c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:18 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 22 Sep 2020 16:40:19 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 22 Sep 2021 16:40:19 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 296
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK addtohomescreen Show response
chubb.perkspot.com/bundles/ 9 KB
4 KB 152ms
151ms Script
text/javascript 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/bundles/addtohomescreen?v=dQY7ReEN3P6AvpTV4mVTeWSR8WQitK0nH1fxax2VNoA1

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

65e4d18477e0e194ae2b3848fe053621a40508eeb817ab8c832b8005edd2c6af

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:19 GMT
Content-Encoding: gzip
Vary: User-Agent,Accept-Encoding
Last-Modified: Tue, 22 Sep 2020 16:40:19 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 22 Sep 2021 16:40:19 GMT
Cache-Control: public
Content-Security-Policy: frame-ancestors *.perkspot.com
Content-Length: 3536
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H2 200 spm.v1.min.js Show response
ak.sail-horizon.com/spm/ 120 KB
43 KB 29ms
27ms Script
application/javascript 143.204.94.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.94.58 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-94-58.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d79a41844504ccb8bd40dcc91e68cd0467e012021852e634567cf0e7b9afba79

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:37:54 GMT
content-encoding: gzip
last-modified: Mon, 21 Sep 2020 17:42:51 GMT
server: AmazonS3
age: 146
etag: "1cc94de012ba79d45eadd015c82acf31"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=600; must-revalidate
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: UQ2zO8BlGQdjtPbtJAQshkFRcCxEfcrXlFFM6UpzheeZAui0tZjuRQ==
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront)

GET
H/1.1 200
OK rollbar.min.js Show response
cdn.rollbar.com/rollbarjs/refs/tags/v2.18.0/ 72 KB
22 KB 52ms
51ms Script
application/javascript 99.84.158.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.rollbar.com/rollbarjs/refs/tags/v2.18.0/rollbar.min.js
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.158.177 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-158-177.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 55f321e4a81f17977a71b1dd2f848c0b10639c8a0ebf64452ccc658fe80e9f7a

Request headers

Origin: https://chubb.perkspot.com
Referer: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:38:30 GMT
Content-Encoding: gzip
Age: 110
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 07 Jul 2020 19:10:26 GMT
Server: AmazonS3
ETag: W/"b4eb6c864526098f8ea9da4024246fdb"
Vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Via: 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
Cache-Control: max-age=30672000,public
X-Amz-Cf-Pop: TXL52-C1
X-Amz-Cf-Id: cKIPOEDaAJijg4SNyUkSV4arvVjhM4X-3v9zlK7RoNHzmUaFG0jQHg==

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ 45 KB
17 KB 14ms
14ms Script
text/javascript 2a00:1450:400c:c07::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 5296
date: Tue, 22 Sep 2020 15:12:03 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17093
expires: Tue, 22 Sep 2020 17:12:03 GMT

GET
H2 200 heap-1214792821.js Show response
cdn.heapanalytics.com/js/ 103 KB
41 KB 50ms
50ms Script
application/javascript 99.84.144.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.heapanalytics.com/js/heap-1214792821.js
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.19 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-19.txl52.r.cloudfront.net
Software: nginx /
Resource Hash: a7557597d9c89e686bff153b4c9541be53c272930d3886e1f3cbfe51605d8ce4

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:38:22 GMT
content-encoding: gzip
server: nginx
age: 117
etag: W/"19b72-wVRQ6qYwK/g09KGFVu+Qcw"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
status: 200
cache-control: public, max-age=120
x-amz-cf-pop: TXL52-C1
x-amz-cf-id: YAHzB4Opj1Di0evIPTuyba0IvSkBFwdKDcvV-f3l7pWB1aOnDOOgbg==
via: 1.1 46d8c022a630614463bdb0576f6829a9.cloudfront.net (CloudFront)

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 80 KB
31 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-578DK6

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9ba920baf500f0d4574f6160f04f16a81736b451a373a4cae91454f795575369

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31488
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:19 GMT

GET
H/1.1 200
OK 35A1AD_0_0.woff2
chubb.perkspot.com/Content/fonts/ 28 KB
28 KB 346ms
214ms Font
font/woff2 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/Content/fonts/35A1AD_0_0.woff2

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/Content/sass/perxcss.css?v=20.9.16425.1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

42ae1eb8cc55b4e2382e02323c96a40e80432d3e810bce85f10c75ddacbd2e2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Origin: https://chubb.perkspot.com
Referer: https://chubb.perkspot.com/Content/sass/perxcss.css?v=20.9.16425.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Last-Modified: Mon, 21 Sep 2020 18:06:45 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "cab6b1f74190d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Date: Tue, 22 Sep 2020 16:40:19 GMT
Accept-Ranges: bytes
Content-Length: 28718
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK fontawesome-webfont.woff2
chubb.perkspot.com/Content/fonts/ 69 KB
69 KB 379ms
244ms Font
font/woff2 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/Content/fonts/fontawesome-webfont.woff2?v=4.6.1

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/Content/css/core?v=20.9.16425.1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Origin: https://chubb.perkspot.com
Referer: https://chubb.perkspot.com/Content/css/core?v=20.9.16425.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Last-Modified: Mon, 21 Sep 2020 18:06:45 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "828ccf74190d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Date: Tue, 22 Sep 2020 16:40:19 GMT
Accept-Ranges: bytes
Content-Length: 70728
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H/1.1 200
OK 35A1AD_3_0.woff2
chubb.perkspot.com/Content/fonts/ 41 KB
41 KB 346ms
211ms Font
font/woff2 23.96.203.178
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://chubb.perkspot.com/Content/fonts/35A1AD_3_0.woff2

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/Content/sass/perxcss.css?v=20.9.16425.1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.96.203.178 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

255733aa26ecbe1a2608fc086d6b510fafce3647ad1ddf22392c390a1306e640

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Request headers

Origin: https://chubb.perkspot.com
Referer: https://chubb.perkspot.com/Content/sass/perxcss.css?v=20.9.16425.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors *.perkspot.com
Last-Modified: Mon, 21 Sep 2020 18:06:45 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "9e52c1f74190d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Date: Tue, 22 Sep 2020 16:40:18 GMT
Accept-Ranges: bytes
Content-Length: 42010
X-Content-Security-Policy: frame-ancestors *.perkspot.com

GET
H2 200 ai.2.min.js Show response
az416426.vo.msecnd.net/scripts/b/ 123 KB
37 KB 10ms
9ms Script
text/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/bundles/insights?v=BYC8KfJNNFadC6mBN8WA9SN_bH3bqkPFtSQg0hXgWI01
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F5B) /
Resource Hash: 0061053848f04ed531336574ed591c136cf8f424b5d68914b2a407a289412eea

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: gzip
content-md5: I8onfuSNSNOwC9VQnISPaw==
age: 308
x-cache: HIT
status: 200
x-ms-meta-aijssdksrc: [scripts]/b/ai.2.5.8.min.js
content-length: 37448
x-ms-lease-status: unlocked
last-modified: Tue, 01 Sep 2020 17:28:03 GMT
server: ECAcc (frc/8F5B)
x-ms-meta-aijssdkver: 2.5.8
etag: 0x8D84E9C618CCA5A
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 862bf06c-601e-0060-4afe-90a1c6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800, immutable
x-ms-version: 2009-09-19
expires: Tue, 22 Sep 2020 17:10:19 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=361657025&utmhn=chubb.perkspot.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Y...
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=913213870.1600792819&jid=764338307&_v=5.7.2dc&z=361657025
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=913213870.1600792819&jid=764338307&_v=5.7.2dc&z=361657025&slf_rd=1&random=4284271330

42 B
106 B

45ms
45ms

Image
image/gif

2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=913213870.1600792819&jid=764338307&_v=5.7.2dc&z=361657025&slf_rd=1&random=4284271330

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-652375-6&cid=913213870.1600792819&jid=764338307&_v=5.7.2dc&z=361657025&slf_rd=1&random=4284271330
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
11 KB 36ms
36ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-578DK6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

2d25f06ba5a1e228262948c457155e24a1d91bfb5dad460bd1dcfe2106011f20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11315
x-xss-protection: 0
server: cafe
etag: 17904044164015545428
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 22 Sep 2020 16:40:19 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-578DK6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 398
date: Tue, 22 Sep 2020 16:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Tue, 22 Sep 2020 18:33:41 GMT

OPTIONS
H2 200 simple
api.sail-personalize.com/v1/personalize/ Frame 0
0 134ms
133ms Other
text/plain 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/simple?pageviews=1&isMobile=0&page=utm_medium%3Demail&page=utm_id%3Dweeklyblast&messageId=21567988.98009&userIdKey=hid&userIdValue=1e19406ad460d8bb6b01f7d418c3fad15b688b2c95a7a11d301df4bc7cd45881eca17d0a0500f115878546ba
Protocol: H2
Server: 99.83.154.140 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,content-type,x-lib-version,x-referring-url
Origin: https://chubb.perkspot.com
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Tue, 22 Sep 2020 16:40:19 GMT
content-type: text/plain
content-length: 18
access-control-allow-origin: https://chubb.perkspot.com
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET,POST,PUT,DELETE
access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version,X-Referring-URL
allow: HEAD,GET,OPTIONS

GET
H2 200 simple Show response
api.sail-personalize.com/v1/personalize/ 288 B
456 B 152ms
151ms Fetch
application/json 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/simple?pageviews=1&isMobile=0&page=utm_medium%3Demail&page=utm_id%3Dweeklyblast&messageId=21567988.98009&userIdKey=hid&userIdValue=1e19406ad460d8bb6b01f7d418c3fad15b688b2c95a7a11d301df4bc7cd45881eca17d0a0500f115878546ba
Requested by: Host: cdn.rollbar.com
URL: https://cdn.rollbar.com/rollbarjs/refs/tags/v2.18.0/rollbar.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash: c0800f4dd1574e62881571e3339bc02988cb02bf5e35b1d85a9099ab939ef467

Request headers

accept: application/json
Referer: https://chubb.perkspot.com/
x-lib-version: v1.0.1
authorization: Bearer 294681006d1c69c4a7d06d0165dc3500
x-referring-url: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
content-type: application/json

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: gzip
allowedorigins: *
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
allowedheaders: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
content-length: 197
allowedmethods: GET,OPTIONS

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/978685899/ 2 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/978685899/?random=1600792819569&cv=9&fst=1600792819569&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg990&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fchubb.perkspot.com%2Foffer%2F1392471%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Citizens%20One%20Student%20Loans%20%7C%20Welcome%20to%20Your%20Chubb%20Discount%20Program&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ded201920f34d77d2f9906dbdc23cac305814c8e04c980e58767a81c5b8042e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1124
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
887 B 6ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:19:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1228
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 22 Sep 2020 17:19:51 GMT

POST
H3-Q050 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
27 B 15ms
15ms XHR
text/plain 2a00:1450:400c:c07::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-652375-6&cid=913213870.1600792819&jid=1079027218&uid=11574996&gjid=636516087&_gid=516090783.1600792820&_u=aSBCgAAjAAAAAE~&z=684620187

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 22 Sep 2020 16:40:19 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://chubb.perkspot.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
61 B 6ms
6ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1489865547&t=pageview&_s=1&dl=https%3A%2F%2Fchubb.perkspot.com%2Foffer%2F1392471%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&ul=en-us&de=UTF-8&dt=You%27re%20on%20your%20way%20to%20saving%20at%20Citizens%20One%20Student%20Loans%20%7C%20Welcome%20to%20Your%20Chubb%20Discount%20Program&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=267775964.913213870.1600792819.1600792819.1600792819.1&_utmz=267775964.1600792819.1.1.utmcid%3Dweeklyblast%7Cutmccn%3D(not%2520set)%7Cutmcmd%3Demail&_utmht=1600792819585&_u=aSBCgAAj~&jid=1079027218&gjid=636516087&cid=913213870.1600792819&uid=11574996&tid=UA-652375-6&_gid=516090783.1600792820&gtm=2wg990578DK6&z=420053925

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 14:29:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 7857
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

asset_composer.js Show response
static.zdassets.com/ekr/ Frame 7643
Redirect Chain

https://assets.zendesk.com/embeddable_framework/main.js
https://static.zdassets.com/ekr/asset_composer.js

24 KB
7 KB

33ms
32ms

Script
application/javascript

104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/ekr/asset_composer.js

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb4b7a1be5f80c37ac74daa6f20b193b24414f23da856ad2560a0053e65a2cb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 38
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: COMPLETED
x-amz-request-id: 8599EB2A7FEECC29
x-amz-id-2: v5e2BdSVys9kp6ftpT/DqjUp2otl1bJmqsgXPpbnFEj+ZtWlcqOWjnWGdiV7bcyPR0Q5zyJw+BE=
last-modified: Tue, 10 Mar 2020 23:13:51 GMT
server: cloudflare
etag: W/"f47f1934dec578b3ec2daacb7e61d9c9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
content-type: application/javascript
cache-control: public, max-age=3600, s-maxage=60
x-amz-version-id: sY6Zq5SXmxNkbgD1V_h8h9T.ZhWYQwC3
cf-request-id: 05584910320000cc4a11864200000001
cf-ray: 5d6d77938b0bcc4a-ZRH

Redirect headers

date: Tue, 22 Sep 2020 16:40:19 GMT
server: cloudflare
status: 301
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
location: https://static.zdassets.com/ekr/asset_composer.js
cache-control: max-age=3600
strict-transport-security: max-age=0
cf-ray: 5d6d77931b7b2355-ZRH
cf-request-id: 0558490feb00002355d3052200000001
expires: Tue, 22 Sep 2020 17:40:19 GMT

OPTIONS
H2 200 simple
api.sail-personalize.com/v1/personalize/ Frame 0
0 134ms
134ms Other
text/plain 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/simple?pageviews=2&isMobile=0&page=utm_medium%3Demail&page=utm_id%3Dweeklyblast&messageId=21567988.98009&userIdKey=hid&userIdValue=1e19406ad460d8bb6b01f7d418c3fad15b688b2c95a7a11d301df4bc7cd45881eca17d0a0500f115878546ba
Protocol: H2
Server: 99.83.154.140 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,content-type,x-lib-version,x-referring-url
Origin: https://chubb.perkspot.com
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Tue, 22 Sep 2020 16:40:19 GMT
content-type: text/plain
content-length: 18
access-control-allow-origin: https://chubb.perkspot.com
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET,POST,PUT,DELETE
access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version,X-Referring-URL
allow: HEAD,GET,OPTIONS

GET
H2 200 simple Show response
api.sail-personalize.com/v1/personalize/ 289 B
458 B 159ms
159ms Fetch
application/json 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/simple?pageviews=2&isMobile=0&page=utm_medium%3Demail&page=utm_id%3Dweeklyblast&messageId=21567988.98009&userIdKey=hid&userIdValue=1e19406ad460d8bb6b01f7d418c3fad15b688b2c95a7a11d301df4bc7cd45881eca17d0a0500f115878546ba
Requested by: Host: cdn.rollbar.com
URL: https://cdn.rollbar.com/rollbarjs/refs/tags/v2.18.0/rollbar.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash: 97b60abddca66cb67594c3d71d5f36dee04189ad9fa1561c0c1da7b7ee20d7be

Request headers

accept: application/json
Referer: https://chubb.perkspot.com/
x-lib-version: v1.0.1
authorization: Bearer 294681006d1c69c4a7d06d0165dc3500
x-referring-url: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
content-type: application/json

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: gzip
allowedorigins: *
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
allowedheaders: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
content-length: 199
allowedmethods: GET,OPTIONS

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
87 B 17ms
16ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-652375-6&cid=913213870.1600792819&jid=1079027218&_u=aSBCgAAjAAAAAE~&z=1243843214

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.de/ads/ 42 B
64 B 31ms
30ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-652375-6&cid=913213870.1600792819&jid=1079027218&_u=aSBCgAAjAAAAAE~&z=1243843214

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 h
heapanalytics.com/ 37 B
212 B 119ms
118ms Image
image/gif 75.101.164.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heapanalytics.com/h?a=1214792821&u=1099463176670886&v=8340262473717367&s=4805107953064959&b=web&tv=4.0&z=0&h=%2Foffer%2F1392471%2Fnone&q=%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&d=chubb.perkspot.com&t=You%27re%20on%20your%20way%20to%20saving%20at%20Citizens%20One%20Student%20Loans%20%7C%20Welcome%20to%20Your%20Chubb%20Discount%20Program&um=email&k=CommunityId&k=808&k=StatusId&k=2&ts=1600792819751&st=1600792819753
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.101.164.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-75-101-164-61.compute-1.amazonaws.com
Software: nginx /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
server: nginx
etag: W/"25-PqzQEyMQ6kTK11azeKO8Bw"
content-type: image/gif
status: 200
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H2 200 identify_v3
heapanalytics.com/api/ 37 B
212 B 121ms
120ms Image
image/gif 75.101.164.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heapanalytics.com/api/identify_v3?a=1214792821&u=1099463176670886&v=8340262473717367&s=4805107953064959&i=11574996&b=web&tv=4.0&z=0&st=1600792819754
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.101.164.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-75-101-164-61.compute-1.amazonaws.com
Software: nginx /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
server: nginx
etag: W/"25-PqzQEyMQ6kTK11azeKO8Bw"
content-type: image/gif
status: 200
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H2 200 add_user_properties_v3
heapanalytics.com/api/ 37 B
212 B 120ms
119ms Image
image/gif 75.101.164.61
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heapanalytics.com/api/add_user_properties_v3?a=1214792821&u=1099463176670886&v=8340262473717367&s=4805107953064959&i=11574996&b=web&tv=4.0&_CommunityId=808&_StatusId=2&st=1600792819754
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.101.164.61 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-75-101-164-61.compute-1.amazonaws.com
Software: nginx /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
server: nginx
etag: W/"25-PqzQEyMQ6kTK11azeKO8Bw"
content-type: image/gif
status: 200
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-length: 37

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/978685899/ 42 B
65 B 20ms
19ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/978685899/?random=1600792819569&cv=9&fst=1600790400000&num=1&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg990&sendb=1&frm=0&url=https%3A%2F%2Fchubb.perkspot.com%2Foffer%2F1392471%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Citizens%20One%20Student%20Loans%20%7C%20Welcome%20to%20Your%20Chubb%20Discount%20Program&async=1&fmt=3&is_vtc=1&random=653610481&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/978685899/ 42 B
88 B 20ms
20ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/978685899/?random=1600792819569&cv=9&fst=1600790400000&num=1&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg990&sendb=1&frm=0&url=https%3A%2F%2Fchubb.perkspot.com%2Foffer%2F1392471%2Fnone%3Futm_medium%3Demail%26utm_id%3Dweeklyblast&tiba=You%27re%20on%20your%20way%20to%20saving%20at%20Citizens%20One%20Student%20Loans%20%7C%20Welcome%20to%20Your%20Chubb%20Discount%20Program&async=1&fmt=3&is_vtc=1&random=653610481&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 perkspot.zendesk.com Show response
ekr.zdassets.com/compose/web_widget/ Frame 7643 798 B
445 B 115ms
114ms XHR
application/json 104.18.71.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ekr.zdassets.com/compose/web_widget/perkspot.zendesk.com

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.71.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2837f61d9667f39af6b7cf98314af572e068d8d1ccef8bfc4aadf7428126515

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
vary: Origin, Accept-Encoding
cf-cache-status: HIT
age: 42
status: 200, 200 OK
strict-transport-security: max-age=0
cf-request-id: 055849105e0000cc3a7e1a2200000001
x-request-id: 858f2ad9-a342-438c-9397-1be04fbe37be
x-runtime: 0.003536
server: cloudflare
etag: W/"d2837f61d9667f39af6b7cf98314af57"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: max-age=600, public, s-maxage=60, stale-while-revalidate=600, stale-if-error=3600
cf-ray: 5d6d7793ca5dcc3a-ZRH

GET
H2 200 pixel
bid.g.doubleclick.net/xbbe/ Frame ED59 0
0 38ms
37ms Document
text/html 74.125.133.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://chubb.perkspot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmqA4qlle6g7BqZ3O4qUTim2fqeugUm9Wqv_OpEqwhaCaYaSwhk9Jk37yKx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://chubb.perkspot.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 22 Sep 2020 16:40:19 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

OPTIONS
H2 200 track
dc.services.visualstudio.com/v2/ Frame 0
0 38ms
38ms Other 52.236.186.210
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Server

52.236.186.210 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,sdk-context
Origin: https://chubb.perkspot.com
Sec-Fetch-Mode: cors

Response headers

status: 200
access-control-allow-methods: POST
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-origin: *
access-control-max-age: 3600
x-content-type-options: nosniff
date: Tue, 22 Sep 2020 16:40:18 GMT
content-length: 0

POST
H2 200 track Show response
dc.services.visualstudio.com/v2/ 96 B
187 B 1077ms
1076ms XHR
application/json 52.236.186.210
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.236.186.210 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e35f30a29d1359038a5b8e999a714cda8270aa4140a9c75510e840e68629881d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://chubb.perkspot.com/
Sdk-Context: appId
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: application/json

Response headers

x-ms-session-id: 5CBBFC93-CCB0-47CB-A8D4-450AA4503D47
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
status: 200
date: Tue, 22 Sep 2020 16:40:20 GMT
access-control-max-age: 3600
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
content-length: 96

GET
H2 200 preload.55392e8c9a3b8090a3f2.js Show response
static.zdassets.com/web_widget/latest/ Frame 5768 61 KB
19 KB 41ms
38ms Script
application/javascript 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/preload.55392e8c9a3b8090a3f2.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7f4cfa38acd5b443b4b6f910f9f991b864b4e848305a4c7f4d19b9478fcc9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 131327
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: COMPLETED
x-amz-request-id: FBD5C9FA4DDED9B2
x-amz-id-2: RAjkVZMRsJjhNbuESgF2vcc8Fbh96RfEuhE3ggSsCCVL9qHpaBagFuNusFTZiTwacf9liIEGiUE=
last-modified: Thu, 17 Sep 2020 07:48:16 GMT
server: cloudflare
etag: W/"49eb01e63d1841b01ce04cf2b2b2f84f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 9T3paqgKSB.1TGni3fi3uEDegCYRKNYv
cf-request-id: 05584910dc0000cc4a11876200000001
cf-ray: 5d6d77949cb8cc4a-ZRH
expires: Fri, 17 Sep 2021 07:48:15 GMT

GET
H2 200 vendors~web_widget.af1f4c14418f7f4d7688.chunk.js Show response
static.zdassets.com/web_widget/latest/ Frame 5768 1 MB
280 KB 65ms
63ms Script
application/javascript 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/vendors~web_widget.af1f4c14418f7f4d7688.chunk.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39e728574e3c99e4633a84fff1ca0df9d61021667f0627a3522f849c3eb468a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 658756
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: COMPLETED
x-amz-request-id: 8514C97EDC2ABBCF
x-amz-id-2: 9MtBggjO1riQ4t7iDsGL2FrvCeWLlNtpQB/kpqIGiawODh1MrnEZOGnRE4hWpF3NAfnD3smXftE=
last-modified: Mon, 14 Sep 2020 09:12:28 GMT
server: cloudflare
etag: W/"ff02a002dde49d70e6fa9965cd35be6a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: hfm6Jx83crjEGFAcGr69w_TyvM2zdxrs
cf-request-id: 05584910dc0000cc4a11877200000001
cf-ray: 5d6d77949cbacc4a-ZRH
expires: Tue, 14 Sep 2021 09:12:27 GMT

GET
H2 200 web_widget.e223f11f955c574d1b79.chunk.js Show response
static.zdassets.com/web_widget/latest/ Frame 5768 851 KB
163 KB 57ms
54ms Script
application/javascript 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/web_widget.e223f11f955c574d1b79.chunk.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c9341a2a75c9949a441e6be45f38f24761f4b6af7fb6ea277e4e4b2f4ee8cc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 131327
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: COMPLETED
x-amz-request-id: 387B62A5D702454D
x-amz-id-2: nIloeKlSfOOXRRKAYM0OgEX/ywI2wxAA+5hHxynwSiv5unYi9uWKn9DpGCTf7sEaPvYMHPefC4Q=
last-modified: Thu, 17 Sep 2020 07:48:18 GMT
server: cloudflare
etag: W/"10d4898e9861af73588f9eefa5dc9e04"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: ji8C2T61EK_IbJ_wuANFTvPvOt4eTc85
cf-request-id: 05584910dc0000cc4a11878200000001
cf-ray: 5d6d77949cbccc4a-ZRH
expires: Fri, 17 Sep 2021 07:48:17 GMT

GET
H2 200 chat-sdk.cec40ba63b2a85de0a9c.chunk.js Show response
static.zdassets.com/web_widget/latest/ Frame 5768 257 KB
50 KB 84ms
82ms Script
application/javascript 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/chat-sdk.cec40ba63b2a85de0a9c.chunk.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8231103d519b2db6114b40807697ff8a7443f6ec6e939c8cb9cb4f5dee7348b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 1190638
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: COMPLETED
x-amz-request-id: 49E392D47B722145
x-amz-id-2: CCrTo5MnDp3FDRPe+JKkuWHe5rEAAZHeJsXS27i+DtQwmbpA0UzYprWzq7JbXhurbAnfpgTh85Y=
last-modified: Thu, 23 Jul 2020 00:30:02 GMT
server: cloudflare
etag: W/"c7b786c485c50d3373906fb0a543389a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: PcnN01NyLbkunfzfd0xMlbllHt.43Log
cf-request-id: 05584910dc0000cc4a11879200000001
cf-ray: 5d6d77949cc2cc4a-ZRH
expires: Fri, 23 Jul 2021 00:30:01 GMT

GET
H2 200 talk-sdk.a78cdd8b4495e55b4f0a.chunk.js Show response
static.zdassets.com/web_widget/latest/ Frame 5768 57 KB
18 KB 41ms
39ms Script
application/javascript 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/talk-sdk.a78cdd8b4495e55b4f0a.chunk.js

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

911245e9a32d617b8b908d8e742522fa9ed193aae41570cdb80b263517e453cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 1190638
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: COMPLETED
x-amz-request-id: C008C246ED477DAB
x-amz-id-2: XjLEqbfiPuql6EX3WggzYoQYlRidsc3wNFxm+df+4jkMQ7OQ60faGLqd1+KYYZ6x6fhdIg3ldQk=
last-modified: Sun, 21 Jun 2020 21:55:01 GMT
server: cloudflare
etag: W/"dd6b4b79adcd15cd09f88b9f6a39d8ab"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: psAWRBeIBfaPkFKrC1wYHLjMlcAD1.mY
cf-request-id: 05584910dc0000cc4a1187a200000001
cf-ray: 5d6d77949cc3cc4a-ZRH
expires: Mon, 21 Jun 2021 21:55:00 GMT

GET
H2 200 config Show response
perkspot.zendesk.com/embeddable/ Frame 7643 721 B
971 B 30ms
30ms XHR
application/json 104.16.53.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://perkspot.zendesk.com/embeddable/config

Requested by

Host: assets.zendesk.com
URL: https://assets.zendesk.com/embeddable_framework/main.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.53.111 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82f0a6a6f8c5503d204a6f6439918e47d27d21c35f189e6e004ac682e8d85d0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://chubb.perkspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 42
status: 200
vary: Origin, Accept-Encoding
cf-request-id: 055849110e00002325ceab4200000001
x-request-id: 5d6d768b2e6623af-SEA
x-runtime: 0.001669
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers
cache-control: public, max-age=60, stale-while-revalidate=600, stale-if-error=3600
x-zendesk-origin-server: embeddable-app-server-b55bf6b74-sjj7p
cf-ray: 5d6d7794e8132325-ZRH

GET
H2 200 en-us-json.cc8e73e5fe307bb27426.chunk.js Show response
static.zdassets.com/web_widget/latest/locales/ Frame 5768 25 KB
5 KB 30ms
30ms Script
application/javascript 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/locales/en-us-json.cc8e73e5fe307bb27426.chunk.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/preload.55392e8c9a3b8090a3f2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8882e31b1407e6da2e2dda44ffa9f1c1a9298059f7203c5fa7d50bee4899783

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:20 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 1190638
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: COMPLETED
x-amz-request-id: 27091CD6C50CF74E
x-amz-id-2: 7O6aFRN3wmyqAHylo4DBQ6+4a7zu9/x4iLYrKBTNPKIymHr4jTxLGfYa2JnwqFzGpUVxuODWXXs=
last-modified: Wed, 22 Jul 2020 04:05:08 GMT
server: cloudflare
etag: W/"c94e458331968060067c4539f118fd54"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: 5EVM6Ae5ZeloER_IP_K91Z5iUqcAli8n
cf-request-id: 05584911550000cc4a11880200000001
cf-ray: 5d6d77955dcecc4a-ZRH
expires: Thu, 22 Jul 2021 04:05:07 GMT

GET
H2 200 framework-boot.c8435bb2267c0b2e3f7f.chunk.js Show response
static.zdassets.com/web_widget/latest/lazy/ Frame 5768 10 KB
4 KB 27ms
27ms Script
application/javascript 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/latest/lazy/framework-boot.c8435bb2267c0b2e3f7f.chunk.js

Requested by

Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/preload.55392e8c9a3b8090a3f2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

28f23136a892031c55898fb4679f2dfeab7d98c71f372068e77b34b20964d736

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:20 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 131326
x-amz-server-side-encryption: AES256
status: 200
x-amz-replication-status: COMPLETED
x-amz-request-id: 4805B1A84B755AB3
x-amz-id-2: Gg4T9b4nyL+MuJ+Y5r6J9hhxcpde749lEO4MOIW6mXuxSAwEUi1pTgD57YObC9NP8JACNKHPr+A=
last-modified: Thu, 17 Sep 2020 07:47:23 GMT
server: cloudflare
etag: W/"6d069a2eb3809a2fdb90dc0e14d7ccc5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
x-amz-version-id: IcmseY2sTDGS6IAW.wrcRn4KB.X_.KnC
cf-request-id: 055849128a0000cc4a11898200000001
cf-ray: 5d6d7797491fcc4a-ZRH
expires: Fri, 17 Sep 2021 07:47:22 GMT

GET
H2 200 embeddable_blip Show response
perkspot.zendesk.com/ Frame 5768 0
540 B 230ms
230ms XHR
text/html 104.16.53.111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://perkspot.zendesk.com/embeddable_blip?type=pageView&data=eyJwYWdlVmlldyI6eyJyZWZlcnJlciI6Imh0dHBzOi8vY2h1YmIucGVya3Nwb3QuY29tIiwidGltZSI6NTUsImxvYWRUaW1lIjpudWxsLCJuYXZpZ2F0b3JMYW5ndWFnZSI6ImVuLVVTIiwicGFnZVRpdGxlIjoiWW91J3JlIG9uIHlvdXIgd2F5IHRvIHNhdmluZyBhdCBDaXRpemVucyBPbmUgU3R1ZGVudCBMb2FucyB8IFdlbGNvbWUgdG8gWW91ciBDaHViYiBEaXNjb3VudCBQcm9ncmFtIiwidXNlckFnZW50IjoiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2IiwiaXNNb2JpbGUiOmZhbHNlLCJpc1Jlc3BvbnNpdmUiOnRydWUsInZpZXdwb3J0TWV0YSI6IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xIiwiaGVscENlbnRlckRlZHVwIjpmYWxzZX0sImJ1aWQiOiI4NDI1MDRhNmY2NmI5ZjgxZDQ4MmE5NDEyNzA2NGVlOSIsInN1aWQiOiJlMzc3MDQ0YjgzYmIyYTk5MzY3ZDhiZTQwMTc4ZGY1NCIsInZlcnNpb24iOiJmZjY4NjkzYWYiLCJ0aW1lc3RhbXAiOiIyMDIwLTA5LTIyVDE2OjQwOjIwLjQ0NloiLCJ1cmwiOiJodHRwczovL2NodWJiLnBlcmtzcG90LmNvbSJ9
Requested by: Host: static.zdassets.com
URL: https://static.zdassets.com/web_widget/latest/vendors~web_widget.af1f4c14418f7f4d7688.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.53.111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:20 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=utf-8
access-control-allow-origin: https://chubb.perkspot.com
cache-control: no-store, no-cache, must-revalidate
cf-ray: 5d6d7797eea12325-ZRH
cf-request-id: 05584912ed00002325cead8200000001

GET
H2 206 chat-incoming-message-notification.mp3
static.zdassets.com/web_widget/static/ Frame 5768 19 KB
20 KB 82ms
81ms Media
audio/mpeg 104.18.70.113
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.zdassets.com/web_widget/static/chat-incoming-message-notification.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 22 Sep 2020 16:40:20 GMT
cf-cache-status: DYNAMIC
x-amz-request-id: 76D997C27E203031
x-amz-server-side-encryption: AES256
cf-ray: 5d6d779abf23cc4a-ZRH
status: 206
x-amz-replication-status: COMPLETED
Content-Length: 19698
x-amz-id-2: NRf8CrVzZoZ+wzA6ithSKJqgul1BJELtD+rg0A3o2EXlRX/Qrrv0BbpplFyraA6hjoEO56GydEg=
Content-Range: bytes 0-19697/19698
last-modified: Tue, 12 Feb 2019 01:07:53 GMT
server: cloudflare
etag: "f11ce9e8f40a392830217253fe75d6de"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0
x-amz-version-id: 7QfN44DQ.h7tzqx9G_4CeAsccdu5t2pF
cache-control: public, max-age=31536000
cf-request-id: 05584914b30000cc4a118b5200000001
accept-ranges: bytes
content-type: audio/mpeg; charset=utf-8
expires: Wed, 12 Feb 2020 01:07:52 GMT

GET
H/1.1

200
OK

Primary Request

Cookie set Combo Show response
studentloans.citizensone.com/lr/
Redirect Chain

http://partner.citizensone.com/perkspot
https://partner.citizensone.com/perkspot
https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

131 KB
131 KB

1677ms
1072ms

Document
text/html

173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: b83acffb85a0798d99bc88bad326110b6c60712303ee135bf8c5acda868adaec

Request headers

Host: studentloans.citizensone.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://chubb.perkspot.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast

Response headers

Cache-Control: public, no-store, max-age=0
Content-Type: text/html; charset=utf-8
Expires: Tue, 22 Sep 2020 16:40:31 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:31 GMT
Vary: *
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=pyp0drd0geat552misgw5wtf; path=/lr/Combo; secure; HttpOnly; SameSite=Lax
X-Release: release_21.2.2
Date: Tue, 22 Sep 2020 16:40:31 GMT
Content-Length: 134019

Redirect headers

Cache-Control: public, no-store, max-age=0
Content-Type: text/html; charset=utf-8
Expires: Tue, 22 Sep 2020 16:40:30 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:30 GMT
Location: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Vary: *
Server: Microsoft-IIS/7.5
Set-Cookie: ASP.NET_SessionId=llv4j0akujqbogzykeykdouh; path=/Perkspot; secure; HttpOnly; SameSite=Lax
X-Release: release_21.2.2
Date: Tue, 22 Sep 2020 16:40:30 GMT
Content-Length: 271

GET
H/1.1 200
OK fonts.css
studentloans.citizensone.com/Content/ 12 KB
2 KB 544ms
181ms Stylesheet
text/css 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/Content/fonts.css
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 80f6aa2a8d7db2336749ee6bd68c034aee3fbdd9475ea7475bd1fd90e27efe6c

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:32 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
Vary: Accept-Encoding
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: text/css
Content-Length: 1636

GET
H/1.1 200
OK main
studentloans.citizensone.com/Content/ 227 KB
227 KB 643ms
280ms Stylesheet
text/css 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/Content/main?v=9qox9dcuGOykfRhZOvBYjmozgUuGjvuy_nqcetEKZsM1
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: fe09b22dbe5969d85a73c65f9cf13e28bdd6ed1b1dba22010899563d6bd4f40c

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:32 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:33 GMT
Server: Microsoft-IIS/7.5
Vary: User-Agent
X-Release: release_21.2.2
Cache-Control: public
Content-Type: text/css; charset=utf-8
Content-Length: 232517
Expires: Wed, 22 Sep 2021 16:40:33 GMT

GET
H/1.1 200
OK B2BComboBundle
studentloans.citizensone.com/Content/ 57 KB
57 KB 639ms
276ms Stylesheet
text/css 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/Content/B2BComboBundle?v=CQp0DcYoV-G-0_8stoxEnW-_KV4d1oLfUmDhgczDj441
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 316d0c396a7613cb29eb2f97b51c7da9435a1dcbd92a719655286532c19c2e7f

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:32 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:33 GMT
Server: Microsoft-IIS/7.5
Vary: User-Agent
X-Release: release_21.2.2
Cache-Control: public
Content-Type: text/css; charset=utf-8
Content-Length: 58219
Expires: Wed, 22 Sep 2021 16:40:33 GMT

GET
H/1.1 200
OK modernizr Show response
studentloans.citizensone.com/bundles/ 11 KB
11 KB 640ms
277ms Script
text/javascript 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/bundles/modernizr?v=inCVuEFe6J4Q07A0AcRsbJic_UE5MwpRMNGcOtk94TE1
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 9e83216908224ffbc39992a5e60f93ca21b8e2240ba28025ba679c4b70f7112d

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:32 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:33 GMT
Server: Microsoft-IIS/7.5
Vary: User-Agent
X-Release: release_21.2.2
Cache-Control: public
Content-Type: text/javascript; charset=utf-8
Content-Length: 11095
Expires: Wed, 22 Sep 2021 16:40:33 GMT

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citizensbank/prod/ 279 KB
88 KB 108ms
49ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: fa21f3e1e9b08a2081408c92e668f630dc3c5795a0a84e7759fd05f12c94578a

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:24 GMT
content-encoding: gzip
last-modified: Tue, 22 Sep 2020 14:39:37 GMT
server: nginx
etag: W/"5f6a0ca9-45cea"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=300

GET
H/1.1 200
OK ERL_CBO_Logo.png
studentloans.citizensone.com/Content/rate-quote/ 6 KB
6 KB 726ms
182ms Image
image/png 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/rate-quote/ERL_CBO_Logo.png
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: ffcb5cb34cc80f1368764a7ae025499377ecf638cdf12c7294017f8e45adb9ab

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 5884

GET
H/1.1 200
OK official-facebook.png
studentloans.citizensone.com/Content/social-icons/ 409 B
659 B 597ms
181ms Image
image/png 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/social-icons/official-facebook.png
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: ec14da626f007013d8b63d18e2ad7334503e2fa8d4f848d538d23a19ec34e546

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 409

GET
H/1.1 200
OK official-twitter.png
studentloans.citizensone.com/Content/social-icons/ 1 KB
2 KB 468ms
185ms Image
image/png 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/social-icons/official-twitter.png
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: fbe286776db04ab76a923866bf736c50a1f2d2ed92e71e5f31f46964d791adbf

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 1311

GET
H/1.1 200
OK official-linkedin.png
studentloans.citizensone.com/Content/social-icons/ 1 KB
1 KB 510ms
200ms Image
image/png 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/social-icons/official-linkedin.png
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 32ce0c0948956a02883836ff2e03fa108bd54fffc9c1aff61aa1f2ec0d03a7f6

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 1079

GET
H/1.1 200
OK ctz_b2b_mobile_percent_icon%20copy.png
studentloans.citizensone.com/Content/erl/B2BCombo/ 2 KB
3 KB 183ms
182ms Image
image/png 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/erl/B2BCombo/ctz_b2b_mobile_percent_icon%20copy.png
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 9dc5c4df962e82aeb99b6afd7448ecb2926f6494c79264d9862634b59b0ca4a3

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 2524

GET
H/1.1 200
OK ctz_b2b_cosigner_icon.png
studentloans.citizensone.com/Content/erl/B2BCombo/ 5 KB
5 KB 186ms
185ms Image
image/png 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/erl/B2BCombo/ctz_b2b_cosigner_icon.png
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: fe9a1ae0d717a13393617cd6a257fa933cb637c0a5515511ff7015081c6c4ed3

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 4647

GET
H/1.1 200
OK ctz_b2b_app_fees_icon.png
studentloans.citizensone.com/Content/erl/B2BCombo/ 4 KB
4 KB 183ms
183ms Image
image/png 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/erl/B2BCombo/ctz_b2b_app_fees_icon.png
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: da920f3ab34be6657328f6fd9a049786a33cc8be516e929b47c1042410f8b5e8

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 3997

GET
H/1.1 200
OK arrow_blue.png
studentloans.citizensone.com/Content/ 106 B
356 B 183ms
183ms Image
image/png 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/arrow_blue.png
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 327e44e8cdd93f33b8908aef8c8fe05624c168a5daba94d7831cbade665326e0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 106

GET
H/1.1 200
OK elh.gif
www.citizensbank.com/assets/CB_media/images/ 1 KB
2 KB 139ms
39ms Image
image/gif 23.77.209.175
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.citizensbank.com/assets/CB_media/images/elh.gif

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.77.209.175 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

/ ASP.NET, ARR/2.5

Resource Hash

56c43c6f5c8209acd47f355810bca2f9b0fc86c4bbdf1361d60fb2d2e2e66f8c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:26 GMT
Last-Modified: Wed, 13 Jun 2018 18:25:21 GMT
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET, ARR/2.5
ETag: "1D40343E3323E80"
X-Frame-Options: SAMEORIGIN
Content-Type: image/gif
Cache-Control: public, max-age=600
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 1433

GET
H/1.1 200
OK fdicFooter.gif
www.citizensbank.com/assets/CB_media/images/ 2 KB
3 KB 138ms
38ms Image
image/gif 23.77.209.175
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.citizensbank.com/assets/CB_media/images/fdicFooter.gif

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.77.209.175 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

/ ASP.NET, ARR/2.5

Resource Hash

dddb031e5144ce20d909dbf4829d637738efa477bf5ab4eab67b1990ef0efb2d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:26 GMT
Last-Modified: Wed, 13 Jun 2018 18:25:22 GMT
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET, ARR/2.5
ETag: "1D40343E3CAD500"
X-Frame-Options: SAMEORIGIN
Content-Type: image/gif
Cache-Control: public, max-age=600
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: none
Content-Length: 2245

GET
H/1.1 200
OK jquery-1.11.1.min.js Show response
studentloans.citizensone.com/Scripts/ 94 KB
33 KB 184ms
184ms Script
application/x-javascript 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/Scripts/jquery-1.11.1.min.js
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:32 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Dec 2019 17:43:46 GMT
Server: Microsoft-IIS/7.5
ETag: "0b5b660caaad51:0"
Vary: Accept-Encoding
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 33323

GET
H/1.1 200
OK jquery Show response
studentloans.citizensone.com/bundles/ 200 KB
200 KB 295ms
295ms Script
text/javascript 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/bundles/jquery?v=0EQOTb8RisNX0ZEeAZWjlQVO8s4DIiB8Rp96LooQXPg1
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: bfdeb8d9fbfe529ff5525562348109ad07bd73d9a4fc6890382e122ba46bca82

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:32 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:33 GMT
Server: Microsoft-IIS/7.5
Vary: User-Agent
X-Release: release_21.2.2
Cache-Control: public
Content-Type: text/javascript; charset=utf-8
Content-Length: 204327
Expires: Wed, 22 Sep 2021 16:40:33 GMT

GET
H/1.1 200
OK bootstrap Show response
studentloans.citizensone.com/bundles/ 41 KB
41 KB 258ms
257ms Script
text/javascript 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/bundles/bootstrap?v=4H4nr4NC9tenl_lsLOI8z477TCCsO0biQKmqvQ85t5M1
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 3bbfc59a5fd2f6c12a3fa4ed85847409301afd5a1e0d5a657544939fbdce4432

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:34 GMT
Server: Microsoft-IIS/7.5
Vary: User-Agent
X-Release: release_21.2.2
Cache-Control: public
Content-Type: text/javascript; charset=utf-8
Content-Length: 41869
Expires: Wed, 22 Sep 2021 16:40:34 GMT

GET
H/1.1 200
OK index-combo Show response
studentloans.citizensone.com/bundles/home/ 19 KB
19 KB 346ms
343ms Script
text/javascript 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/bundles/home/index-combo?v=HR5qkrXp6om6GU46GfVwrVYrzRf75TID799G2VVbZDY1
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 6db12ddad6255141f8b6d45154e6afacc7cbfd412b9254dca5d711291eecad2d

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:34 GMT
Server: Microsoft-IIS/7.5
Vary: User-Agent
X-Release: release_21.2.2
Cache-Control: public
Content-Type: text/javascript; charset=utf-8
Content-Length: 19350
Expires: Wed, 22 Sep 2021 16:40:34 GMT

GET
H/1.1 200
OK erl-calculator Show response
studentloans.citizensone.com/bundles/ 28 KB
28 KB 372ms
368ms Script
text/javascript 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/bundles/erl-calculator?v=JyWJTVmgVccSCuHIY9sCQStLvimgj8Hr98JpN1HbSbk1
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 5e2bd5a90ecf122c4426fc1585c6a0d239e6abf4d7f95baebf203307d3ae882d

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:40:34 GMT
Server: Microsoft-IIS/7.5
Vary: User-Agent
X-Release: release_21.2.2
Cache-Control: public
Content-Type: text/javascript; charset=utf-8
Content-Length: 28345
Expires: Wed, 22 Sep 2021 16:40:34 GMT

GET
H/1.1 200
OK rates-table-erl.js Show response
studentloans.citizensone.com/Scripts/ 17 KB
4 KB 186ms
183ms Script
application/x-javascript 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/Scripts/rates-table-erl.js
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: fd1c8608317876eb077dbe46d443d20ac8db70fff364d4128c5824f852aadf02

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 16:14:24 GMT
Server: Microsoft-IIS/7.5
ETag: "030bf6ffb90d61:0"
Vary: Accept-Encoding
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 3675

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

5 KB
2 KB

78ms
27ms

Script
application/javascript

151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
age: 68884
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4060-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1600792826.328503,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

Redirect headers

x-tw-cdn: VZ
Date: Tue, 22 Sep 2020 16:40:26 GMT
Server: ECS (fcn/418C)
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Location: https://static.ads-twitter.com/oct.js
Content-Length: 0

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1600792826131
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1600792826131

4 KB
2 KB

50ms
50ms

XHR
application/json

34.247.153.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1600792826131

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.247.153.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

11c0d4fa1a258fc738c72fee74284797b97fc23db50ac9ab7c97a02aca71a721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-0adb9c804.edge-irl1.demdex.com 5.78.0.20200908113611 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: azhZV+u9Rjg=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://studentloans.citizensone.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1305
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://studentloans.citizensone.com
X-TID: A25lQeW9QvU=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1600792826131
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

firstevent Show response
citizensbank.demdex.net/
Redirect Chain

https://citizensbank.demdex.net/event?d_nsid=0&d_rtbd=json&d_jsonv=1&d_dst=1&d_cb=CZAAMCallback
https://citizensbank.demdex.net/firstevent?d_nsid=0&d_rtbd=json&d_jsonv=1&d_dst=1&d_cb=CZAAMCallback

3 KB
2 KB

124ms
63ms

Script
application/javascript

52.209.239.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citizensbank.demdex.net/firstevent?d_nsid=0&d_rtbd=json&d_jsonv=1&d_dst=1&d_cb=CZAAMCallback

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.209.239.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4ed84c70f5fbe99d8ce35e1530b55d4ad6684a0fa58e09f407e9ab8fe02ef803

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-09f48a4e2.edge-irl1.demdex.com 5.78.0.20200908113611 4ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: bZAUjZghTD4=
Vary: Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: application/javascript;charset=utf-8
Content-Length: 1193
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: BBKPRELrT/E=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://citizensbank.demdex.net/firstevent?d_nsid=0&d_rtbd=json&d_jsonv=1&d_dst=1&d_cb=CZAAMCallback
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 405
date: Tue, 22 Sep 2020 16:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Tue, 22 Sep 2020 18:33:41 GMT

GET
H/1.1 200
OK Refi_Amazon_Banner_Desktop.jpg
studentloans.citizensone.com/Content/erl/GiftCard/ 25 KB
25 KB 453ms
182ms Image
image/jpeg 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://studentloans.citizensone.com/Content/erl/GiftCard/Refi_Amazon_Banner_Desktop.jpg
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/Content/B2BComboBundle?v=CQp0DcYoV-G-0_8stoxEnW-_KV4d1oLfUmDhgczDj441
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 3fea9f6b900b039ac52678172775b58426aa7b1fa4efe24e9ac7eeb99d5d2aba

Request headers

Referer: https://studentloans.citizensone.com/Content/B2BComboBundle?v=CQp0DcYoV-G-0_8stoxEnW-_KV4d1oLfUmDhgczDj441
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:44 GMT
Server: Microsoft-IIS/7.5
ETag: "088855fcaaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 25747

GET
H/1.1 200
OK citisanb-webfont.woff
studentloans.citizensone.com/fonts/ 25 KB
25 KB 360ms
191ms Font
application/x-woff 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/fonts/citisanb-webfont.woff
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/Content/fonts.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 20a29036fe4a46137c8df7bd672f8bd5673a657e338a709a9ccc629ad886d7fb

Request headers

Origin: https://studentloans.citizensone.com
Referer: https://studentloans.citizensone.com/Content/fonts.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:46 GMT
Server: Microsoft-IIS/7.5
ETag: "0b5b660caaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: application/x-woff
Content-Length: 25372

GET
H/1.1 200
OK fontawesome-webfont.woff2
studentloans.citizensone.com/fonts/ 63 KB
63 KB 358ms
185ms Font
application/x-woff2 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/fonts/fontawesome-webfont.woff2?v=4.4.0
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/Content/B2BComboBundle?v=CQp0DcYoV-G-0_8stoxEnW-_KV4d1oLfUmDhgczDj441
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019

Request headers

Origin: https://studentloans.citizensone.com
Referer: https://studentloans.citizensone.com/Content/B2BComboBundle?v=CQp0DcYoV-G-0_8stoxEnW-_KV4d1oLfUmDhgczDj441
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Wed, 04 Dec 2019 17:43:46 GMT
Server: Microsoft-IIS/7.5
ETag: "0b5b660caaad51:0"
X-Release: release_21.2.2
Accept-Ranges: bytes
Content-Type: application/x-woff2
Content-Length: 64464

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citizensbank/prod/ 496 B
638 B 34ms
34ms Script
text/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citizensbank/prod/serverComponent.php?r=286952.03018903045&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citizensbank/prod/code/&publishedOn=Tue%20Sep%2022%2014:39:35%20GMT%202020&ClientID=397&PageID=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b4edef7690e0cf61248b8fe38db8404effd811c26fd900558acd533b64485fd0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 22 Sep 2020 16:40:26 GMT
cache-control: no-cache, no-store
server: nginx
content-type: text/javascript
content-length: 496
expires: Tue, 22 Sep 2020 16:40:25 GMT

GET
H3-Q050 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
887 B 6ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:19:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1235
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 22 Sep 2020 17:19:51 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
73 B 13ms
13ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=352772109&t=pageview&_s=1&dl=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&dr=https%3A%2F%2Fchubb.perkspot.com%2F&ul=en-us&de=UTF-8&dt=Education%20Refinance%20Loan%20from%20Citizens%20One&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KGBAAEAjAAAAAC~&jid=2107148264&gjid=1987835965&cid=26847358.1600792826&tid=UA-58805805-13&_gid=304766932.1600792826&_r=1&_slc=1&z=1369733309

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://studentloans.citizensone.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 a8f4f4a0c666169ddad10febd12a0c4e.js Show response
nexus.ensighten.com/citizensbank/prod/code/ 100 KB
34 KB 34ms
33ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citizensbank/prod/code/a8f4f4a0c666169ddad10febd12a0c4e.js?conditionId0=421909
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 8381e08ba1da3e3d56d9a3f23eb1f87934cda97a394b260b4ba87f537381fe7f

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
last-modified: Fri, 31 Jul 2020 16:30:09 GMT
server: nginx
etag: W/"5f244711-19181"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 56f2ecd20ee526c624a06280ddad656e.js Show response
nexus.ensighten.com/citizensbank/prod/code/ 16 KB
3 KB 38ms
37ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citizensbank/prod/code/56f2ecd20ee526c624a06280ddad656e.js?conditionId0=393270
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: cabf84461a8d377748f59dd9291707f47814e4906eae1d7fa07690ae2f8d064d

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
last-modified: Tue, 21 Jan 2020 21:45:21 GMT
server: nginx
etag: W/"5e2770f1-3f57"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 c907206b52e74257bff2060a8f20c3de.js Show response
nexus.ensighten.com/citizensbank/prod/code/ 9 KB
3 KB 38ms
37ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citizensbank/prod/code/c907206b52e74257bff2060a8f20c3de.js?conditionId0=365435
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 70a32e8f8b0ba1e572c021d68ebe12140da45ae22d1a662c36b661821586ed8d

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
last-modified: Wed, 08 Jul 2020 12:24:36 GMT
server: nginx
etag: W/"5f05bb04-2259"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
106 B 36ms
35ms Image
text/plain 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=Invalid%20data%20definition%20used%3A%2056820&lnn=-1&fn=&cid=397&client=citizensbank&publishPath=prod&rid=-1&did=-1&errorName=DataDefinitionException
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Tue, 22 Sep 2020 16:40:26 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 22 Sep 2020 16:40:25 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 1 KB
831 B 135ms
135ms Script
application/javascript 2a02:26f0:6c00:2bf::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2bf::1931 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: edb66434567b603679a9fd45786ff3b3b2bf3903d0da2e1c5af626688540bcc4

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-encoding: gzip
x-cdn: akamai
status: 200
etag: "16423308d2b448e51a13f749cab3576e"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=7200
x-fallback: 5820d28-2.16.186.126
accept-ranges: bytes
content-length: 584
access-control-expose-headers: X-CDN

GET
H2 200 merkle_track.js Show response
cdn.merklesearch.com/ 12 KB
3 KB 150ms
48ms Script
application/javascript 99.84.144.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.merklesearch.com/merkle_track.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.144.40 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-144-40.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b1bdb3e02bdbf5388bda50315993c9adb9697e4a0bafaeff5afb7b23b02d00bd

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 13:49:19 GMT
content-encoding: gzip
last-modified: Tue, 11 Jun 2019 16:03:34 GMT
server: AmazonS3
age: 10267
etag: "55b79ca0a4b0e00827f69a2deac1c849"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400
x-amz-cf-pop: TXL52-C1
x-amz-cf-id: _ZMDhHimEzxz2IIg2B6AEQu8CiJLW4tMEucOSYT6yIr6dT8qLQOXxA==
via: 1.1 fe14b43a6dfec5fc809a25185c7fce43.cloudfront.net (CloudFront)

GET
H2 200 loader.js Show response
www.gstatic.com/wcm/ 539 B
493 B 6ms
6ms Script
text/javascript 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/wcm/loader.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/code/a8f4f4a0c666169ddad10febd12a0c4e.js?conditionId0=421909

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e05da544a93b639782cb0974f5dacbfc36b60d40622f680e3383ec581243ca4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 15:55:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 25 Jun 2020 00:15:00 GMT
server: sffe
age: 2686
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 366
x-xss-protection: 0
expires: Tue, 22 Sep 2020 16:55:40 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 21ms
20ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-8253365

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d086a3ad64a17f3a77fd54dbf319f7b86107415a5b70ac5120abcc9325455aba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35637
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H2 200 adsct
t.co/i/ 43 B
449 B 220ms
154ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nuw9t&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 124
pragma: no-cache
last-modified: Tue, 22 Sep 2020 16:40:26 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f264f23284037f54a42c95c0e78e9640
x-transaction: 0094830d00e7f89e
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK Cookie set dest5.html
citizensbank.demdex.net/ Frame 8940 0
0 106ms
58ms Document
text/html 52.209.239.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citizensbank.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.209.239.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: citizensbank.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=49745402664019729664610683948844734608
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 09 Sep 2020 13:37:18 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=49745402664019729664610683948844734608;Path=/;Domain=.demdex.net;Expires=Sun, 21-Mar-2021 16:40:26 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: +FXraFk1SQo=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
smetrics.citizensbank.com/ 48 B
493 B 142ms
44ms XHR
application/x-javascript 15.188.154.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.citizensbank.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=4C3B0C3755C3822E7F000101%40AdobeOrg&mid=49737134053424323854608100952882325239&ts=1600792826376

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.154.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

6f82273f9bf1362eaff869332ec45e6a2bc3fae0d903dd00223f963845d4aa00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-6485bbc5d6-h5wmp
vary: Origin
x-c: master-1362.Ibf4d3d.M0-447
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://studentloans.citizensone.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=X2oo_gAABhQ_yVL0
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=49745402664019729664610683948844734608
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2oo_gAABhQ_yVL0

42 B
915 B

47ms
46ms

Image
image/gif

34.247.153.209
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2oo_gAABhQ_yVL0

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.247.153.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-04d53d23e.edge-irl1.demdex.com 5.78.0.20200908113611 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: uqSrtd5NTIM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Tue, 22 Sep 2020 16:40:26 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=X2oo_gAABhQ_yVL0
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H3-Q050 200 call-tracking_2.js Show response
www.gstatic.com/call-tracking/ 51 KB
19 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/call-tracking/call-tracking_2.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/loader.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee0af9cb821e3b90c73da380ca1ea46a9568f50635facf5e263d0044c9124c9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 07:51:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 23 Apr 2020 17:15:00 GMT
server: sffe
age: 118117
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19708
x-xss-protection: 0
expires: Tue, 21 Sep 2021 07:51:49 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 29ms
28ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-826923884&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2a4b9c1397b0b1d2130e6ba57c51cef39d54db2f5ada6248be8271b6e7cfca8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35673
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-940611339&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b9fcf937a1c0af0d25d572419610edded8a8ad4ca18250c697d81356f4e4666a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35675
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 38ms
37ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-933247469&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d31c7a1b9047c89d89e1e479ee248957e02241f1630553d542d37e1296ef1f9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35674
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 35ms
34ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-894893351&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e6ed90bdc57a62f527655d1c1c133fe843d8bce04d4069b3912dfaee6506e1c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35674
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 39ms
38ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-938156881&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5e8ba39a1fbac87207c44e0a7406a1c1118c15daf1ac72d91667d4e13fffd7ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35674
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 39ms
38ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-940365237&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c48cff5fc47baa351f5ad84e6f0b45c7bdd9fb3d9923a69a141eb4ca3a0a7ca0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35675
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 53ms
51ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-936821595&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

75f56cdec68dece7c9a997f0c2e8d67230d2137f3ab0a0573f07a65ddcdde812

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35674
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 55ms
53ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-935775867&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b63ccfdff1f14a79e21509d78979afd48a4594260db072582e9ca6d5f4729c35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35675
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 51ms
49ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-942049220&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

060ff62fdf98b3e94636ad44eb0733d06b4a2d91e361a73a9a4d75ddc36ffba4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35673
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 92ms
91ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-935344641&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5a0a5baf907052310243f080c49d8f5c0fc6a9d03b0dbffcbdba4f05c3eea33f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35674
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:26 GMT

GET
H2

200

wcm Show response
www.google.ch/pagead/attribution/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/942049220/wcm?cc=ZZ&dn=18668882487&cl=s9I-CP7Jj3sQxI-awQM&ref=https%3A%2F%2Fchubb.perkspot.com%2F&ct_eid=2
https://www.google.ch/pagead/attribution/wcm?cc=ZZ&dn=18668882487&cl=s9I-CP7Jj3sQxI-awQM

80 B
577 B

35ms
15ms

XHR
application/json

2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.ch/pagead/attribution/wcm?cc=ZZ&dn=18668882487&cl=s9I-CP7Jj3sQxI-awQM

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d933a98657089095397ca6126d62e3a07c39e70f82b36f8cea002c0ba5bf1e2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-type: application/json; charset=UTF-8
access-control-allow-origin: null
cache-control: private
access-control-allow-credentials: true
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87
x-xss-protection: 0

Redirect headers

timing-allow-origin: *
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
status: 302
location: https://www.google.ch/pagead/attribution/wcm?cc=ZZ&dn=18668882487&cl=s9I-CP7Jj3sQxI-awQM
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: https://studentloans.citizensone.com
access-control-allow-credentials: true
content-type: text/html; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
11 KB 37ms
36ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-826923884&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

2d25f06ba5a1e228262948c457155e24a1d91bfb5dad460bd1dcfe2106011f20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11315
x-xss-protection: 0
server: cafe
etag: 17904044164015545428
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 22 Sep 2020 16:40:26 GMT

POST
H2 200 delivery Show response
citizensbank.tt.omtrdc.net/rest/v1/ 285 B
475 B 204ms
68ms XHR
application/json 54.76.90.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://citizensbank.tt.omtrdc.net/rest/v1/delivery?client=citizensbank&sessionId=6d08a66bc51045c39ac8bf98407d53ee&version=2.1.1
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.90.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 76d3c41efd88a87996eef063ae44c241e9db0bcef82ab95413e375c7b1d5718e

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
status: 200
vary: Origin,Accept-Encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://studentloans.citizensone.com
access-control-allow-credentials: true
x-request-id: 9027ecb346466b9c2b2c05c7e78711a7

GET
H2 200 main.2424edb5.js Show response
s.pinimg.com/ct/lib/ 48 KB
17 KB 130ms
130ms Script
application/javascript 2a02:26f0:6c00:2bf::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.2424edb5.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2bf::1931 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 87ba34a2dac0d833ec28f5da1f52fa5a2b8279152500e1b825e241e4a64ea488

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-encoding: gzip
x-cdn: akamai
status: 200
etag: "f387c9c6b7338963d43f8909d77d8840"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=1209600
x-fallback: 5821002-2.16.186.126
accept-ranges: bytes
content-length: 16965
access-control-expose-headers: X-CDN

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/826923884/ 3 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/826923884/?random=1600792826638&cv=9&fst=1600792826638&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

356ee74a7fdcfbdc24c2c13fdfbd48d7b1b5da0ec0dc76ed84bb5d637965c631

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1150
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/936821595/ 3 KB
1 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/936821595/?random=1600792826642&cv=9&fst=1600792826642&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

291a25a78d13a5b4e18b315061832e79238e0a8afd945790120b9167b9f80f4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1153
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/935775867/ 3 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/935775867/?random=1600792826643&cv=9&fst=1600792826643&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12a021f311131c5278f1fbccb842500f0ed261c6c40ae45f748ca91271e49855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1140
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/933247469/ 3 KB
1 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/933247469/?random=1600792826644&cv=9&fst=1600792826644&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1190ab672ec78b119d380372cbe97514161ec40a3f58cb6837a8f5e015ddafba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1151
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/894893351/ 3 KB
1 KB 20ms
18ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/894893351/?random=1600792826645&cv=9&fst=1600792826645&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

decbd25e011cb146c2d7eb16c3f9e0b76a6ffb637d10d92a27b7348d6ba69501

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1141
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/940365237/ 3 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/940365237/?random=1600792826646&cv=9&fst=1600792826646&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5c1595100523675d7b4537114fb96259403d9f74e18fdea7d06a473d7fef869e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1142
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/940611339/ 3 KB
1 KB 31ms
27ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/940611339/?random=1600792826648&cv=9&fst=1600792826648&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d20fd746ede98700775310f11e4b16f48bb9727e6d3188604edda293174abaf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1151
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/942049220/ 3 KB
1 KB 26ms
22ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/942049220/?random=1600792826649&cv=9&fst=1600792826649&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b8ead69897dda3de26fe6e7cd76eee9351c5cb9a8c3001fd8acd07eab6abeace

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1149
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/938156881/ 3 KB
1 KB 28ms
24ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/938156881/?random=1600792826650&cv=9&fst=1600792826650&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d57cebe84975b165e77ef4d98619fd1e0d1e0f909aadaa3d188feda5e18451f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1152
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/935344641/ 3 KB
1 KB 222ms
221ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/935344641/?random=1600792826663&cv=9&fst=1600792826663&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b7732da9e72e8a70304acd47504acb22e415bb8ee165acf6fa54dd37aa91742

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1140
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 s16989567212019
smetrics.citizensbank.com/b/ss/citizensbankdotcomprod/1/JS-2.5.0/ 43 B
221 B 45ms
44ms Image
image/gif 15.188.154.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.citizensbank.com/b/ss/citizensbankdotcomprod/1/JS-2.5.0/s16989567212019?AQB=1&ndh=1&pf=1&t=22%2F8%2F2020%2018%3A40%3A26%202%20-120&sdid=08BE266F426DC889-7CC403C439B3974C&mid=49737134053424323854608100952882325239&aamlh=6&ce=UTF-8&ns=citizensbank&pageName=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo&g=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&r=https%3A%2F%2Fchubb.perkspot.com%2F&cc=USD&v0=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c2=D%3Dv2&v2=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&c5=D%3Dv8&c7=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo&v7=New&v8=12%3A40%20PM%7CTuesday&c9=D%3Dv7&v9=CTO&c10=D%3Dv10&v10=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo&c11=D%3Dv11&v11=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&c12=D%3Dv12&v12=%2Flr%2FCombo&c13=D%3Dv13&v13=studentloans.citizensone.com&c14=D%3Dv18&v14=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo&c15=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo&v18=.COM&v19=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo&v26=%3A&v32=49737134053424323854608100952882325239&v54=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&c65=D%3Dv2&v65=D%3Dv2&c75=VisitorAPI%20Present&v82=Legacy%20Site&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=4C3B0C3755C3822E7F000101%40AdobeOrg&AQE=1

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.154.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
x-c: master-1362.Ibf4d3d.M0-447
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 23 Sep 2020 16:40:26 GMT
server: jag
xserver: anedge-6485bbc5d6-mpwzt
etag: 3437676417756004352-4621866414240486903
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 21 Sep 2020 16:40:26 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/826923884/ 42 B
107 B 21ms
19ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/826923884/?random=1600792826638&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=3324761808&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/826923884/ 42 B
107 B 28ms
26ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/826923884/?random=1600792826638&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=3324761808&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/936821595/ 42 B
107 B 26ms
19ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/936821595/?random=1600792826642&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=2876877951&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/936821595/ 42 B
107 B 32ms
25ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/936821595/?random=1600792826642&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=2876877951&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/935775867/ 42 B
107 B 27ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/935775867/?random=1600792826643&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=921249250&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/935775867/ 42 B
107 B 28ms
21ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/935775867/?random=1600792826643&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=921249250&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/933247469/ 42 B
107 B 24ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/933247469/?random=1600792826644&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=731516301&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/933247469/ 42 B
107 B 25ms
22ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/933247469/?random=1600792826644&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=731516301&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/894893351/ 42 B
107 B 24ms
21ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/894893351/?random=1600792826645&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=3064431851&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/894893351/ 42 B
88 B 44ms
41ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/894893351/?random=1600792826645&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=3064431851&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/940365237/ 42 B
88 B 42ms
40ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/940365237/?random=1600792826646&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=3317678903&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/940365237/ 42 B
65 B 43ms
41ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/940365237/?random=1600792826646&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=3317678903&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
652 B 230ms
157ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nuw9t&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 126
pragma: no-cache
last-modified: Tue, 22 Sep 2020 16:40:26 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 10d1bbe6158193c5b0ff2837b89dee52
x-transaction: 005b2bfe001c8873
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK ERLRates Show response
studentloans.citizensone.com/lr/combo/Loan/ 21 KB
21 KB 189ms
184ms XHR
application/json 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/lr/combo/Loan/ERLRates
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/bundles/jquery?v=0EQOTb8RisNX0ZEeAZWjlQVO8s4DIiB8Rp96LooQXPg1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: e44ede153cad0294665eb6c13f0ac99a140880484b5dc01f7d18bbcc9ae160a5

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:38:12 GMT
Server: Microsoft-IIS/7.5
Vary: *
X-Release: release_21.2.2
Cache-Control: public, max-age=457
Content-Type: application/json; charset=utf-8
Content-Length: 21106
Expires: Tue, 22 Sep 2020 16:48:12 GMT

GET
H/1.1 200
OK ParentErlRates Show response
studentloans.citizensone.com/lr/combo/Loan/ 6 KB
6 KB 230ms
183ms XHR
application/json 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/lr/combo/Loan/ParentErlRates
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/bundles/jquery?v=0EQOTb8RisNX0ZEeAZWjlQVO8s4DIiB8Rp96LooQXPg1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 12cf6018c3fd78630030aa3215319873fb6adc906d49191563b6bc184e3cdf70

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:38:11 GMT
Server: Microsoft-IIS/7.5
Vary: *
X-Release: release_21.2.2
Cache-Control: public, max-age=457
Content-Type: application/json; charset=utf-8
Content-Length: 5875
Expires: Tue, 22 Sep 2020 16:48:11 GMT

GET
H/1.1 200
OK ERLRates Show response
studentloans.citizensone.com/lr/combo/Loan/ 21 KB
21 KB 312ms
190ms XHR
application/json 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/lr/combo/Loan/ERLRates
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/bundles/jquery?v=0EQOTb8RisNX0ZEeAZWjlQVO8s4DIiB8Rp96LooQXPg1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: e44ede153cad0294665eb6c13f0ac99a140880484b5dc01f7d18bbcc9ae160a5

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:38:12 GMT
Server: Microsoft-IIS/7.5
Vary: *
X-Release: release_21.2.2
Cache-Control: public, max-age=457
Content-Type: application/json; charset=utf-8
Content-Length: 21106
Expires: Tue, 22 Sep 2020 16:48:12 GMT

GET
H/1.1 200
OK BarStudyRates Show response
studentloans.citizensone.com/lr/combo/Loan/ 9 KB
9 KB 314ms
184ms XHR
application/json 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/lr/combo/Loan/BarStudyRates
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/bundles/jquery?v=0EQOTb8RisNX0ZEeAZWjlQVO8s4DIiB8Rp96LooQXPg1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 0c9856f4e5c68a7fb4a68848604d86b1d0b77118288641d79f0b96c518eb485a

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:38:11 GMT
Server: Microsoft-IIS/7.5
Vary: *
X-Release: release_21.2.2
Cache-Control: public, max-age=456
Content-Type: application/json; charset=utf-8
Content-Length: 8899
Expires: Tue, 22 Sep 2020 16:48:11 GMT

GET
H/1.1 200
OK MedicalResidencyRates Show response
studentloans.citizensone.com/lr/combo/Loan/ 9 KB
9 KB 325ms
184ms XHR
application/json 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/lr/combo/Loan/MedicalResidencyRates
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/bundles/jquery?v=0EQOTb8RisNX0ZEeAZWjlQVO8s4DIiB8Rp96LooQXPg1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: c52ecdf3468821a31aebcdb3d0e11da26dc6caab8e981823c95e4648e265b3e4

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:38:12 GMT
Server: Microsoft-IIS/7.5
Vary: *
X-Release: release_21.2.2
Cache-Control: public, max-age=458
Content-Type: application/json; charset=utf-8
Content-Length: 8989
Expires: Tue, 22 Sep 2020 16:48:12 GMT

GET
H2 200 inqChatLaunch345.js Show response
citizens.inq.com/chatskins/launch/ 23 KB
7 KB 536ms
170ms Script
application/javascript 74.201.20.82
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL

https://citizens.inq.com/chatskins/launch/inqChatLaunch345.js?_=1600792826613

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/bundles/jquery?v=0EQOTb8RisNX0ZEeAZWjlQVO8s4DIiB8Rp96LooQXPg1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.201.20.82 , United States, ASN10912 (INTERNAP-BLK, US),

Reverse DNS

Software

TouchCommerce Server /

Resource Hash

e60734394e81954dabc01cf634b8b478ae421caea1bd20ab6f00418031ee229f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 16:16:17 GMT
server: TouchCommerce Server
accept-language: bytes
etag: "8HGOptrAzDi"
content-type: application/javascript
status: 200
cache-control: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-length: 6692
x-xss-protection: 1; mode=block
expires: Tue, 22 Sep 2020 17:40:27 GMT

GET
H/1.1 200
OK TruFitRates Show response
studentloans.citizensone.com/lr/combo/Loan/ 68 KB
69 KB 344ms
190ms XHR
application/json 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/lr/combo/Loan/TruFitRates
Requested by: Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/bundles/jquery?v=0EQOTb8RisNX0ZEeAZWjlQVO8s4DIiB8Rp96LooQXPg1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: 92eeb9dfd2c7117fcde85274ba851a80c8ea41b874cbaee50b7a79b77c245f64

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:34 GMT
Last-Modified: Tue, 22 Sep 2020 16:38:12 GMT
Server: Microsoft-IIS/7.5
Vary: *
X-Release: release_21.2.2
Cache-Control: public, max-age=457
Content-Type: application/json; charset=utf-8
Content-Length: 69926
Expires: Tue, 22 Sep 2020 16:48:12 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/942049220/ 42 B
65 B 29ms
26ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/942049220/?random=1600792826649&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1602032787&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/942049220/ 42 B
65 B 40ms
38ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/942049220/?random=1600792826649&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1602032787&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/938156881/ 42 B
65 B 31ms
19ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/938156881/?random=1600792826650&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1930848590&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/938156881/ 42 B
65 B 33ms
22ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/938156881/?random=1600792826650&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1930848590&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/940611339/ 42 B
65 B 31ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/940611339/?random=1600792826648&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=2699131181&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/940611339/ 42 B
65 B 36ms
26ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/940611339/?random=1600792826648&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=2699131181&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 38 B
514 B 127ms
124ms XHR
application/json 23.210.248.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2619414502653&ov=%7B%22page_name%22%3A%22allpages%22%2C%22page_category%22%3A%22allpages%22%7D&cb=1600792826799

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.2424edb5.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.189 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-189.deploy.static.akamaitechnologies.com

Software

Resource Hash

a0774f290781320b1ee451e53e384381cfa827d5c94526856eb4f5f80b3e50e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:26 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cdn: akamai
pragma: no-cache
status: 200
x-envoy-upstream-service-time: 0
x-pinterest-rid: 1673953217502265
pin-unauth: dWlkPVkyTmxPRGt3T0RNdE1HUXlaQzAwTUdReUxXRTNPRFF0TjJZNVpqUXpaR013Wm1NNSZycD1abUZzYzJV
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
content-type: application/json; charset=utf-8
access-control-allow-origin: https://studentloans.citizensone.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
content-length: 64
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
282 B 132ms
130ms Image
image/gif 23.210.248.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?tid=2619414502653&ov=%7B%22page_name%22%3A%22allpages%22%2C%22page_category%22%3A%22allpages%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500%22%2C%22ref%22%3A%22https%3A%2F%2Fchubb.perkspot.com%2F%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%222424edb5%22%7D&cb=1600792826800

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.189 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-189.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-cdn: akamai
status: 200
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 8
content-length: 35
x-pinterest-rid: 0671223207846662
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/935344641/ 42 B
65 B 23ms
22ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/935344641/?random=1600792826663&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1358421429&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/935344641/ 42 B
65 B 24ms
23ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/935344641/?random=1600792826663&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1358421429&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 / Show response
ct.pinterest.com/md/ 0
223 B 123ms
123ms XHR
text/plain 23.210.248.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/md/

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.2424edb5.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.189 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-189.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-cdn: akamai
status: 204
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 0
x-pinterest-rid: 5877886539780296
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK tag.js Show response
t.a3cloud.net/AM-141554/ 11 KB
4 KB 470ms
393ms Script
application/javascript 99.86.7.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.a3cloud.net/AM-141554/tag.js?nm=am
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.124 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-124.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3327c49ffc4fc9b396bbda25c6c47d423cc533d77a7498f53cb39b5f04727cb4

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: SpNwtOKMtb6YusllNM1HRyIznL9h9j5c
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 12 Feb 2020 16:22:41 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA6-C1
ETag: "a891dec118d4055610885025a6e7e993"
Transfer-Encoding: chunked
X-Cache: RefreshHit from cloudfront
Content-Type: application/javascript
Via: 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront)
Date: Tue, 22 Sep 2020 16:40:28 GMT
Connection: keep-alive
X-Amz-Cf-Id: 4QEOiE7ngjJZ_nCPlZN6HglwKQK4TA4qYuKMfkdxVxfMMiaEWHH1Sw==

GET
H3-Q050

200

activityi;dc_pre=CILS0v6Z_esCFejIuwgd9JQC-w;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=49737134053424323854608100952882325239;u2=https%253...
8253365.fls.doubleclick.net/ Frame A9F6
Redirect Chain

https://8253365.fls.doubleclick.net/activityi;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=49737134053424323854608100952882325239;u2=https%2...
https://8253365.fls.doubleclick.net/activityi;dc_pre=CILS0v6Z_esCFejIuwgd9JQC-w;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=497371340534243...

0
0

47ms
45ms

Document
text/html

216.58.208.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8253365.fls.doubleclick.net/activityi;dc_pre=CILS0v6Z_esCFejIuwgd9JQC-w;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=49737134053424323854608100952882325239;u2=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;u3=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.208.38 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s12-in-f38.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8253365.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CILS0v6Z_esCFejIuwgd9JQC-w;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=49737134053424323854608100952882325239;u2=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;u3=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl2QYbYilzVOnfpDcZf9ELwXsSkoRNLX5iI2rI94nPuE8lHA0Clh3nETdTm
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 22 Sep 2020 16:40:27 GMT
expires: Tue, 22 Sep 2020 16:40:27 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 473
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 22 Sep 2020 16:40:27 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8253365.fls.doubleclick.net/activityi;dc_pre=CILS0v6Z_esCFejIuwgd9JQC-w;src=8253365;type=allpgs;cat=allpageu;ord=1;num=280850374533;gtm=2od990;auiddc=740116574.1600792826;u1=49737134053424323854608100952882325239;u2=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;u3=https%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/826923884/ 3 KB
1 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/826923884/?random=1600792827293&cv=9&fst=1600792827293&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca6e05d1144f9600151db30ae796f344eaa7b682a66aa19d829eebdbd3b05392

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1139
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/940611339/ 3 KB
1 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/940611339/?random=1600792827299&cv=9&fst=1600792827299&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c05cd198351936a3e998107c919bc7d73b18aa6b082994090d3b57d1b72f4f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1149
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/933247469/ 3 KB
1 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/933247469/?random=1600792827302&cv=9&fst=1600792827302&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57ba758dcb1e78e69507b65039f8bbdaaa9d94b5f8c85e6624acca110a269d75

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1151
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/894893351/ 3 KB
1 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/894893351/?random=1600792827304&cv=9&fst=1600792827304&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74ce78acff32e8f0e85d4e48df11d3878fa7bef270fa5a8ab2acd0f2f8ed96f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1150
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/938156881/ 3 KB
1 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/938156881/?random=1600792827307&cv=9&fst=1600792827307&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d923e22c85da30b99cc1519fd9abdac4fa896ddd9f04bf586c7d6cbfb52cee05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1150
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/940365237/ 3 KB
1 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/940365237/?random=1600792827309&cv=9&fst=1600792827309&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e18cb654469bf08f25a764fb23172db59a42aa355dc80f14ffc4dd4723419a0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1148
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/936821595/ 3 KB
1 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/936821595/?random=1600792827312&cv=9&fst=1600792827312&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3942d95c2daec33e89a5761fef33a208f0f125db2d8a3758a90ae52f65bfbb87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1149
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/935775867/ 3 KB
1 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/935775867/?random=1600792827314&cv=9&fst=1600792827314&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11fccee55be781038c0c85c5c87e03c507c10551029800fc2c67d0507aa6aae4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1152
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/942049220/ 3 KB
1 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/942049220/?random=1600792827317&cv=9&fst=1600792827317&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de4e3880a30945353b7a90cb7c830adc06aa81167839157558972f7af9837094

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1150
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/935344641/ 3 KB
1 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/935344641/?random=1600792827319&cv=9&fst=1600792827319&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

455d2d4e80da24d0a86989925cea3c3be7be3578748ebb73026240d0f6a3a13d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1149
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-770144981&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1a94fbba728c9d38d6cb4f171ca6ba6ef70f155353484322421d3b4116f46701

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35674
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:27 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 50ms
49ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-1791096

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e5ae0fe96873aea82e0ebfd0cdd03e1f5b33bd66e72ddc3f97a366d7e07d58e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35636
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:27 GMT

GET
H2 200 pixel
bid.g.doubleclick.net/xbbe/ Frame DF6A 0
0 38ms
37ms Document
text/html 74.125.133.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl2QYbYilzVOnfpDcZf9ELwXsSkoRNLX5iI2rI94nPuE8lHA0Clh3nETdTm
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 22 Sep 2020 16:40:27 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel
bid.g.doubleclick.net/xbbe/ Frame 948D 0
0 38ms
36ms Document
text/html 74.125.133.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl2QYbYilzVOnfpDcZf9ELwXsSkoRNLX5iI2rI94nPuE8lHA0Clh3nETdTm
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 22 Sep 2020 16:40:27 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel
bid.g.doubleclick.net/xbbe/ Frame E4E1 0
0 37ms
37ms Document
text/html 74.125.133.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl2QYbYilzVOnfpDcZf9ELwXsSkoRNLX5iI2rI94nPuE8lHA0Clh3nETdTm
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 22 Sep 2020 16:40:27 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel
bid.g.doubleclick.net/xbbe/ Frame EACF 0
0 36ms
36ms Document
text/html 74.125.133.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl2QYbYilzVOnfpDcZf9ELwXsSkoRNLX5iI2rI94nPuE8lHA0Clh3nETdTm
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 22 Sep 2020 16:40:27 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel
bid.g.doubleclick.net/xbbe/ Frame 4607 0
0 38ms
38ms Document
text/html 74.125.133.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl2QYbYilzVOnfpDcZf9ELwXsSkoRNLX5iI2rI94nPuE8lHA0Clh3nETdTm
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 22 Sep 2020 16:40:27 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK inqChat.html Show response
studentloans.citizensone.com/ Frame A5D1 632 B
882 B 195ms
187ms Document
text/html 173.209.247.165
SRS-6-Z-7381

General

Check archive.org

Show headers Download Go to

Full URL: https://studentloans.citizensone.com/inqChat.html?IFRAME
Requested by: Host: citizens.inq.com
URL: https://citizens.inq.com/chatskins/launch/inqChatLaunch345.js?_=1600792826613
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.209.247.165 San Francisco, United States, ASN7381 (SRS-6-Z-7381, US),
Reverse DNS
Software: Microsoft-IIS/7.5 /
Resource Hash: d5392818f8fd88f711a3e836546a0d5e7841613f1ce120bea95e52937c3d57cf

Request headers

Host: studentloans.citizensone.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: check=true; _ga=GA1.2.26847358.1600792826; _gid=GA1.2.304766932.1600792826; _gat=1; mtgcampleadsource=Perkspot-B2B; mtgdmpleadsource=earned; mtgcampname=SID823335-StudentLending; mtgcampdetails=B2B-StudentLendingCombo; mtgcampversion=pw1; mtgcampbrand=CO; dmpsite=CTO; dmpprodtype=ERL; AMCVS_4C3B0C3755C3822E7F000101%40AdobeOrg=1; _gcl_au=1.1.740116574.1600792826; rkglsid=h-5b1c4df2722b6263735afa16174b6b01_t-1600792827; AMCV_4C3B0C3755C3822E7F000101%40AdobeOrg=1585540135%7CMCIDTS%7C18528%7CMCMID%7C49737134053424323854608100952882325239%7CMCAAMLH-1601397626%7C6%7CMCAAMB-1601397626%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1600800026s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18535%7CvVersion%7C4.4.0; gpv_v51=no%20value; s_nr=1600792826674-New; s_cpmcvp=%5B%5B%27Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%27%2C%271600792826675%27%5D%5D; s_cc=true; mbox=session#6d08a66bc51045c39ac8bf98407d53ee#1600794687|PC#6d08a66bc51045c39ac8bf98407d53ee.37_0#1664037627; mboxEdgeCluster=37; _pin_unauth=dWlkPVkyTmxPRGt3T0RNdE1HUXlaQzAwTUdReUxXRTNPRFF0TjJZNVpqUXpaR013Wm1NNSZycD1abUZzYzJV; s_ppvl=https%253A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%253FWT.mc_id%253DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%2526b2boffer%253Damazon500%2C40%2C40%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP; s_ppv=https%253A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%253FWT.mc_id%253DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%2526b2boffer%253Damazon500%2C39%2C39%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500

Response headers

Content-Type: text/html
Last-Modified: Wed, 04 Dec 2019 17:43:46 GMT
Accept-Ranges: bytes
ETag: "0b5b660caaad51:0"
Server: Microsoft-IIS/7.5
X-Release: release_21.2.2
Date: Tue, 22 Sep 2020 16:40:35 GMT
Content-Length: 632

GET
H3-Q050 200 conversion.js Show response
www.googleadservices.com/pagead/ 29 KB
11 KB 25ms
16ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd63d6a5ec44215e50612d8bea8eff0a12f5d4981ab6745db8d8479f7c102845

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11416
x-xss-protection: 0
server: cafe
etag: 7270336119834106254
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 22 Sep 2020 16:40:27 GMT

GET
H2 200 detector-dom.min.js Show response
cdn.glassboxcdn.com/citizen/com/p/ 297 KB
92 KB 50ms
16ms Script
application/javascript 2606:4700:10::6816:653
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.glassboxcdn.com/citizen/com/p/detector-dom.min.js?
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 581fea0dca42905acf390bbe5720f9cc5ee1a890a621f1a9518a13680cf967c3

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
via: 1.1 ccfe5851ecd4194e2d976fb32dec7539.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 3281
x-cache: Hit from cloudfront
status: 200
content-encoding: gzip
content-type: application/javascript
cf-request-id: 0558492dec0000d705bf282200000001
last-modified: Thu, 13 Aug 2020 16:10:49 GMT
server: cloudflare
etag: W/"6bb8c9bc05b7a36648bea852c3c55c92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: ln.0LsbiwZmgD6RyIOB.qX3JrcuBp.EK
cache-control: max-age=14400
x-amz-cf-pop: FRA2-C2
cf-ray: 5d6d77c31b9ad705-FRA
x-amz-cf-id: Rls2bMCDl6zWWzX4KRrAk-bzf8dLTy4k3sM83I0GxeHTAFwTPzHC7A==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 135 KB
34 KB 15ms
5ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34302
x-xss-protection: 0
pragma: public
x-fb-debug: miTp43AnT5IlPmwxqBAiijMtZsxhzqnBbUEilNIkxCnFlm2IljOqB+UtUlN3HxZO/Pa2peQdR59H4BETCB9nYw==
x-fb-trip-id: 1460883810
x-frame-options: DENY
date: Tue, 22 Sep 2020 16:40:27 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1

200
OK

bounce Show response
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?add=10100&redir=&t=1
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D10100%26redir%3D%26t%3D1

0
1 KB

37ms
34ms

Script
application/javascript

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D10100%26redir%3D%26t%3D1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

538.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Sep 2020 16:40:27 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.14:80
AN-X-Request-Uuid: 51c934ca-1563-4f54-b998-2e9556f31de2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 22 Sep 2020 16:40:27 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.244:80
AN-X-Request-Uuid: f7fd0dba-f4fc-4279-8206-ab5f0b7db6fd
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D10100%26redir%3D%26t%3D1
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 6 KB
3 KB 120ms
48ms Script
application/x-javascript 23.210.250.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.250.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 3dbe82bc7b6967990c2ac5fc49ccce4f5cda3177a5f1cb9f5ac15810610f4fed

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:27 GMT
Content-Encoding: gzip
Last-Modified: Sun, 06 Sep 2020 11:14:30 GMT
Server: AkamaiNetStorage
ETag: "70678dbef44ec87a01b0658386ba8cbb:1599390870.727094"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2697
Expires: Tue, 22 Sep 2020 17:00:27 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
760 B 18ms
9ms Script
application/x-javascript 2a02:26f0:10c:58e::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:58e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 83af74f9ae1d1e4be00a7e271ab233c20ecc5769bdbd1c72e0524dc86bdf12e4

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:27 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Sep 2020 18:39:56 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=50834
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 447

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/826923884/ 42 B
88 B 27ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/826923884/?random=1600792827293&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=4011368230&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/826923884/ 42 B
88 B 26ms
19ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/826923884/?random=1600792827293&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=4011368230&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/940611339/ 42 B
65 B 30ms
23ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/940611339/?random=1600792827299&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1350293057&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/940611339/ 42 B
65 B 31ms
23ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/940611339/?random=1600792827299&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1350293057&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/933247469/ 42 B
65 B 29ms
22ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/933247469/?random=1600792827302&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1217181774&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/933247469/ 42 B
65 B 32ms
25ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/933247469/?random=1600792827302&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1217181774&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/894893351/ 42 B
65 B 30ms
23ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/894893351/?random=1600792827304&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1222161839&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/894893351/ 42 B
65 B 34ms
28ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/894893351/?random=1600792827304&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1222161839&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/940365237/ 42 B
65 B 28ms
22ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/940365237/?random=1600792827309&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1914138880&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/940365237/ 42 B
65 B 40ms
34ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/940365237/?random=1600792827309&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1914138880&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/938156881/ 42 B
65 B 27ms
22ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/938156881/?random=1600792827307&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1119883835&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/938156881/ 42 B
65 B 33ms
28ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/938156881/?random=1600792827307&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1119883835&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/936821595/ 42 B
65 B 29ms
25ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/936821595/?random=1600792827312&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=790109435&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/936821595/ 42 B
65 B 59ms
54ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/936821595/?random=1600792827312&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=790109435&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/942049220/ 42 B
65 B 31ms
26ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/942049220/?random=1600792827317&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=3739350223&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/942049220/ 42 B
65 B 30ms
25ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/942049220/?random=1600792827317&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=3739350223&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/935775867/ 42 B
65 B 32ms
27ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/935775867/?random=1600792827314&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=2866238187&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/935775867/ 42 B
65 B 30ms
25ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/935775867/?random=1600792827314&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=2866238187&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/935344641/ 42 B
65 B 28ms
24ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/935344641/?random=1600792827319&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1868682573&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/935344641/ 42 B
65 B 31ms
26ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/935344641/?random=1600792827319&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1868682573&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
11 KB 22ms
19ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-770144981&l=dataLayer&cx=c

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11311
x-xss-protection: 0
server: cafe
etag: 12833363978352728442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 22 Sep 2020 16:40:27 GMT

GET
H/1.1 200
OK insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 22ms
9ms Script
application/x-javascript 2a02:26f0:10c:58e::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:58e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:27 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Sep 2020 20:29:41 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=36543
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 435349033276053 Show response
connect.facebook.net/signals/config/ 151 KB
38 KB 13ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/435349033276053?v=2.9.24&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

64be26da0b22259ffa20b0b16f5b592a26ecf15068762119b4e219968e9ced1c

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 38315
x-xss-protection: 0
pragma: public
x-fb-debug: JKm/HG2wclpOp3wBoPFTGocWucc42SfYk0u96GyBHJ1zhccdG2d7evxyDSUQguoxW44FCZL1CglFhwVs6ZxE8g==
x-fb-trip-id: 1460883810
x-frame-options: DENY
date: Tue, 22 Sep 2020 16:40:27 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 52ms
51ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-1791096&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

586664d0cb59cecbc04103f037ad655beaaec5d937c697e293d984e4257f6c86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35635
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:27 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 82ms
32ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-8022851&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8253365

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ad5da3bebca23142495bbd71b45711cfbe4d3857a57d49960a401a28185c4fdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35635
x-xss-protection: 0
last-modified: Tue, 22 Sep 2020 15:21:13 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 22 Sep 2020 16:40:27 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/770144981/ 3 KB
1 KB 27ms
24ms Script
text/javascript 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770144981/?random=1600792827472&cv=9&fst=1600792827472&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15c0d41e38829cb86de92c1d6f98b7a93679efb6cd16ff149e14181c6dd8ce92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1140
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cls_report Show response
report.citizen.glassboxdigital.io/glassbox/reporting/37272EEE-17C5-70B4-EA6F-C6F8796CE694/ 0
940 B 381ms
126ms XHR
text/plain 52.73.94.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://report.citizen.glassboxdigital.io/glassbox/reporting/37272EEE-17C5-70B4-EA6F-C6F8796CE694/cls_report?_cls_s=78377534-6b3e-4155-bd09-a039c2e15d84%3A0&_cls_v=172ce32f-08e9-41b1-a561-c8f7ab646cc4
Requested by: Host: cdn.glassboxcdn.com
URL: https://cdn.glassboxcdn.com/citizen/com/p/detector-dom.min.js?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.94.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: GlassBox Cligate /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:27 GMT
Server: GlassBox Cligate
vary: origin
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://studentloans.citizensone.com
access-control-allow-credentials: true
Connection: keep-alive
GB-Server: g5025
X-Robots-Tag: noindex
Content-Length: 0

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=583769&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D583769%26url%3Dhttps%253A%252F%252Fstudentloans.citizensone.com%252Flr%252FCombo%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=583769&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-...

0
57 B

113ms
113ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=583769&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&time=1600792827512&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: Ty4Hc5goNxawgHsnbisAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: rSMBb5goNxYg6bIKmysAAA==
pragma: no-cache
x-li-pop: afd-prod-lva1
x-msedge-ref: Ref A: 3150733CB8624D3997EAEC8997685A78 Ref B: FRAEDGE1209 Ref C: 2020-09-22T16:40:27Z
x-frame-options: sameorigin
date: Tue, 22 Sep 2020 16:40:27 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=583769&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&time=1600792827512&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 707569535948495 Show response
connect.facebook.net/signals/config/ 151 KB
37 KB 9ms
9ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/707569535948495?v=2.9.24&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cecd63a54fbb0c3ee2fd20c3b217c0ec4b0e9e5d03de4394d4180daee2ccea4b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 38247
x-xss-protection: 0
pragma: public
x-fb-debug: Q3u6Tl2KUWVVFXXlkc29kGRNgRWPgYn55k7+GWXNLDPBmTlFJk4A5MdqZwfNB3J6YJU3QK9kcfH3l72ekOWMCA==
x-fb-trip-id: 1460883810
x-frame-options: DENY
date: Tue, 22 Sep 2020 16:40:27 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
256 B 6ms
5ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=435349033276053&ev=PageView&dl=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&rl=https%3A%2F%2Fchubb.perkspot.com%2F&if=false&ts=1600792827525&sw=1600&sh=1200&v=2.9.24&r=stable&a=tmensighten&ec=0&o=29&fbp=fb.1.1600792827524.1576737921&it=1600792827392&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 22 Sep 2020 16:40:27 GMT

GET
H/1.1 200
OK unifiedPixel
tr.outbrain.com/ 43 B
275 B 726ms
181ms Image
image/gif 38.133.127.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.outbrain.com/unifiedPixel?marketerId=001b0a938fd4b435e0d11ea9b677bf8d05&obApiVersion=1.0&obtpVersion=1.3.1&name=PAGE_VIEW&dl=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&optOut=false&bust=08409314397639875
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.133.127.127 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
Software: /
Resource Hash: 33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 22 Sep 2020 16:40:28 GMT
Cache-Control: no-cache
Connection: close
X-TraceId: ec3fc945b242a2c19e68c8322a4f895f
content-encoding: gzip
Content-Length: 60
Content-Type: image/gif;

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/770144981/ 42 B
65 B 21ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/770144981/?random=1600792827472&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1799340327&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/770144981/ 42 B
65 B 22ms
21ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/770144981/?random=1600792827472&cv=9&fst=1600790400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa990&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&ref=https%3A%2F%2Fchubb.perkspot.com%2F&tiba=Education%20Refinance%20Loan%20from%20Citizens%20One&async=1&fmt=3&is_vtc=1&random=1799340327&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

activityi;dc_pre=CMKT4_6Z_esCFc3juwgdvo8Oig;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2...
8022851.fls.doubleclick.net/ Frame DA3D
Redirect Chain

https://8022851.fls.doubleclick.net/activityi;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr...
https://8022851.fls.doubleclick.net/activityi;dc_pre=CMKT4_6Z_esCFc3juwgdvo8Oig;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2...

0
0

42ms
42ms

Document
text/html

216.58.208.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8022851.fls.doubleclick.net/activityi;dc_pre=CMKT4_6Z_esCFc3juwgdvo8Oig;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-8022851&l=dataLayer&cx=c

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.208.38 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s12-in-f38.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8022851.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CMKT4_6Z_esCFc3juwgdvo8Oig;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl2QYbYilzVOnfpDcZf9ELwXsSkoRNLX5iI2rI94nPuE8lHA0Clh3nETdTm
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 22 Sep 2020 16:40:27 GMT
expires: Tue, 22 Sep 2020 16:40:27 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 419
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 22 Sep 2020 16:40:27 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8022851.fls.doubleclick.net/activityi;dc_pre=CMKT4_6Z_esCFc3juwgdvo8Oig;src=8022851;type=sitet0;cat=citiz0;ord=1;num=6139699872312;gtm=2od990;auiddc=740116574.1600792826;~oref=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=707569535948495&ev=PageView&dl=https%3A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%3FWT.mc_id%3DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%26b2boffer%3Damazon500&rl=https%3A%2F%2Fchubb.perkspot.com%2F&if=false&ts=1600792827634&sw=1600&sh=1200&v=2.9.24&r=stable&a=tmensighten&ec=0&o=29&fbp=fb.1.1600792827524.1576737921&it=1600792827392&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 22 Sep 2020 16:40:27 GMT

GET
H2 200 inqChatLaunch345.js Show response
citizens.inq.com/chatskins/launch/ Frame A5D1 23 KB
7 KB 168ms
168ms Script
application/javascript 74.201.20.82
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL

https://citizens.inq.com/chatskins/launch/inqChatLaunch345.js

Requested by

Host: studentloans.citizensone.com
URL: https://studentloans.citizensone.com/inqChat.html?IFRAME

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.201.20.82 , United States, ASN10912 (INTERNAP-BLK, US),

Reverse DNS

Software

TouchCommerce Server /

Resource Hash

e60734394e81954dabc01cf634b8b478ae421caea1bd20ab6f00418031ee229f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://studentloans.citizensone.com/inqChat.html?IFRAME
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 16:16:17 GMT
server: TouchCommerce Server
accept-language: bytes
etag: "8HGOptrAzDi"
content-type: application/javascript
status: 200
cache-control: no-cache
date: Tue, 22 Sep 2020 16:40:27 GMT
content-length: 6692
x-xss-protection: 1; mode=block
expires: Tue, 22 Sep 2020 17:40:27 GMT

GET
H2

200

px.png
segment.a3cloud.net/
Redirect Chain

https://ib.adnxs.com/getuid?//segment.a3cloud.net/px.png?uid=$UID&cid=AM-141554&sid=48988147&url=https%3A//chubb.perkspot.com/&vars=%257B%2522event%2522%253A%2522data%2522%252C%2522message%2522%253...
https://segment.a3cloud.net/px.png?uid=1409149246837196894&cid=AM-141554&sid=48988147&url=https://chubb.perkspot.com/&vars=%7B%22event%22%3A%22data%22%2C%22message%22%3A%7B%22MCID%22%3A%22Perkspot-...

169 B
484 B

462ms
400ms

Image
image/png

99.86.7.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segment.a3cloud.net/px.png?uid=1409149246837196894&cid=AM-141554&sid=48988147&url=https://chubb.perkspot.com/&vars=%7B%22event%22%3A%22data%22%2C%22message%22%3A%7B%22MCID%22%3A%22Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%22%2C%22mcvisid%22%3A%2249737134053424323854608100952882325239%22%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.96 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-96.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 26a19cd78ee23849a890de25aab00fcd463a35e76605cbb311e76802e3770ea0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:29 GMT
via: 1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
last-modified: Tue, 23 Sep 2014 18:35:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "6710654eca7b7742b7b9238e23caef52"
x-cache: Miss from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 169
x-amz-cf-id: PqCEEe661cSCHDU9Gv_PdqBQJhtdkiILtrwmwC69Vf0mrAXHRIL-uw==

Redirect headers

Pragma: no-cache
Date: Tue, 22 Sep 2020 16:40:27 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.48:80
AN-X-Request-Uuid: c4f78f00-2042-40b6-947a-4e7b3447a7ea
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: //segment.a3cloud.net/px.png?uid=1409149246837196894&cid=AM-141554&sid=48988147&url=https://chubb.perkspot.com/&vars=%7B%22event%22%3A%22data%22%2C%22message%22%3A%7B%22MCID%22%3A%22Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%22%2C%22mcvisid%22%3A%2249737134053424323854608100952882325239%22%7D%7D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

px.png
segment.a3cloud.net/
Redirect Chain

https://ib.adnxs.com/getuid?//segment.a3cloud.net/px.png?uid=$UID&cid=AM-141554&sid=48988147&url=https%3A//chubb.perkspot.com/&vars=
https://segment.a3cloud.net/px.png?uid=1409149246837196894&cid=AM-141554&sid=48988147&url=https://chubb.perkspot.com/&vars=

169 B
484 B

434ms
402ms

Image
image/png

99.86.7.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segment.a3cloud.net/px.png?uid=1409149246837196894&cid=AM-141554&sid=48988147&url=https://chubb.perkspot.com/&vars=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.7.96 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-7-96.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 26a19cd78ee23849a890de25aab00fcd463a35e76605cbb311e76802e3770ea0

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:29 GMT
via: 1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
last-modified: Tue, 23 Sep 2014 18:35:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
etag: "6710654eca7b7742b7b9238e23caef52"
x-cache: Miss from cloudfront
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 169
x-amz-cf-id: lEVXzt9g79njIt9tf4HXRF43uSymHGa9Ru4Emw9v1vqti4H8xEHUhA==

Redirect headers

Pragma: no-cache
Date: Tue, 22 Sep 2020 16:40:27 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 538.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.41:80
AN-X-Request-Uuid: d5667128-7608-48a4-8b7a-87db83813583
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: //segment.a3cloud.net/px.png?uid=1409149246837196894&cid=AM-141554&sid=48988147&url=https://chubb.perkspot.com/&vars=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 site_345_default.js Show response
mediav3.inq.com/media/launch/ Frame A5D1 938 KB
119 KB 185ms
137ms Script
application/javascript 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediav3.inq.com/media/launch/site_345_default.js?codeVersion=1600791370744
Requested by: Host: citizens.inq.com
URL: https://citizens.inq.com/chatskins/launch/inqChatLaunch345.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: 1640d933ab229abd44a2c1f908be6571e29e5193a87b45ccdd4ee0a0bf02a265

Request headers

Referer: https://studentloans.citizensone.com/inqChat.html?IFRAME
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:20:12 GMT
content-encoding: gzip
last-modified: Fri, 18 Sep 2020 04:53:06 GMT
server: nginx
age: 1216
etag: W/"5f643d32-ea9a7"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=3600,public
alt-svc: clear
content-length: 121359
via: 1.1 google
expires: Tue, 22 Sep 2020 17:20:12 GMT

GET
H2 200 tcFramework.min.js Show response
mediav3.inq.com/media/launch/ Frame A5D1 549 KB
156 KB 136ms
136ms Script
application/javascript 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744
Requested by: Host: citizens.inq.com
URL: https://citizens.inq.com/chatskins/launch/inqChatLaunch345.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: 4111324753464321895e41b45ec7c7abf79099ef4a1d8b2763abaf759221e3a9

Request headers

Referer: https://studentloans.citizensone.com/inqChat.html?IFRAME
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:20:12 GMT
content-encoding: gzip
last-modified: Fri, 18 Sep 2020 04:52:32 GMT
server: nginx
age: 1216
etag: W/"5f643d10-8925c"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=3600,public
alt-svc: clear
content-length: 159757
via: 1.1 google
expires: Tue, 22 Sep 2020 17:20:12 GMT

GET
H2 200 ads-blocking-detector.js Show response
citizens.inq.com/tagserver/js/ Frame A5D1 7 KB
2 KB 169ms
168ms Script
application/javascript 74.201.20.82
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL

https://citizens.inq.com/tagserver/js/ads-blocking-detector.js

Requested by

Host: mediav3.inq.com
URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.201.20.82 , United States, ASN10912 (INTERNAP-BLK, US),

Reverse DNS

Software

TouchCommerce Server /

Resource Hash

68027152150d7e8075b4b06c2ed28c42580a2be9d1bbd2106151e196e4734b84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://studentloans.citizensone.com/inqChat.html?IFRAME
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 22:16:17 GMT
server: TouchCommerce Server
accept-language: bytes
etag: "8EKEOoTxP9X"
vary: Accept-Encoding
p3p: policyref="http://citizens.inq.com/w3c/p3p.xml", CP="NON DSP LAW CUR ADMi TAIi PSAi PSD TELi OUR SAMi IND
status: 200
cache-control: max-age=3600
date: Tue, 22 Sep 2020 16:40:28 GMT
content-type: application/javascript
content-length: 2051
x-xss-protection: 1; mode=block

GET
H2 200 postToServer.min.htm
citizens.inq.com/tagserver/ Frame A80C 0
0 172ms
171ms Document
text/html 74.201.20.82
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL

https://citizens.inq.com/tagserver/postToServer.min.htm?codeVersion=1600791370744

Requested by

Host: mediav3.inq.com
URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.201.20.82 , United States, ASN10912 (INTERNAP-BLK, US),

Reverse DNS

Software

TouchCommerce Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: citizens.inq.com
:scheme: https
:path: /tagserver/postToServer.min.htm?codeVersion=1600791370744
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://studentloans.citizensone.com/inqChat.html?IFRAME
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://studentloans.citizensone.com/inqChat.html?IFRAME

Response headers

status: 200
server: TouchCommerce Server
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: max-age=3600
p3p: policyref="http://citizens.inq.com/w3c/p3p.xml", CP="NON DSP LAW CUR ADMi TAIi PSAi PSD TELi OUR SAMi IND
etag: "4iKo+IuTVXn"
last-modified: Wed, 09 Sep 2020 22:16:10 GMT
accept-language: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html; charset=utf-8
content-length: 7365
date: Tue, 22 Sep 2020 16:40:28 GMT

GET
H2 200 InqFramework.js
mediav3.inq.com/flash/ 0
284 KB 139ms
138ms Other
application/javascript 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediav3.inq.com/flash/InqFramework.js?codeVersion=1600791370744
Requested by: Host: mediav3.inq.com
URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:20:14 GMT
content-encoding: gzip
last-modified: Thu, 17 Sep 2020 05:07:41 GMT
server: nginx
age: 1215
etag: W/"5f62ef1d-15e42e"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=3600,public
alt-svc: clear
content-length: 289565
via: 1.1 google
expires: Tue, 22 Sep 2020 17:20:14 GMT

GET
H2 200 pre-acif.js
citizens.inq.com/tagserver/acif/ 0
590 B 170ms
169ms Other
application/javascript 74.201.20.82
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL

https://citizens.inq.com/tagserver/acif/pre-acif.js

Requested by

Host: mediav3.inq.com
URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.201.20.82 , United States, ASN10912 (INTERNAP-BLK, US),

Reverse DNS

Software

TouchCommerce Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 22:16:10 GMT
server: TouchCommerce Server
accept-language: bytes
etag: "CZNYrMxQHjq"
vary: Accept-Encoding
p3p: policyref="http://citizens.inq.com/w3c/p3p.xml", CP="NON DSP LAW CUR ADMi TAIi PSAi PSD TELi OUR SAMi IND
status: 200
cache-control: max-age=3600
date: Tue, 22 Sep 2020 16:40:29 GMT
content-type: application/javascript
content-length: 139
x-xss-protection: 1; mode=block

GET
H2 200 acif.js
mediav3.inq.com/media/launch/acif/ 0
132 KB 19ms
19ms Other
application/javascript 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediav3.inq.com/media/launch/acif/acif.js
Requested by: Host: mediav3.inq.com
URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 15:48:07 GMT
content-encoding: gzip
last-modified: Tue, 08 Sep 2020 16:30:28 GMT
server: nginx
age: 3142
etag: W/"5f57b1a4-5be44"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=3600,public
alt-svc: clear
content-length: 134586
via: 1.1 google
expires: Tue, 22 Sep 2020 16:48:07 GMT

GET
H2 200 acif-configs.js
mediav3.inq.com/media/sites/345/assets/automatons/ 0
12 KB 140ms
140ms Other
application/javascript 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediav3.inq.com/media/sites/345/assets/automatons/acif-configs.js
Requested by: Host: mediav3.inq.com
URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:29 GMT
content-encoding: gzip
last-modified: Wed, 02 Sep 2020 22:31:03 GMT
server: nginx
etag: W/"5f501d27-153af"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=3600, public
alt-svc: clear
via: 1.1 google
expires: Tue, 22 Sep 2020 17:40:29 GMT

GET
H2 200 jquery-3.5.0.min.js Show response
mediav3.inq.com/flash/ Frame A5D1 87 KB
35 KB 134ms
134ms Script
application/javascript 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediav3.inq.com/flash/jquery-3.5.0.min.js
Requested by: Host: mediav3.inq.com
URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

Request headers

Referer: https://studentloans.citizensone.com/inqChat.html?IFRAME
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:12:21 GMT
content-encoding: gzip
last-modified: Thu, 17 Sep 2020 05:07:41 GMT
server: nginx
age: 1688
etag: W/"5f62ef1d-15d95"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=3600,public
alt-svc: clear
content-length: 36067
via: 1.1 google
expires: Tue, 22 Sep 2020 17:12:21 GMT

GET
H2 200 safeJQuery.js Show response
mediav3.inq.com/media/sites/320/flash/SolutionsAssets/br3-addons/ 91 KB
38 KB 143ms
143ms Script
application/javascript 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediav3.inq.com/media/sites/320/flash/SolutionsAssets/br3-addons/safeJQuery.js
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: 6f52cb9dd4e8d13b9fd14b985c5c616f1e6355379e5a22aa3eec83d50803fa2e

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:33:38 GMT
content-encoding: gzip
last-modified: Tue, 14 Nov 2017 21:39:54 GMT
server: nginx
age: 411
etag: W/"5a0b62aa-16de8"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=3600,public
alt-svc: clear
content-length: 38447
via: 1.1 google
expires: Tue, 22 Sep 2020 17:33:38 GMT

GET
H2 200 createScrollEventListener.js Show response
mediav3.inq.com/media/sites/320/flash/SolutionsAssets/br3-addons/ 2 KB
808 B 143ms
143ms Script
application/javascript 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://mediav3.inq.com/media/sites/320/flash/SolutionsAssets/br3-addons/createScrollEventListener.js
Requested by: Host: chubb.perkspot.com
URL: https://chubb.perkspot.com/offer/1392471/none?utm_medium=email&utm_id=weeklyblast
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: 01a089b8d20b41f05a62e2899b2d6df44ae02cbfe8c338f2cd729e99c59e23c1

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:35:59 GMT
content-encoding: gzip
last-modified: Tue, 14 Nov 2017 21:32:10 GMT
server: nginx
age: 270
etag: W/"5a0b60da-6d2"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=3600,public
alt-svc: clear
content-length: 685
via: 1.1 google
expires: Tue, 22 Sep 2020 17:35:59 GMT

GET
H2 200 cbc-min.js Show response
citizens.inq.com/tagserver/ Frame A5D1 81 KB
23 KB 173ms
172ms Script
application/javascript 74.201.20.82
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL

https://citizens.inq.com/tagserver/cbc-min.js

Requested by

Host: mediav3.inq.com
URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

74.201.20.82 , United States, ASN10912 (INTERNAP-BLK, US),

Reverse DNS

Software

TouchCommerce Server /

Resource Hash

57ea2800fa80a8f0504b280e2315002435da653379cadeee9889914b2984bc6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://studentloans.citizensone.com/inqChat.html?IFRAME
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 22:16:10 GMT
server: TouchCommerce Server
accept-language: bytes
etag: "CdVsDBQzuRq"
vary: Accept-Encoding
p3p: policyref="http://citizens.inq.com/w3c/p3p.xml", CP="NON DSP LAW CUR ADMi TAIi PSAi PSD TELi OUR SAMi IND
status: 200
cache-control: max-age=3600
date: Tue, 22 Sep 2020 16:40:29 GMT
content-type: application/javascript
x-xss-protection: 1; mode=block

GET
H2 200 CB_Fixed-C2C_Green_V14.gif
mediav3.inq.com/media/sites/345/images/ 2 KB
2 KB 138ms
138ms Image
image/gif 130.211.25.196
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mediav3.inq.com/media/sites/345/images/CB_Fixed-C2C_Green_V14.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.25.196 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: nginx /
Resource Hash: 063bc05e26bb794fda63cebe21e56dc3c92c930ddf45500953198e2fea827a77

Request headers

Referer: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 16:40:30 GMT
via: 1.1 google
last-modified: Wed, 07 Dec 2016 18:39:12 GMT
server: nginx
etag: "58485750-905"
content-type: image/gif
status: 200
cache-control: max-age=3600, public
accept-ranges: bytes
alt-svc: clear
content-length: 2309
expires: Tue, 22 Sep 2020 17:40:30 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citizens Bank (Banking)

170 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 16:59:04	Name: DST Value:
.citizensbank.demdex.net/	1970-01-19 16:59:04	Name: citizensbank Value: 24064277428930658882826327140542896409
.demdex.net/	1970-01-19 16:59:04	Name: demdex Value: 24064277428930658882826327140542896409
.citizensone.com/	1969-12-31 23:59:59	Name: s_ppv Value: https%253A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%253FWT.mc_id%253DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%2526b2boffer%253Damazon500%2C39%2C39%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.citizensone.com/	1969-12-31 23:59:59	Name: s_ppvl Value: https%253A%2F%2Fstudentloans.citizensone.com%2Flr%2FCombo%253FWT.mc_id%253DPerkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%2526b2boffer%253Damazon500%2C40%2C40%2C1200%2C1600%2C1200%2C1600%2C1200%2C1%2CP
.citizensone.com/	1970-01-19 12:39:54	Name: mboxEdgeCluster Value: 37
.citizensone.com/	1970-01-20 06:13:57	Name: mbox Value: session#6d08a66bc51045c39ac8bf98407d53ee#1600794687\|PC#6d08a66bc51045c39ac8bf98407d53ee.37_0#1664037627
.citizensone.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.citizensone.com/	1970-01-21 08:29:19	Name: s_cpmcvp Value: %5B%5B%27Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO%27%2C%271600792826675%27%5D%5D
.citizensone.com/	1970-01-19 13:23:04	Name: s_nr Value: 1600792826674-New
.citizensone.com/	1970-01-20 06:11:04	Name: AMCV_4C3B0C3755C3822E7F000101%40AdobeOrg Value: 1585540135%7CMCIDTS%7C18528%7CMCMID%7C49737134053424323854608100952882325239%7CMCAAMLH-1601397626%7C6%7CMCAAMB-1601397626%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1600800026s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18535%7CvVersion%7C4.4.0
.studentloans.citizensone.com/	1970-01-19 21:25:28	Name: _pin_unauth Value: dWlkPVkyTmxPRGt3T0RNdE1HUXlaQzAwTUdReUxXRTNPRFF0TjJZNVpqUXpaR013Wm1NNSZycD1abUZzYzJV
.citizensone.com/	1970-01-19 21:25:28	Name: rkglsid Value: h-5b1c4df2722b6263735afa16174b6b01_t-1600792827
.citizensone.com/	1970-01-19 14:49:28	Name: _gcl_au Value: 1.1.740116574.1600792826
.studentloans.citizensone.com/	1969-12-31 23:59:59	Name: dmpsite Value: CTO
.citizensone.com/	1969-12-31 23:59:59	Name: AMCVS_4C3B0C3755C3822E7F000101%40AdobeOrg Value: 1
.studentloans.citizensone.com/	1969-12-31 23:59:59	Name: dmpprodtype Value: ERL
.studentloans.citizensone.com/	1969-12-31 23:59:59	Name: mtgdmpleadsource Value: earned
.studentloans.citizensone.com/	1969-12-31 23:59:59	Name: mtgcampdetails Value: B2B-StudentLendingCombo
.studentloans.citizensone.com/	1969-12-31 23:59:59	Name: mtgcampversion Value: pw1
.citizensone.com/	1970-01-19 12:39:52	Name: _gat Value: 1
.citizensone.com/	1970-01-20 06:11:04	Name: _ga Value: GA1.2.26847358.1600792826
.studentloans.citizensone.com/	1969-12-31 23:59:59	Name: mtgcampbrand Value: CO
.studentloans.citizensone.com/	1969-12-31 23:59:59	Name: mtgcampname Value: SID823335-StudentLending
.studentloans.citizensone.com/	1969-12-31 23:59:59	Name: mtgcampleadsource Value: Perkspot-B2B
.demdex.net/	1970-01-19 16:59:04	Name: dextp Value: 60-1-1600792826605\|843-1-1600792826717\|771-1-1600792826819\|1121-1-1600792826919\|30064-1-1600792827020\|121998-1-1600792827121\|144230-1-1600792827222\|144231-1-1600792827323
.citizensone.com/	1970-01-19 12:41:19	Name: _gid Value: GA1.2.304766932.1600792826
.citizensone.com/	1970-01-19 12:39:54	Name: gpv_v51 Value: no%20value
.citizensone.com/	1969-12-31 23:59:59	Name: check Value: true

409 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://nexus.ensighten.com/citizensbank/prod/Bootstrap.js(Line 509) Message: loading seg code now...
console-api	log	URL: https://studentloans.citizensone.com/lr/Combo?WT.mc_id=Perkspot-B2B-_-SID823335-StudentLending-_-B2B-StudentLendingCombo-_-pw1-_-CO&b2boffer=amazon500(Line 2295) Message: unsupported-browser-check=''
console-api	log	URL: https://cdn.glassboxcdn.com/citizen/com/p/detector-dom.min.js?(Line 60) Message: Cookies effective TLD determined: .citizensone.com
console-api	log	URL: https://cdn.glassboxcdn.com/citizen/com/p/detector-dom.min.js?(Line 60) Message: [object HTMLDivElement]
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: PSC initialized.
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: CM initialized.
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: GCBR3,box716469,,https://studentloans.citizensone.com/inqChat.html,no action
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Sync Sale Status: null
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: POSTBR30,r682959,,https://studentloans.citizensone.com/inqChat.html,https%3A%2F%2Fcitizens.inq.com%2Ftagserver%2Finit%2FinitFramework%3Fchecksum%3D3929120%26_rand%3Dcec1jdtw%26rid%3Dr682959%26d%3D%257BINQ%253A%257BsiteID%253A345%252CcustID%253A%2522%2522%252CscheduleTZs%253A%257B%257D%257D%257D,{}
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: SCBR3_PM,box821397,345,https://studentloans.citizensone.com/inqChat.html,inqVital,%7BINQ%3A%7BcustID%3A%22742635898324044679%22%7D%2Cv%3A3%2Cvcnt%3A0%2Cvtime%3A1600792829271%7D,,31536000000,true,/
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: LE12#agrtyer
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: PM initialized.
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: SM initialized.
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: BRM initialized.
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Ended chat was closed
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 600 "Sale Page Triggering Rule"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10 "Incrementality Attribute Setter Stub Rule - DEPRECATED"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 400 "MobileSuppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 401 "We need this rule to reserve id to use it for business rule for CEAPI-Post-Chat-Survey"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 404 "ChromeOnIphoneSuppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 405 "iOS6orLessSuppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 407 "iOS-7-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 408 "iOS-8-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 409 "iOS-9-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 410 "iOS-10-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 411 "WindowsPhone-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 412 "iOS-10-Chrome-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 420 "iOS-11-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 421 "iOS-12-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 422 "iOS-13-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 423 "iOS-14-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 500 "Session Manager- Reset Session Rule"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 555 "Referring Search Rule"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 799 "Reset incGroup"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 800 "Eligible Rule"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=800): business-unit-id=385
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: POSTBR30,vanity545982,,https://studentloans.citizensone.com/inqChat.html,https%3A%2F%2Fcitizens.inq.com%2Ftagserver%2Fincrementality%2FonEvent%3Fchecksum%3D-1689235563%26evt%3DELIGIBLE%26siteID%3D345%26pageID%3D37611464%26customerID%3D742635898324044679%26incrementalityID%3D7426358983240446791%26sessionID%3D7426358983240446791%26group%3DCHAT%26businessUnitID%3D385%26browserType%3DCHROME%26browserVersion%3D83.0.4103.61%26countryCode%3DCH%26regionCode%3DZH%26operatingSystemType%3DLinux%26codeVersion%3D1600791370744%26visitorAttributes%3D%26externalCustomerIDs%3D,{}
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 910 "Last n Session Time Rule"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 920 "Session Time Reset"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 553 "DEPRECATED Clientside listeners backward compatibility Rule"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 605 "Sale Reset Rule"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 700 "Page Landing Data Pass"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 802 "Set G3R3 Actionable Flag"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 930 "Session and Site Time Update"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 945 "resetFunnelLevel"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -351591954 "LC_Stud-LOANS"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1330315954 "LC_EDB-CC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1330315955 "LC_EDB-CD"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -132258378 "CG-PW-Reset-TLI"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -922898965 "CG-CZ-EF-ERLMicrosite"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -835569137 "CG-CZ-EF-ERLMicrosite-State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1370563552 "CG-CO-EF-ERLMicrosite"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1643076540 "CG-CO-EF-ERLMicrosite-State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule -2006662342 "CG-CZO-EF-ERLMicrosite"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule -1514264606 "CG-CZO-EF-ERLMicrosite-State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1371450495 "CG-CZ-EdFi-ERL"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1350794486 "PC_CO-HomeEquityLinesOfCredit"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -901676630 "PC_CO-HomeEquityLoans"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -876667492 "PM-CO-EdFi-TrufitLoan"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1416795025 "PM-CZ-EdFi-TrufitLoan"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1778301753 "PM-CZ-EdFi-GradSchool"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1301058373 "PM-CO-EdFi-LoanProcess"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1076802918 "PM-CZ-EdFi-LoanProcess"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1967818140 "PM-CO-EdFi-UndergradLoan"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1765718961 "PM-CZ-EdFi-UndergradLoan"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1269843339 "PM-CZ-EdFi-MBASchoolLoan"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -909029806 "PM-CZ-EdFi-LawSchoolLoans"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -208449687 "PM-CZ-EdFi-DentalMedicalLoans"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1275432308 "PM-CO-EdFi-Undergrad"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1205584712 "PM-CZ-EdFi-GradStudent"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -515160764 "PM-CO-EdFi-GradSchool"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -711521293 "PM-CO-EdFi-GradStudent"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1471942518 "PM-CO-EdFi-MBASchoolLoan"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -359300915 "PM-CO-EdFi-Borrowing"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1166016606 "PM-CO-EdFi-DentalMedicalLoans"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1061077447 "PM-CO-EdFi-LawSchoolLoans"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -961607736 "PM-CZ-EdFi-Borrowing"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1698626337 "PM-CZ-EdFi-Undergrad"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -328277798 "PM-CO-EdFi-LoanApplication"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -846195841 "PM-S-CZ-EdFi-LoanApplication"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -959566304 "CG-CO-Marketing-EF"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2069223413 "CG-CZ-Marketing-EF"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1406623462 "CG-S-CO-Marketing-EF"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -140445883 "CG-S-CZ-Marketing-EF"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1644312071 "PC_CZ-HomeEquityOverview"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1846411250 "PC_CO-HomeEquityOverview"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -65541417 "PC_CZ-Loans-HE-Resources"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -267640596 "PC_CO-Loans-HE-Resources"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1424264934 "PC_CZ-Loans-HE-FAQ"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -158087355 "PC_CO-Loans-HE-FAQ"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -18288233 "CZ-Savings-CDS-Counter"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1685961087 "CZ-Savings-MoneyMarket-Counter"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1406370450 "CO-DEP-NG-CO-Savings-CDS"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -575649660 "CO-DEP-NG-CO-Savings-MoneyMarket"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -117770887 "CO-DEP-NG-CheckingSavings-Counter"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -754076658 "CZ-DEP-NG-CheckingSavings-Counter"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -23914322 "CZ-Savings-Counter"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1749313028 "PC_CZ-BuyFlow_OLB-DEP_State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1977590457 "CO-Savings-Counter"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -867540980 "CO-Marketing-CRCBMC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -867405479 "CO-Marketing-CRGSMC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -347700525 "CO-Marketing-CRMC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1323265367 "CO-Marketing-CR"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1049565025 "CZ-Marketing-CRCBMC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1049700526 "CZ-Marketing-CRGSMC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -973208126 "CZ-Marketing-CRMC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -57087788 "CZ-Marketing-CR"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -500775648 "CGC_CZ-BuyFlow-DEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1565420388 "CGC_CZ-BuyFlow-DEP-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -500776985 "CGC_CZ-BuyFlow-EQT"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -478974604 "PC_CZ-Equity-PersonalInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1110301115 "PC_CZ-AUTH-Equity-PersonalInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -734235976 "PC_CZ-Equity-EmploymentInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -380152359 "PC_CZ-AUTH-Equity-EmploymentInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -800982147 "PC_CZ-Equity-ChooseAProduct"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1915370482 "PC_CZ-AUTH-Equity-ChooseAProduct"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -73291393 "PC_CZ-Home-Equity-Loans"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1125427616 "PC_CZ-EquityLinesOfCredit"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -566758571 "CGC_CO-BuyFlow-DEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -566757234 "CGC_CO-BuyFlow-EQT"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -797185421 "CGC_CO-Marketing2-DEP-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1687875887 "CGC_CO-Marketing2-DEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1746794521 "CGC_CO-Marketing-DEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -120286940 "CGC_CO-BuyFlowDEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2030290919 "CGC_CO-BuyFlow-DEP-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1951373490 "CGC_CZ-Marketing-DEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -366967236 "CGC_CZ-Marketing2-DEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1740968120 "CGC_CZ-Marketing2-DEP-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1951374827 "CGC_CZ-Marketing-EQT"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -770500049 "CGC_CZ-Marketing-EQT-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1457832013 "PC_CZ-Equity-Confirmation"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -566248951 "PC_CZ-Equity-Confirmation-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -826505502 "PC_CZ-AUTH-Equity-Confirmation"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1532308966 "PC_CZ-AUTH-Equity-Confirmation-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1746793184 "CGC_CO-Marketing-EQT"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1199607204 "CGC_CO-Marketing-EQT-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1777995664 "PC_CO-Equity-GetStarted-AcctInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1845885439 "PC_CO-Equity-PersonalInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -769083238 "PC_CO-AUTH-Equity-PersonalInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1112712942 "PC_CO-AUTH-Equity-EmploymentInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -491677961 "PC_CO-Checking-Main"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1635580910 "PC_CZ-BuyFlow_OLB-DEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -657881607 "PC_CO-BuyFlow_OLB-DEP"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -460099253 "PC_CO-BuyFlow_OLB-DEP-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1363057416 "PC_CZ-AUTH-GettingStarted"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -607049837 "PC_CO-AUTH-GettingStarted"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1254838905 "PC_CZ-GettingStarted"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -66069746 "PC_CO-GettingStarted"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -82248964 "PC_CZ-I-declined"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2064865664 "PC_CZ-I-declined-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1651734793 "PC_CZ-I-pending"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2120112435 "PC_CZ-I-pending-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -662183307 "PC_CZ-I-standard"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -830119473 "PC_CZ-I-standard-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -320406105 "PC_CZ-Success"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -539948061 "PC_CZ-Success-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1010835259 "PC_CZ-i-AUTH-declined"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -886591881 "PC_CZ-i-AUTH-declined-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -204145216 "PC_CZ-I-AUTH-pending"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1497705156 "PC_CZ-I-AUTH-pending-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -266402988 "PC_CZ-i-AUTH-standard"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2121338072 "PC_CZ-i-AUTH-standard-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1904191480 "PC_CZ-AUTH-Success"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -849016180 "PC_CZ-AUTH-Success-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -512275240 "PC_CO-Equity-Confirmation"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1421570644 "PC_CO-Equity-Confirmation-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1167723379 "PC_CO-AUTH-Equity-Confirmation"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2126352559 "PC_CO-AUTH-Equity-Confirmation-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -799343559 "PC_CO-i-declined"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1155771147 "PC_CO-i-declined-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -56636738 "PC_CO-I-pending"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -173350082 "PC_CO-I-pending-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -757726602 "PC_CO-I-standard"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1547741818 "PC_CO-I-standard-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1272431282 "PC_CO-Success"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1136747346 "PC_CO-Success-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1282627258 "PC_CO-i-AUTH-declined"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -79084478 "PC_CO-i-AUTH-declined-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1525053867 "PC_CO-I-AUTH-pending"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1853479441 "PC_CO-I-AUTH-pending-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2027059529 "PC_CO-i-AUTH-standard"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1313830669 "PC_CO-i-AUTH-standard-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -638013901 "PC_CO-AUTH-Success"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -646917001 "PC_CO-AUTH-Success-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1346219406 "PC_CO-Loans"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1541743379 "PC_CO-Equity-EmploymentInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -693050091 "PC_CZ-CC-ApplyNow"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -374484128 "PC_CO-CC-ApplyNow"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1252290296 "PC_CZ-Marketing-CC_Session"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -92981123 "PC_CZ-Marketing-CC_State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1911781636 "PC_CO-Marketing-CC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -295080302 "PC_CO-Marketing-CC_State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -260444179 "PC_CZ-Cards-Main"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1680354088 "PC_CO-Cards-Main"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1546842159 "PC_CZ-DEP-NG-CDs-FAQ"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1427216486 "PC_CO-DEP-NG-CDs-FAQ"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -296689565 "PC_CZ-Marketing-OLMB"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -780575399 "PC_CZ-Marketing-OLMB-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1024219086 "PC_CO-Marketing-OLMB"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1694805426 "PC_CO-Marketing-OLMB-State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -719137078 "PC_CZ-OLMB-Overview"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -980518583 "PC_CZ-OLMB-Transfers"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2104644568 "PC_CZ-OLMB-Alerts"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -176487357 "PC_CZ-OLMB-Apps"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1652703021 "PC_CZ-OLMB-Deposit"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -122337793 "PC_CO-OLMB-Overview"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1993540062 "PC_CO-OLMB-Transfers"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1122788509 "PC_CO-OLMB-Alerts"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1884858888 "PC_CO-OLMB-Apps"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1376086696 "PC_CO-OLMB-Deposit"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -933410459 "PC_CZ-InSchholApp"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2051681951 "LC_CZ-InSchholApp"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1531131481 "RE_PC_CZ-InSchholApp"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -296475509 "PC_CZ-EdfiApp"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1470087537 "LC_CZ-EdfiApp"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1319890331 "CZ-EdFi-InSchool_Graduate-Session"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -830340128 "CZ-EdFi-InSchool_Graduate-State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1384789118 "CZ-EdFi-InSchool_Undergrad-Session"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2116562823 "CZ-EdFi-InSchool_Undergrad-State"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1716853811 "PC_CZ_App_Eligibility"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -854457209 "PC_CZ_App_Disclosure"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -751208060 "PC_CZ_App_Borrower"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -311307571 "LC_CTZ-O-BRW-HE"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -520184431 "LC_CTZ-O-BRW-HE-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1737965600 "LC_CTZ-O-BRW-HE-LOC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1723629404 "LC_CTZ-O-BRW-HE-LOC-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1957641232 "LC_CTZ-O-BRW-HE-LOAN"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -429844596 "LC_CTZ-O-BRW-HE-LOAN-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -107165978 "LC_CZ-EQT-HELOC-App-GettingStarted"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1345319843 "LC_CTZ-O-SL"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -168622904 "LC_CTZ-O-SL-ISL"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -220821060 "LC_CTZ-O-SL-ISL-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -168619029 "LC_CTZ-O-SL-ERL"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -971219161 "LC_CTZ-O-SL-ERL-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -268626883 "LC_CTZ-O-SL-ISL-GRAD"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2107287047 "LC_CTZ-O-SL-ISL-GRAD-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -2068776798 "LC_CTZ-O-CHECK"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -67205191 "LC_CTZ-O-SAVE"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1244771463 "LC_CTZ-O-EDB"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1792075069 "LC_CTZ-O-EDB-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1298233528 "LC-EQT-HELOC"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -453186848 "LC_CTZ-O-BRW-HE-LEADFORM"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -1334752949 "LC-APP-ELIGIBILITY"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -3927094 "LC_CTZ-EDB-I-P-CC-BB"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -299679563 "LC_CTZ-O-EDB_CHECK-FAQ"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -707153009 "LC_CTZ-O-EDB_CHECK-FAQ-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -73564105 "LC_CTZ-O-BRW-LOC-Marketing"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule -966746739 "LC_CTZ-O-BRW-LOC-Marketing-state"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 399 "MSIE8-Suppression"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1004 "SuppressProactiveOnIE8"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1098 "Tablet-Assigner-ScriptTree-And-ChatThemes"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 10010 "set-NinaVars"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: NinaVars saved
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 101101 "CitizensBank-setPreProdVA-TestFlag"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 101111 "CitizensBank-TestFlag2"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 101011 "CitizensBank-CRCpromotesting"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1018 "AnchoredPhoneInjection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1019 "inject-inqC2CImgContainer_olbAnchored_Nuance"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10319 "setIncrementalityStringCZ"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1031901 "setIncrementalityStringCZ-BF"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10318 "setIncrementalityStringCO"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1031801 "setIncrementalityStringCO-BF"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100400 "setLastFormField-GettingStarted"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100403 "setLastFormField-AccountSelection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100410 "setLastFormField-PersonalInfoPage"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100430 "setLastFormField-FO"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100450 "setLastFormField-Agreements"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100460 "setLastFormField-OpeningDeposit"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100470 "setLastFormField-Confirmation"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1014 "CitizensBank-DIV-Injection-Right-Middle"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 101832 "CitizensBank-DIV-Injection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 101833 "CitizensBank-C2C2DIV-BuyFlow-OLB-EQT-Injection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 101834 "CitizensBank-C2C2DIV-App-InSchool-Injection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 101837 "CitizensBank-C2C2DIV-BuyFlow-EQT-Injection-Test_W_130906a_D"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 101841 "CitizensBank-C2C2DIV-BuyFlow-EQT-Positioner-Test_W_130906a_D"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1005 "CitizensBank-DIV-Injection-FixedC2C-Test_W_130827a_B"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1011 "CitizensBank-DIV-Injection-FixedC2C3"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10320 "CB-DIV1-HOR-QA2-Positioner-Left"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 103201 "TargetedOfferContainer"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1032012 "TargetedOfferContainer2"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 103202 "CB-DIV1-HOR-Checking-Positioner-Right"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 103203 "CB-DIV2-HOR-Positioner-Right"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10321 "CB-DIV1-HOR-Positioner-Left"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10322 "CB-DIV1-HOR-Positioner-Right"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10330 "CZ-DIV2-Positioner-body"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10331 "CZ-DIV3-Positioner-fixed-right"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 1000 "Execute Datapass"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 7328 "Execute Care Datapass"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 2023030 "CitizensBank-Redesign-Anchored-Bottom-DIV-Injection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 2021 "CitizensBank-Redesign-Anchored-heloc-DIV-Injection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10712 "formStallTimer-COPropertyInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 107122 "formStallTimer-CZPropertyInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 107123 "formStallTimer-AuthPropertyInfo"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9151 "formStallTimer-9151"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9159 "formStallTimer-9159"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 131588 "Contact_US_AutoOpener_Poll"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9166 "formStallTimer-9166"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1075 "Form_CZ_Equity_MortgageBalance_Idle"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1300 "MouseClick_Landing_Event"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1304 "formStallTimer-1001"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 3146 "formStallTimer-3146"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 3148 "formStallTimer-4143"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 10000 "PX-Map"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 2200 "resetMissedOpSuppress"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule 2200, checkForMissedOp set to: true
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 1006 "loadAddOns"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 3002 "formStallTimer_App-Borrower"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 590603 "CZ-inqC2CImgContainerNG1-Anchored-C2C- right middle Positioner"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 894400 "SuppressIPAddress"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 825060 "checkERLAgentAvailable"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: POSTBR30,r882494,,https://studentloans.citizensone.com/inqChat.html,https%3A%2F%2Fcitizens.inq.com%2Ftagserver%2Flaunch%2FagentAvailability%3Fchecksum%3D2603102806%26_rand%3D607pqd61%26siteID%3D345%26brID%3D825060%26buID%3D385%26agID%3D10006771%26q-thresh%3D1%26rid%3Dr882494,{}
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825061 "checkISLAgentAvailable"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825065 "checkCOV19AgentAvailable"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825071 "CitizensQA2-DIV-Inject"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 181818 "Page Load Event Action"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 513900 "AnchoredMob-Injection-Right-Anchored"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 513951 "AnchoredMob-Injection-Right-Anchored-UAO"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 513955 "AnchoredMob-Reposition"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 513960 "IE11-Bootstrap-Scrollbar-Style-Injection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 31521 "reset_nextBtnCount"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 31700 "assignRandAgentName"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 3153 "ContinueBtnCounter"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9051 "formStallTimer-9051"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9105 "formStallTimer-9105"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9115 "formStallTimer-9115"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9127 "formStallTimer-9127"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9138 "formStallTimer-9138"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1032014 "Positioner_CZ-DEP-O-R-1-Marketing_Dynamic-C2C"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 91522 "formStallTimer-9152"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 91612 "formStallTimer-9161"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9176 "formStallTimer-9176"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 9186 "formStallTimer-9186"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 40017 "CZ-DEP-O-R-G-Marketing_Anchored2.0-C2C-Positioner"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 5620 "CZ-inqC2CImgContainerNG1-C2C-Positioner"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 502850 "CZ-EF-O-ApplyNowListner"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1299999 "DIV-Injection_TopLeft_CreditCard-C2C"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 12999992 "DIV-Injection_BottomL_CreditCard-C2C"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 12999993 "DIV-Injection_BottomR_CreditCard-C2C"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 12999994 "DIV-Injection_TopR_CreditCard-C2C"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 100300 "resetPageCOAccountSelection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1003001 "PageCOAccountSelection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1003003 "PageCOAccountSelection-Reset"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 1003005 "resetPageCOAccountSelectionAuth"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 1003006 "PageCOAccountSelectionAuth"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 4002010 "resetPageCZAccountSelection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 4002011 "PageCZAccountSelection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 400201111 "PageCZAccountSelection-Reset"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 4002014 "resetPageCZAccountSelectionAuth"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 4002015 "PageCZAccountSelectionAuth"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100632 "CZ-OB-O-P-G-MarketingCallListener"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 100634 "CZ-OB-O-P-G-MarketingListener"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 13002 "tabCount-Repoller"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 111111 "CZ-CO-DIV-Injection"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 6194 "OLMB-MarketingRepoll_Landing_Event"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 6196 "OLMB-DIV-Injection-AnchoredC2C3"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 6197 "OLMB-MarketingCORepoll_Landing_Event"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 120091 "PreemptiveLeave-JS"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 6979180 "changePhysAddressPage_landing"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 6979240 "addMailingAddressPage_landing"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 746801 "CTZ-OLBHELP-O-P-PW-Reset_ExceedLoginError-T0"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 746802 "CTZ-OLBHELP-O-P-PW-Reset_ExceedLoginError_PWOnly-T0"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 7468011 "CTZ-OLBHELP-O-P-PW-Reset_Lockout-T0-worker"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 746803 "CTZ-OLBHELP-VALC-O-P-PW-Reset_Lockout-2x-T0_Helper"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825058 "CitizensUAO-DIV-Inject"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825059 "CitizensQA1-DIV-Inject"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 93231 "formStallTimer-9323"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 67701 "Citizens-CIS-Provide-Helper"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825057 "PreemptiveLeave-JS-UAO"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825043 "Execute_Datapass"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 8250431 "Execute_CIS_Datapass"
console-api	log	(Line 6) Message: CISKey not available
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: SCBR3_PM,box209772,345,https://studentloans.citizensone.com/inqChat.html,inqState,%7BVA%3A%5B%5D%2C_loy%3A1%2C_ssQ%3A%5B%222020-09-22T16%3A40%3A29.605Z%22%5D%2C_slq%3A%5B%5D%2C_cct%3A0%2C_sqc%3A0%2C_slc%3A0%2Ccfl%3A9223372036854776000%2CraI%3A%2218000834%22%2ClEn%3A%22ninaProd%22%2Coi%3A17458952%2Coii%3A17460441%2Crt%3A0%2CtFn%3A0%2ClC%3A0%2CcMC%3A0%2CaMC%3A0%2Cchtin%3A0%2Cstid%3A200091%2Cctid1%3A24000940%2Cctid2%3A220%2Cctid3%3A4000326%2Cctid4%3A15000382%2Cctid5%3A23000414%2Cctid6%3A23000413%2Cctid7%3A24000940%2Cctid8%3A24001088%2Cctid9%3A24001093%2Ccid10%3A24001094%2Ccid21%3A24001221%2C_rnA%3A1%2C_rnB%3A2%2C_rnC%3A2%2Csp%3A0%2CtbCt1%3A0%2CtbCt2%3A0%2CstLFF%3A%22Not%20Set%22%2CnLFF%3A%22nLFF%20Not%20Set%22%2CisCvt%3A0%2Cr0712%3A1%2C_rne%3A2%2CczEMs%3A0%2CcoEMs%3A0%2CczoMs%3A1%2CcoMef%3A0%2CczMEF%3A0%2CczEFG%3A0%2CczEFU%3A0%2CHE021%3A0%2CHE023%3A0%2CLM021%3A0%2CLDM%3A%7Blh%3A%5B%7Bid%3A37611464%2Ccg%3A%5B64%5D%7D%5D%7D%2CCHM%3A%7B%7D%2Cfst%3A1600792829605%2Clst%3A1600792829605%2C_ist%3A%22ELIGIBLE%22%2C_sesT%3A0%7D,,31536000000,true,/
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: SCBR3_PM,box849382,345,https://studentloans.citizensone.com/inqChat.html,inqSession,%7B_svMs%3A-1%2C_aTyp%3A3%2CCnd%3A24002530%2CCOnd%3A24003198%2CcrP%3A0%2CcUAO%3A-17433098%2CaNC%3A0%2CmcC%3A0%2CmtC%3A0%2CczCTF%3A0%2CczCGS%3A0%2CcExB%3A0%2CcExL%3A0%2CcExG%3A0%2CczEFc%3A0%2CczSLA%3A0%2ConCz%3A0%2ConCo%3A0%2CchkA%3A0%2Cc7654%3A0%2Cd4149%3A0%2Cd9175%3A0%2Cd9165%3A0%2Cpol15%3A1%2Cpol30%3A1%2Cpol45%3A1%2ChNC%3A0%2Cd9151%3A0%2Cd9126%3A0%2CdPIC%3A0%2Cd9104%3A0%2CclkCt%3A0%2CTclCt%3A0%2CtLMC%3A0%2Cb3145%3A0%2CNxCnt%3A0%2CCtCnt%3A0%2CclCnT%3A0%2CclCnF%3A0%2CrdAtZ%3A%22Michael%22%2CrdAtO%3A%22William%22%2CAgntZ%3A%22Citizens%20Bank%22%2CvisFl%3A%22visFl%20NOT%20SET%22%2CPMbc%3A%22NOT%20SET%22%2CPMac%3A%22NOT%20SET%22%2Cd4145%3A0%2Cd4118%3A0%2CczASb%3A0%2CczASa%3A0%2CczASp%3A0%2CcoASb%3A0%2CcoASa%3A0%2CcoASp%3A0%2Cd9150%3A0%2Cd9158%3A0%2CbAcL%3A0%2Cd9127%3A0%2CcoPCk%3A0%2CczPCk%3A0%2CczMDC%3A0%2CcoMDC%3A0%2CcMDCl%3A0%2CcMECl%3A0%2CenPXM%3A1%2CdOzp%3A1%2CdOop%3A1%2CttOcz%3A0%2CttOco%3A0%2CbIE8%3A0%2CcCls%3A0%2ChasPH%3A0%2C_rnaa%3A1%2C_rnab%3A2%2C_rnac%3A1%2C_rnad%3A1%2C_rnae%3A2%2C_rnaf%3A2%2CCCBtn%3A0%2CSCBtn%3A0%2CCPBtn%3A0%2CADBtn%3A0%2CRPBtn%3A0%2ClgnEr%3A0%2CLer%3A0%2ClgRe%3A0%2ClfC%3A0%2Cd9323%3A0%2ClcStd%3A0%2ClcCC%3A0%2ClcCCD%3A0%2CczRTL%3A0%2CczEFM%3A0%2CcoEFM%3A0%2CcgoMs%3A1%2CczEd%3A0%2CcoTd%3A0%2CcoTe%3A0%2CcoTf%3A0%2CczTf%3A0%2CczG%3A0%2CcoLP%3A0%2CczLP%3A0%2CcoUG%3A0%2CczUG%3A0%2CczMBA%3A0%2CczLS%3A0%2CczDM%3A0%2CcoU%3A0%2CczGS%3A0%2CcoG%3A0%2CcoGS%3A0%2CcoMBA%3A0%2CcoB%3A0%2CcoDM%3A0%2CcoL%3A0%2CczB%3A0%2CczU%3A0%2CcoEF%3A0%2CczEF%3A0%2CczHEO%3A0%2CcoHEO%3A0%2CczHER%3A0%2CcoHER%3A0%2CczHEF%3A0%2CcoHEF%3A0%2CczIn%3A1%2CczErl%3A0%2CczEr1%3A0%2CczEDG%3A0%2CczEUG%3A0%2CczAE%3A0%2CczAD%3A0%2CczAB%3A0%2CHE005%3A0%2CCHM%3A%7Bpmor%3Afalse%7D%2C_ssID%3A%227426358983240446791%22%2Crd%3A%22chubb.perkspot.com%22%2Csest%3A%22%22%2C_sT%3A0%2Cltt%3A1600792829620%7D,,31536000000,true,/
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: SCBR3_PM,box278032,345,https://studentloans.citizensone.com/inqChat.html,inqVital,%7BINQ%3A%7BcustID%3A%22742635898324044679%22%7D%2Cv%3A3%2Cvcnt%3A16%2Cvtime%3A1600792829623%2C_acid%3A%22-1%22%2C_ss%3A%22unsold%22%2CCHM%3A%7Blpt%3A0%2ClastChat%3A%7B%7D%2ClastCallId%3A0%7D%2C_is%3A1600792829622%2C_iID%3A%227426358983240446791%22%2C_ig%3A%22CHAT%22%7D,,31536000000,true,/
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: CB FI Controller: CB_ED-FI_ERL_Primary Agents Available
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: *** EVENTTYPE DOES NOT EXIST
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 805 "Targeted Rule"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=9007): business-unit-id=385
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=9007): business-unit-id=385
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: POSTBR30,vanity727069,,https://studentloans.citizensone.com/inqChat.html,https%3A%2F%2Fcitizens.inq.com%2Ftagserver%2Fincrementality%2FonEvent%3Fchecksum%3D-2082243176%26evt%3DTARGETED%26siteID%3D345%26pageID%3D37611464%26customerID%3D742635898324044679%26incrementalityID%3D7426358983240446791%26sessionID%3D7426358983240446791%26group%3DCHAT%26brID%3D9007%26businessUnitID%3D385%26targetAgentAttributes%3D%26brAttributes%3DAgentGroupID%252CCB_ED-FI_ERL-Primary%26funnelLevel%3D5%26visitorAttributes%3D%26agentGroupID%3D10006771%26queueThreshold%3D1,{}
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 2201 "checkChatLaunchAndAvail"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=9007): business-unit-id=385
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: POSTBR30,r642941,,https://studentloans.citizensone.com/inqChat.html,https%3A%2F%2Fcitizens.inq.com%2Ftagserver%2Flaunch%2FrequestC2CImage%3Fchecksum%3D-1976298123%26_rand%3D76eajlsr%26d%3D%257BsiteID%253A345%252CbrID%253A9007%252Cbrn%253A%2522CZO-EF-O-R-G-Microsite-Anchored-C2C%2522%252CpageID%253A37611464%252CchatType%253A%2522C2C%2522%252Cqt%253A1%252CbuID%253A385%252CcustID%253A%2522742635898324044679%2522%252CagID%253A10006771%252Cigaa%253Afalse%252CrAtts%253A%255B%257Bname%253A%2522AgentGroupID%2522%252Cvalue%253A%2522CB_ED-FI_ERL-Primary%2522%257D%255D%252CaAtts%253A%255B%255D%257D%26rid%3Dr642941,{}
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: X43 request: {ruleName: "CZO-EF-O-R-G-Microsite-Anchored-C2C"}
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: CBAUTH,cbcAuth257561,345,https://studentloans.citizensone.com/inqChat.html,cobrowse,0,/cobrowse,Wed, 23 Sep 2020 16:40:29 GMT,true
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: CBC: Cobrowse initialization complete
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: SCBR3_PM,box564693,345,https://studentloans.citizensone.com/inqChat.html,inqVital,%7BINQ%3A%7BcustID%3A%22742635898324044679%22%7D%2Cv%3A3%2Cvcnt%3A17%2Cvtime%3A1600792829999%2C_acid%3A%22-1%22%2C_ss%3A%22unsold%22%2CCHM%3A%7Blpt%3A0%2ClastChat%3A%7B%7D%2ClastCallId%3A0%7D%2C_is%3A1600792829622%2C_iID%3A%227426358983240446791%22%2C_ig%3A%22CHAT%22%7D,,31536000000,true,/
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=9007): business-unit-id=385
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 807 "Exposure Qualified Rule"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=9007): business-unit-id=385
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: POSTBR30,vanity24409,,https://studentloans.citizensone.com/inqChat.html,https%3A%2F%2Fcitizens.inq.com%2Ftagserver%2Fincrementality%2FonEvent%3Fchecksum%3D-792777253%26evt%3DEXPOSURE_QUALIFIED%26siteID%3D345%26pageID%3D37611464%26customerID%3D742635898324044679%26incrementalityID%3D7426358983240446791%26sessionID%3D7426358983240446791%26businessUnitID%3D385%26group%3DCHAT%26brID%3D9007%26result%3Dwill_offer%26targetAgentAttributes%3D%26brAttributes%3DAgentGroupID%252CCB_ED-FI_ERL-Primary%26funnelLevel%3D5%26visitorAttributes%3D%26agentGroupID%3D10006771%26queueThreshold%3D1,{}
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Agents available siteID=345, custID=742635898324044679, pageID=37611464, brID=9007, agID=10006771, buID=385
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=9007): business-unit-id=385
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825049 "Refresh_Nuance_JS"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825050 "Refresh_Nuance_JS_More"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825051 "Refresh_Nuance_JS_Id"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825052 "Refresh_Nuance_JS_Acct_Feat"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825053 "Refresh_Nuance_JS_Timer"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825054 "Refresh_Nuance_JS_More_Timer"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825055 "Refresh_Nuance_JS_CoOwnerInfo_Timer"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 825056 "OnPageLandYourInfo_FormFocus"
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Executing: Rule 810 "Exposed Rule"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=9007): business-unit-id=385
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Rule#getBusinessUnitId(ruleid=9007): business-unit-id=385
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: POSTBR30,vanity901485,,https://studentloans.citizensone.com/inqChat.html,https%3A%2F%2Fcitizens.inq.com%2Ftagserver%2Fincrementality%2FonEvent%3Fchecksum%3D-1214927426%26evt%3DEXPOSED%26siteID%3D345%26pageID%3D37611464%26customerID%3D742635898324044679%26incrementalityID%3D7426358983240446791%26sessionID%3D7426358983240446791%26brID%3D9007%26chatID%3D0%26businessUnitID%3D385%26agentGroupID%3D10006771%26targetAgentAttributes%3D%26brAttributes%3DAgentGroupID%252CCB_ED-FI_ERL-Primary%26visitorAttributes%3D%26queueThreshold%3D1,{}
console-api	debug	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: Not executing, does not meet conditions: Rule 855 "Clear Service Missed Rule and update lco"
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: C2C request complete for CZO-EF-O-R-G-Microsite-Anchored-C2C
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: SCBR3_PM,box50531,345,https://studentloans.citizensone.com/inqChat.html,inqState,%7BVA%3A%5B%5D%2C_loy%3A1%2C_ssQ%3A%5B%222020-09-22T16%3A40%3A29.605Z%22%5D%2C_slq%3A%5B%5D%2C_cct%3A0%2C_sqc%3A0%2C_slc%3A0%2Ccfl%3A9223372036854776000%2CraI%3A%2218000834%22%2ClEn%3A%22ninaProd%22%2Coi%3A17458952%2Coii%3A17460441%2Crt%3A0%2CtFn%3A0%2ClC%3A0%2CcMC%3A0%2CaMC%3A0%2Cchtin%3A0%2Cstid%3A200091%2Cctid1%3A24000940%2Cctid2%3A220%2Cctid3%3A4000326%2Cctid4%3A15000382%2Cctid5%3A23000414%2Cctid6%3A23000413%2Cctid7%3A24000940%2Cctid8%3A24001088%2Cctid9%3A24001093%2Ccid10%3A24001094%2Ccid21%3A24001221%2C_rnA%3A1%2C_rnB%3A2%2C_rnC%3A2%2Csp%3A0%2CtbCt1%3A0%2CtbCt2%3A0%2CstLFF%3A%22Not%20Set%22%2CnLFF%3A%22nLFF%20Not%20Set%22%2CisCvt%3A0%2Cr0712%3A1%2C_rne%3A2%2CczEMs%3A0%2CcoEMs%3A0%2CczoMs%3A1%2CcoMef%3A0%2CczMEF%3A0%2CczEFG%3A0%2CczEFU%3A0%2CHE021%3A0%2CHE023%3A0%2CLM021%3A0%2CLDM%3A%7Blh%3A%5B%7Bid%3A37611464%2Ccg%3A%5B64%5D%7D%5D%7D%2CCHM%3A%7B%7D%2Cfst%3A1600792829605%2Clst%3A1600792829605%2C_ist%3A%22ELIGIBLE%22%2C_sesT%3A0%7D,,31536000000,true,/
console-api	log	URL: https://mediav3.inq.com/media/launch/tcFramework.min.js?codeVersion=1600791370744(Line 92) Message: DEBUG: LR45#sendRequest: posted cross-window message: SCBR3_PM,box663829,345,https://studentloans.citizensone.com/inqChat.html,inqSession,%7B_svMs%3A-1%2C_aTyp%3A3%2CCnd%3A24002530%2CCOnd%3A24003198%2CcrP%3A0%2CcUAO%3A-17433098%2CaNC%3A0%2CmcC%3A0%2CmtC%3A0%2CczCTF%3A0%2CczCGS%3A0%2CcExB%3A0%2CcExL%3A0%2CcExG%3A0%2CczEFc%3A0%2CczSLA%3A0%2ConCz%3A0%2ConCo%3A0%2CchkA%3A0%2Cc7654%3A0%2Cd4149%3A0%2Cd9175%3A0%2Cd9165%3A0%2Cpol15%3A1%2Cpol30%3A1%2Cpol45%3A1%2ChNC%3A0%2Cd9151%3A0%2Cd9126%3A0%2CdPIC%3A0%2Cd9104%3A0%2CclkCt%3A0%2CTclCt%3A0%2CtLMC%3A0%2Cb3145%3A0%2CNxCnt%3A0%2CCtCnt%3A0%2CclCnT%3A0%2CclCnF%3A0%2CrdAtZ%3A%22Michael%22%2CrdAtO%3A%22William%22%2CAgntZ%3A%22Citizens%20Bank%22%2CvisFl%3A%22visFl%20NOT%20SET%22%2CPMbc%3A%22NOT%20SET%22%2CPMac%3A%22NOT%20SET%22%2Cd4145%3A0%2Cd4118%3A0%2CczASb%3A0%2CczASa%3A0%2CczASp%3A0%2CcoASb%3A0%2CcoASa%3A0%2CcoASp%3A0%2Cd9150%3A0%2Cd9158%3A0%2CbAcL%3A0%2Cd9127%3A0%2CcoPCk%3A0%2CczPCk%3A0%2CczMDC%3A0%2CcoMDC%3A0%2CcMDCl%3A0%2CcMECl%3A0%2CenPXM%3A1%2CdOzp%3A1%2CdOop%3A1%2CttOcz%3A0%2CttOco%3A0%2CbIE8%3A0%2CcCls%3A0%2ChasPH%3A0%2C_rnaa%3A1%2C_rnab%3A2%2C_rnac%3A1%2C_rnad%3A1%2C_rnae%3A2%2C_rnaf%3A2%2CCCBtn%3A0%2CSCBtn%3A0%2CCPBtn%3A0%2CADBtn%3A0%2CRPBtn%3A0%2ClgnEr%3A0%2CLer%3A0%2ClgRe%3A0%2ClfC%3A0%2Cd9323%3A0%2ClcStd%3A0%2ClcCC%3A0%2ClcCCD%3A0%2CczRTL%3A0%2CczEFM%3A0%2CcoEFM%3A0%2CcgoMs%3A1%2CczEd%3A0%2CcoTd%3A0%2CcoTe%3A0%2CcoTf%3A0%2CczTf%3A0%2CczG%3A0%2CcoLP%3A0%2CczLP%3A0%2CcoUG%3A0%2CczUG%3A0%2CczMBA%3A0%2CczLS%3A0%2CczDM%3A0%2CcoU%3A0%2CczGS%3A0%2CcoG%3A0%2CcoGS%3A0%2CcoMBA%3A0%2CcoB%3A0%2CcoDM%3A0%2CcoL%3A0%2CczB%3A0%2CczU%3A0%2CcoEF%3A0%2CczEF%3A0%2CczHEO%3A0%2CcoHEO%3A0%2CczHER%3A0%2CcoHER%3A0%2CczHEF%3A0%2CcoHEF%3A0%2CczIn%3A1%2CczErl%3A0%2CczEr1%3A0%2CczEDG%3A0%2CczEUG%3A0%2CczAE%3A0%2CczAD%3A0%2CczAB%3A0%2CHE005%3A0%2CCHM%3A%7Bpmor%3Afalse%2Ccb%3A1%7D%2C_ssID%3A%227426358983240446791%22%2Crd%3A%22chubb.perkspot.com%22%2Csest%3A%22%22%2C_sT%3A0%2Cltt%3A1600792829620%7D,,31536000000,true,/

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors *.perkspot.com
X-Content-Security-Policy	frame-ancestors *.perkspot.com
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8022851.fls.doubleclick.net
8253365.fls.doubleclick.net
ak.sail-horizon.com
amplify.outbrain.com
analytics.twitter.com
api.sail-personalize.com
assets.zendesk.com
az416426.vo.msecnd.net
bid.g.doubleclick.net
cdn.glassboxcdn.com
cdn.heapanalytics.com
cdn.merklesearch.com
cdn.rollbar.com
chubb.perkspot.com
citizens.inq.com
citizensbank.demdex.net
citizensbank.tt.omtrdc.net
cm.everesttech.net
connect.facebook.net
ct.pinterest.com
dc.services.visualstudio.com
dpm.demdex.net
ekr.zdassets.com
email.perkspot.com
googleads.g.doubleclick.net
heapanalytics.com
hello.myfonts.net
ib.adnxs.com
mediav3.inq.com
nexus.ensighten.com
partner.citizensone.com
perkspot.zendesk.com
platform.twitter.com
psprods3ep.azureedge.net
px.ads.linkedin.com
report.citizen.glassboxdigital.io
s.pinimg.com
sailthru.perkspot.com
secure.adnxs.com
segment.a3cloud.net
smetrics.citizensbank.com
snap.licdn.com
static.ads-twitter.com
static.zdassets.com
stats.g.doubleclick.net
studentloans.citizensone.com
t.a3cloud.net
t.co
tr.outbrain.com
www.citizensbank.com
www.facebook.com
www.google-analytics.com
www.google.ch
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
104.16.53.111
104.18.70.113
104.18.71.113
104.244.42.131
104.244.42.197
130.211.25.196
143.204.94.58
15.188.154.177
151.101.112.157
152.199.21.2
162.208.117.53
172.217.16.130
173.209.247.165
18.197.253.20
216.58.208.38
23.210.248.189
23.210.250.44
23.77.209.175
23.96.203.178
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:2800:234:59:254c:406:2366:268c
2606:4700:10::6816:653
2620:1ec:21::14
2620:1ec:29::10
2a00:1450:4001:801::2003
2a00:1450:4001:802::2003
2a00:1450:4001:808::2003
2a00:1450:4001:809::2008
2a00:1450:4001:814::2002
2a00:1450:4001:819::2004
2a00:1450:4001:81a::2008
2a00:1450:4001:81c::2002
2a00:1450:4001:820::200e
2a00:1450:400c:c07::9d
2a02:26f0:10c:58e::25ea
2a02:26f0:6c00:2bf::1931
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
34.247.153.209
37.252.172.250
38.133.127.127
52.209.239.68
52.236.186.210
52.73.94.193
54.76.90.77
66.117.28.86
74.125.133.157
74.201.20.82
75.101.164.61
99.83.154.140
99.84.144.19
99.84.144.40
99.84.158.177
99.86.7.124
99.86.7.96
0061053848f04ed531336574ed591c136cf8f424b5d68914b2a407a289412eea
01a089b8d20b41f05a62e2899b2d6df44ae02cbfe8c338f2cd729e99c59e23c1
060ff62fdf98b3e94636ad44eb0733d06b4a2d91e361a73a9a4d75ddc36ffba4
063bc05e26bb794fda63cebe21e56dc3c92c930ddf45500953198e2fea827a77
097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b
0c9856f4e5c68a7fb4a68848604d86b1d0b77118288641d79f0b96c518eb485a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1190ab672ec78b119d380372cbe97514161ec40a3f58cb6837a8f5e015ddafba
11c0d4fa1a258fc738c72fee74284797b97fc23db50ac9ab7c97a02aca71a721
11fccee55be781038c0c85c5c87e03c507c10551029800fc2c67d0507aa6aae4
12a021f311131c5278f1fbccb842500f0ed261c6c40ae45f748ca91271e49855
12cf6018c3fd78630030aa3215319873fb6adc906d49191563b6bc184e3cdf70
15c0d41e38829cb86de92c1d6f98b7a93679efb6cd16ff149e14181c6dd8ce92
1640d933ab229abd44a2c1f908be6571e29e5193a87b45ccdd4ee0a0bf02a265
1a94fbba728c9d38d6cb4f171ca6ba6ef70f155353484322421d3b4116f46701
20a29036fe4a46137c8df7bd672f8bd5673a657e338a709a9ccc629ad886d7fb
20ef197859e006fc1ab760c273d2e83ced00ca2427a5591428c5a44e0e1f6eaf
255733aa26ecbe1a2608fc086d6b510fafce3647ad1ddf22392c390a1306e640
26a19cd78ee23849a890de25aab00fcd463a35e76605cbb311e76802e3770ea0
28f23136a892031c55898fb4679f2dfeab7d98c71f372068e77b34b20964d736
291a25a78d13a5b4e18b315061832e79238e0a8afd945790120b9167b9f80f4e
2a4b9c1397b0b1d2130e6ba57c51cef39d54db2f5ada6248be8271b6e7cfca8a
2c05cd198351936a3e998107c919bc7d73b18aa6b082994090d3b57d1b72f4f9
2d25f06ba5a1e228262948c457155e24a1d91bfb5dad460bd1dcfe2106011f20
316d0c396a7613cb29eb2f97b51c7da9435a1dcbd92a719655286532c19c2e7f
327e44e8cdd93f33b8908aef8c8fe05624c168a5daba94d7831cbade665326e0
32ce0c0948956a02883836ff2e03fa108bd54fffc9c1aff61aa1f2ec0d03a7f6
3327c49ffc4fc9b396bbda25c6c47d423cc533d77a7498f53cb39b5f04727cb4
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
356ee74a7fdcfbdc24c2c13fdfbd48d7b1b5da0ec0dc76ed84bb5d637965c631
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
3942d95c2daec33e89a5761fef33a208f0f125db2d8a3758a90ae52f65bfbb87
39e728574e3c99e4633a84fff1ca0df9d61021667f0627a3522f849c3eb468a9
3bbfc59a5fd2f6c12a3fa4ed85847409301afd5a1e0d5a657544939fbdce4432
3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019
3c9341a2a75c9949a441e6be45f38f24761f4b6af7fb6ea277e4e4b2f4ee8cc5
3dbe82bc7b6967990c2ac5fc49ccce4f5cda3177a5f1cb9f5ac15810610f4fed
3fea9f6b900b039ac52678172775b58426aa7b1fa4efe24e9ac7eeb99d5d2aba
40f2d552c0db3ead874ec52bf624d9ec88007d8b659cd7189fecc3ff19d3d248
4111324753464321895e41b45ec7c7abf79099ef4a1d8b2763abaf759221e3a9
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
42ae1eb8cc55b4e2382e02323c96a40e80432d3e810bce85f10c75ddacbd2e2b
455d2d4e80da24d0a86989925cea3c3be7be3578748ebb73026240d0f6a3a13d
46ed1fd8925fb4fc35e5fefb2ce99b1e3b47fc9333adc4cdc4d4b3f785b8fbc0
4b3953dedfbdbed644b9cac32a0891c1d7d186f61c6c66fc6a4403802213b863
4ed84c70f5fbe99d8ce35e1530b55d4ad6684a0fa58e09f407e9ab8fe02ef803
55f321e4a81f17977a71b1dd2f848c0b10639c8a0ebf64452ccc658fe80e9f7a
56c43c6f5c8209acd47f355810bca2f9b0fc86c4bbdf1361d60fb2d2e2e66f8c
57ba758dcb1e78e69507b65039f8bbdaaa9d94b5f8c85e6624acca110a269d75
57ea2800fa80a8f0504b280e2315002435da653379cadeee9889914b2984bc6c
581fea0dca42905acf390bbe5720f9cc5ee1a890a621f1a9518a13680cf967c3
586664d0cb59cecbc04103f037ad655beaaec5d937c697e293d984e4257f6c86
5a0a5baf907052310243f080c49d8f5c0fc6a9d03b0dbffcbdba4f05c3eea33f
5c1595100523675d7b4537114fb96259403d9f74e18fdea7d06a473d7fef869e
5e2bd5a90ecf122c4426fc1585c6a0d239e6abf4d7f95baebf203307d3ae882d
5e8ba39a1fbac87207c44e0a7406a1c1118c15daf1ac72d91667d4e13fffd7ab
5efd1cdc9fe57d8ee4c5ee8839c2deb5a4c0a6f0eae362825bf0c94785c01632
60035f8d3292fc0b3155089baabc76fce2178f8d104ef606e4e31cbe0a2803b2
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
64be26da0b22259ffa20b0b16f5b592a26ecf15068762119b4e219968e9ced1c
65e4d18477e0e194ae2b3848fe053621a40508eeb817ab8c832b8005edd2c6af
68027152150d7e8075b4b06c2ed28c42580a2be9d1bbd2106151e196e4734b84
6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b
6db12ddad6255141f8b6d45154e6afacc7cbfd412b9254dca5d711291eecad2d
6f52cb9dd4e8d13b9fd14b985c5c616f1e6355379e5a22aa3eec83d50803fa2e
6f82273f9bf1362eaff869332ec45e6a2bc3fae0d903dd00223f963845d4aa00
70a32e8f8b0ba1e572c021d68ebe12140da45ae22d1a662c36b661821586ed8d
74ce78acff32e8f0e85d4e48df11d3878fa7bef270fa5a8ab2acd0f2f8ed96f3
75f56cdec68dece7c9a997f0c2e8d67230d2137f3ab0a0573f07a65ddcdde812
76d3c41efd88a87996eef063ae44c241e9db0bcef82ab95413e375c7b1d5718e
7e05da544a93b639782cb0974f5dacbfc36b60d40622f680e3383ec581243ca4
80f6aa2a8d7db2336749ee6bd68c034aee3fbdd9475ea7475bd1fd90e27efe6c
8231103d519b2db6114b40807697ff8a7443f6ec6e939c8cb9cb4f5dee7348b2
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
82f0a6a6f8c5503d204a6f6439918e47d27d21c35f189e6e004ac682e8d85d0d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8381e08ba1da3e3d56d9a3f23eb1f87934cda97a394b260b4ba87f537381fe7f
83af74f9ae1d1e4be00a7e271ab233c20ecc5769bdbd1c72e0524dc86bdf12e4
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87ba34a2dac0d833ec28f5da1f52fa5a2b8279152500e1b825e241e4a64ea488
89c69b70386c8e4a1be1f0dfe4b485807c2ac88bfe195de3a254a855f36d8c0c
8b7732da9e72e8a70304acd47504acb22e415bb8ee165acf6fa54dd37aa91742
8bc6ca4b67c7d69332d254cec745f729ecfd2b46a2fd2c106fb75d3efcf0e9eb
911245e9a32d617b8b908d8e742522fa9ed193aae41570cdb80b263517e453cb
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef
92eeb9dfd2c7117fcde85274ba851a80c8ea41b874cbaee50b7a79b77c245f64
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
94c6483dadce933e499cc7f0a7cbd22d2565bbaf160f19086d55bd2e2df69f7b
97b60abddca66cb67594c3d71d5f36dee04189ad9fa1561c0c1da7b7ee20d7be
97e5b0b6cfc2ba9815028429c069631ba12b294aa7419d1ea130accd0adc2d46
9ba920baf500f0d4574f6160f04f16a81736b451a373a4cae91454f795575369
9dc5c4df962e82aeb99b6afd7448ecb2926f6494c79264d9862634b59b0ca4a3
9e83216908224ffbc39992a5e60f93ca21b8e2240ba28025ba679c4b70f7112d
9f0fab72c8a1fea1df1d6c5d128115031a8c44ccbc7f37e314acee6acb98779b
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0774f290781320b1ee451e53e384381cfa827d5c94526856eb4f5f80b3e50e7
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a7557597d9c89e686bff153b4c9541be53c272930d3886e1f3cbfe51605d8ce4
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad5da3bebca23142495bbd71b45711cfbe4d3857a57d49960a401a28185c4fdc
b1bdb3e02bdbf5388bda50315993c9adb9697e4a0bafaeff5afb7b23b02d00bd
b4edef7690e0cf61248b8fe38db8404effd811c26fd900558acd533b64485fd0
b63ccfdff1f14a79e21509d78979afd48a4594260db072582e9ca6d5f4729c35
b83acffb85a0798d99bc88bad326110b6c60712303ee135bf8c5acda868adaec
b8882e31b1407e6da2e2dda44ffa9f1c1a9298059f7203c5fa7d50bee4899783
b8ead69897dda3de26fe6e7cd76eee9351c5cb9a8c3001fd8acd07eab6abeace
b9fcf937a1c0af0d25d572419610edded8a8ad4ca18250c697d81356f4e4666a
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bfdeb8d9fbfe529ff5525562348109ad07bd73d9a4fc6890382e122ba46bca82
c0800f4dd1574e62881571e3339bc02988cb02bf5e35b1d85a9099ab939ef467
c48cff5fc47baa351f5ad84e6f0b45c7bdd9fb3d9923a69a141eb4ca3a0a7ca0
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
c52ecdf3468821a31aebcdb3d0e11da26dc6caab8e981823c95e4648e265b3e4
ca6e05d1144f9600151db30ae796f344eaa7b682a66aa19d829eebdbd3b05392
cabf84461a8d377748f59dd9291707f47814e4906eae1d7fa07690ae2f8d064d
cecd63a54fbb0c3ee2fd20c3b217c0ec4b0e9e5d03de4394d4180daee2ccea4b
d086a3ad64a17f3a77fd54dbf319f7b86107415a5b70ac5120abcc9325455aba
d20fd746ede98700775310f11e4b16f48bb9727e6d3188604edda293174abaf6
d2837f61d9667f39af6b7cf98314af572e068d8d1ccef8bfc4aadf7428126515
d31c7a1b9047c89d89e1e479ee248957e02241f1630553d542d37e1296ef1f9e
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
d5392818f8fd88f711a3e836546a0d5e7841613f1ce120bea95e52937c3d57cf
d57cebe84975b165e77ef4d98619fd1e0d1e0f909aadaa3d188feda5e18451f9
d79a41844504ccb8bd40dcc91e68cd0467e012021852e634567cf0e7b9afba79
d7f4cfa38acd5b443b4b6f910f9f991b864b4e848305a4c7f4d19b9478fcc9a5
d923e22c85da30b99cc1519fd9abdac4fa896ddd9f04bf586c7d6cbfb52cee05
d933a98657089095397ca6126d62e3a07c39e70f82b36f8cea002c0ba5bf1e2c
da920f3ab34be6657328f6fd9a049786a33cc8be516e929b47c1042410f8b5e8
dddb031e5144ce20d909dbf4829d637738efa477bf5ab4eab67b1990ef0efb2d
de4e3880a30945353b7a90cb7c830adc06aa81167839157558972f7af9837094
decbd25e011cb146c2d7eb16c3f9e0b76a6ffb637d10d92a27b7348d6ba69501
ded201920f34d77d2f9906dbdc23cac305814c8e04c980e58767a81c5b8042e5
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e18cb654469bf08f25a764fb23172db59a42aa355dc80f14ffc4dd4723419a0d
e35f30a29d1359038a5b8e999a714cda8270aa4140a9c75510e840e68629881d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e44ede153cad0294665eb6c13f0ac99a140880484b5dc01f7d18bbcc9ae160a5
e4ad38d69381a4568f8bd3b11b3f97b4df3dd13ef99bda66e10c6a90f8827693
e5ae0fe96873aea82e0ebfd0cdd03e1f5b33bd66e72ddc3f97a366d7e07d58e9
e60734394e81954dabc01cf634b8b478ae421caea1bd20ab6f00418031ee229f
e6ed90bdc57a62f527655d1c1c133fe843d8bce04d4069b3912dfaee6506e1c5
eb4b7a1be5f80c37ac74daa6f20b193b24414f23da856ad2560a0053e65a2cb7
ec14da626f007013d8b63d18e2ad7334503e2fa8d4f848d538d23a19ec34e546
edb66434567b603679a9fd45786ff3b3b2bf3903d0da2e1c5af626688540bcc4
ee0af9cb821e3b90c73da380ca1ea46a9568f50635facf5e263d0044c9124c9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fa21f3e1e9b08a2081408c92e668f630dc3c5795a0a84e7759fd05f12c94578a
fbe286776db04ab76a923866bf736c50a1f2d2ed92e71e5f31f46964d791adbf
fd1c8608317876eb077dbe46d443d20ac8db70fff364d4128c5824f852aadf02
fd63d6a5ec44215e50612d8bea8eff0a12f5d4981ab6745db8d8479f7c102845
fe09b22dbe5969d85a73c65f9cf13e28bdd6ed1b1dba22010899563d6bd4f40c
fe9a1ae0d717a13393617cd6a257fa933cb637c0a5515511ff7015081c6c4ed3
fea5907b6d4d94746b87daa3c6309433c554f4d2f677f073baa22950d7143985
ffcb5cb34cc80f1368764a7ae025499377ecf638cdf12c7294017f8e45adb9ab

studentloans.citizensone.com Open in urlscan Pro 173.209.247.165 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

234 Requests

100 %HTTPS

36 %IPv6

41 Domains

59 Subdomains

52 IPs

7 Countries

4264 kBTransfer

10464 kBSize

29 Cookies

23 Outgoing links

Page URL History

Redirected requests

234 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

studentloans.citizensone.com Open in urlscan Pro
173.209.247.165 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

234
Requests

100 %
HTTPS

36 %
IPv6

41
Domains

59
Subdomains

52
IPs

7
Countries

4264 kB
Transfer

10464 kB
Size

29
Cookies

234 HTTP transactions
0 data transactions