auth.savings.workingadvantage.com Open in urlscan Pro
104.18.16.216 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://e.email.workingadvantage.com/click?EZWxtZXJkb21pbmljLnRhbmdvYW5AbGV4bWFyay5jb20/CeyJtaWQiOiIxNzIxOTk5MTg3NzcxNjM0ZDkxMDQzYjAx...
Effective URL:
https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=...
Submission: On August 17 via manual (August 17th 2024, 4:56:57 pm UTC) from PH — Scanned from DE

Summary HTTP 102 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 21 IPs in 3 countries across 13 domains to perform 102 HTTP transactions. The main IP is 104.18.16.216, located in and belongs to CLOUDFLARENET, US. The main domain is auth.savings.workingadvantage.com. The Cisco Umbrella rank of the primary domain is 348872.
TLS certificate: Issued by WE1 on August 1st 2024. Valid for: 3 months.

This is the only time auth.savings.workingadvantage.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	96.47.20.26 96.47.20.26	46263 (EDIALOG) (EDIALOG)
3 33	104.18.16.216 104.18.16.216	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a02:26f0:480... 2a02:26f0:480:f9d::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2606:4700::68... 2606:4700::6812:ba1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
2	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
2	172.217.16.202 172.217.16.202	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2602:816:5001... 2602:816:5001::39	54113 (FASTLY) (FASTLY)
2	172.217.18.104 172.217.18.104	15169 (GOOGLE) (GOOGLE)
4	162.247.243.29 162.247.243.29	54113 (FASTLY) (FASTLY)
3	142.250.184.238 142.250.184.238	15169 (GOOGLE) (GOOGLE)
12	104.18.6.126 104.18.6.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	216.239.34.36 216.239.34.36	15169 (GOOGLE) (GOOGLE)
8	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1c7f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.95.41 104.18.95.41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.94.41 104.18.94.41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
102	21

1 96.47.20.26 (United States) 1 redirects

ASN46263 (EDIALOG, US)
PTR: t.ralphlauren.pt.mx2.bm16.maas.zetaglobal.net

e.email.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 104.18.16.216 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

lexmark.savings.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
auth.savings.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:480:f9d::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:ba1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.202 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f10.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2602:816:5001::39 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.104 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f104.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 162.247.243.29 (United States)

ASN54113 (FASTLY, US)

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.184.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 104.18.6.126 (None, )

ASN13335 (CLOUDFLARENET, US)

controlpanel.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lexmark.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.34.36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1c7f (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.95.41 (None, )

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.94.41 (None, )

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	workingadvantage.com 4 redirects e.email.workingadvantage.com — Cisco Umbrella Rank: 373136 lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com — Cisco Umbrella Rank: 348872	2 MB
12	beneplace.com controlpanel.savings.beneplace.com — Cisco Umbrella Rank: 505921 lexmark.savings.beneplace.com	21 KB
9	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 104 region1.google-analytics.com — Cisco Umbrella Rank: 3123	21 KB
8	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 554	157 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	288 KB
6	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 521	173 KB
4	nr-data.net bam.nr-data.net — Cisco Umbrella Rank: 441	2 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 challenges.cloudflare.com — Cisco Umbrella Rank: 3877	29 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 567	160 KB
3	gstatic.com fonts.gstatic.com	28 KB
2	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 1453	26 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 410	28 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 1019	315 B
102	13

	Domain	Requested by
17	lexmark.savings.workingadvantage.com	1 redirects lexmark.savings.workingadvantage.com
16	auth.savings.workingadvantage.com	2 redirects lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
8	cdn.cookielaw.org	auth.savings.workingadvantage.com
8	lexmark.savings.beneplace.com	auth.savings.workingadvantage.com
6	www.google-analytics.com	lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
6	www.googletagmanager.com	lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
6	assets.adobedtm.com	lexmark.savings.workingadvantage.com assets.adobedtm.com auth.savings.workingadvantage.com
4	controlpanel.savings.beneplace.com
4	bam.nr-data.net	lexmark.savings.workingadvantage.com js-agent.newrelic.com auth.savings.workingadvantage.com
4	maps.googleapis.com	lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
3	region1.google-analytics.com	lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
3	fonts.gstatic.com	lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
2	challenges.cloudflare.com	auth.savings.workingadvantage.com challenges.cloudflare.com
2	js-agent.newrelic.com	lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
2	cdnjs.cloudflare.com	lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
2	cdn.jsdelivr.net	lexmark.savings.workingadvantage.com auth.savings.workingadvantage.com
1	geolocation.onetrust.com	auth.savings.workingadvantage.com
1	e.email.workingadvantage.com	1 redirects
102	18

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com

Subject Issuer	Validity	Valid
workingadvantage.com WE1	`2024-08-01` - `2024-10-31`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh
upload.video.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-03-21` - `2025-04-22`	a year	crt.sh
*.nr-data.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2024-10-01`	a year	crt.sh
beneplace.com Cloudflare Inc ECC CA-3	`2023-12-01` - `2024-11-30`	a year	crt.sh
cookielaw.org WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
geolocation.onetrust.com WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
challenges.cloudflare.com E5	`2024-07-17` - `2024-10-15`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true
Frame ID: 8D5E38E073C11D62CDA8800DC013CA41
Requests: 100 HTTP requests in this frame

Frame: https://lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js
Frame ID: 71533C38AE6B8911CB628F44435EAFF2
Requests: 2 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/n64ay/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/
Frame ID: DA3919A1ED6E84EFA8E12D44C45F61EC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nur einen Moment…

Page URL History Show full URLs

https://e.email.workingadvantage.com/click?EZWxtZXJkb21pbmljLnRhbmdvYW5AbGV4bWFyay5jb20/CeyJtaWQiOiIxNzIxOTk5MTg3... HTTP 302
https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder... Page URL
https://auth.savings.workingadvantage.com/auth/authorize?subdomain=lexmark&response_type=code&client_id=9ezalirn45mF43... HTTP 302
https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_sour... Page URL
https://auth.savings.workingadvantage.com/auth/authorize?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_sourc... HTTP 302
https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_sour... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

102
Requests

88 %
HTTPS

48 %
IPv6

13
Domains

18
Subdomains

21
IPs

3
Countries

2794 kB
Transfer

13065 kB
Size

12
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m
Title: Cloudflare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://e.email.workingadvantage.com/click?EZWxtZXJkb21pbmljLnRhbmdvYW5AbGV4bWFyay5jb20/CeyJtaWQiOiIxNzIxOTk5MTg3NzcxNjM0ZDkxMDQzYjAxIiwiY3QiOiJlYmctd2FnMy1hNmViYTlkN2E2MGQ0NGJiNDMzNWE0OWM3ODVkYjcyOS0xIiwicmQiOiJsZXhtYXJrLmNvbSJ9/VaHR0cHM6Ly9sZXhtYXJrLnNhdmluZ3Mud29ya2luZ2FkdmFudGFnZS5jb20vaG9tZQ/SWkhfZWJnd2FfTkRCQU0wNzI2MjAyNGMxMzQzMDA2YjE/LZWIy/qP0RMSz1jMjZhcHdmZDZia2J5OXF1eW8xODZsbmw5JnV0bV9tZWRpdW09SnVseS0yMi0yMDI0LVRydWVDYXItUmVtYWluZGVyJnV0bV9zb3VyY2U9ZW1haWwmY29udl9zb3VyY2U9emV0YSZ1dG1fY2FtcGFpZ249aG9tZS1saW5rLW1hcmtldHBsYWNlJnV0bV9jb250ZW50PWhvbWUtbGluay1tYXJrZXRwbGFjZQ/gZqOjSA/sdg5705ae98 HTTP 302
https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace Page URL
https://auth.savings.workingadvantage.com/auth/authorize?subdomain=lexmark&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace HTTP 302
https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace Page URL
https://auth.savings.workingadvantage.com/auth/authorize?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&subdomain=lexmark&auth_login=true HTTP 302
https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://e.email.workingadvantage.com/click?EZWxtZXJkb21pbmljLnRhbmdvYW5AbGV4bWFyay5jb20/CeyJtaWQiOiIxNzIxOTk5MTg3NzcxNjM0ZDkxMDQzYjAxIiwiY3QiOiJlYmctd2FnMy1hNmViYTlkN2E2MGQ0NGJiNDMzNWE0OWM3ODVkYjcyOS0xIiwicmQiOiJsZXhtYXJrLmNvbSJ9/VaHR0cHM6Ly9sZXhtYXJrLnNhdmluZ3Mud29ya2luZ2FkdmFudGFnZS5jb20vaG9tZQ/SWkhfZWJnd2FfTkRCQU0wNzI2MjAyNGMxMzQzMDA2YjE/LZWIy/qP0RMSz1jMjZhcHdmZDZia2J5OXF1eW8xODZsbmw5JnV0bV9tZWRpdW09SnVseS0yMi0yMDI0LVRydWVDYXItUmVtYWluZGVyJnV0bV9zb3VyY2U9ZW1haWwmY29udl9zb3VyY2U9emV0YSZ1dG1fY2FtcGFpZ249aG9tZS1saW5rLW1hcmtldHBsYWNlJnV0bV9jb250ZW50PWhvbWUtbGluay1tYXJrZXRwbGFjZQ/gZqOjSA/sdg5705ae98 HTTP 302
https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace

Request Chain 22

https://lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js

Request Chain 38

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=lexmark&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace HTTP 302
https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace

102 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

home Show response
lexmark.savings.workingadvantage.com/
Redirect Chain

https://e.email.workingadvantage.com/click?EZWxtZXJkb21pbmljLnRhbmdvYW5AbGV4bWFyay5jb20/CeyJtaWQiOiIxNzIxOTk5MTg3NzcxNjM0ZDkxMDQzYjAxIiwiY3QiOiJlYmctd2FnMy1hNmViYTlkN2E2MGQ0NGJiNDMzNWE0OWM3ODVkYjcy...
https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_co...

10 KB
4 KB

224ms
189ms

Document
text/html

104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

119b3e07743b35015d62b6eedf3e9c6b625587c7c40587541e4653bc29fed6bc

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8b4b331a495b1e18-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Sat, 17 Aug 2024 16:56:49 GMT
last-modified: Thu, 15 Aug 2024 10:50:39 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Sat, 17 Aug 2024 16:56:48 GMT
Keep-Alive: timeout=1, max=100
Location: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
Server: Apache
Strict-Transport-Security: max-age=60
X-Powered-By: PHP/8.2.8

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 678 KB
158 KB 49ms
7ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 003cb3efad9c745c2a6b2771e6c4543c54063a0fead3e7f83cd9d4eb08cd0ebb

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
last-modified: Mon, 12 Aug 2024 13:12:57 GMT
server: AkamaiNetStorage
etag: "741b207f5b1f9b8b9d6ccca0207861a1:1723468377.545799"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 161814
expires: Sat, 17 Aug 2024 17:56:49 GMT

GET
H3 200 new-relic-integration.js Show response
lexmark.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 128ms
126ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=5184000; includeSubDomains
last-modified: Thu, 15 Aug 2024 10:50:38 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66bddd7e-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8b4b331b8ac41e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
28 KB 57ms
25ms Stylesheet
text/css 2606:4700::6812:ba1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
Origin: https://lexmark.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 13569832
x-jsd-version: 5.2.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27506
x-served-by: cache-fra-eddf8230122-FRA, cache-lga21962-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T5JCBTvN1Q%2BM1N0Q3%2BUc9fsG2aBGjs0ZV1ZBRtBUD5ha0sWO%2FqIrSuAtTI6%2BnCVbqnQC%2BqbjySWPNf4gSsq3tuB%2Fg4w89OwoCsuuxPS4Ciz1gemnJwgGDumi5QQwEwzVyIFESC4YzIUix9Se9ks%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8b4b331bba751d94-FRA

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 245 KB
80 KB 97ms
52ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

943519a4ad4d45d94d110a99540cb4253919e9a47693849d103a5cc988970cf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81828
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 41ms
21ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 185141
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bSoDPOQX8tD1hYVaLcDd9Isc52k3vWjD0zKtOAyDZFfNNt2HSrfic%2B6bhFOnAWDwXeC6fYCP%2BlUI%2BU71jlgC5807o3vwJ1GLYxWj%2BH7oBBWcSEGBOE6ngIyON%2BpsgzrUVLfj28Ll"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8b4b331bae093a7a-FRA
expires: Thu, 07 Aug 2025 16:56:49 GMT

GET
H3 200 runtime.944678112fbe20a2.js Show response
lexmark.savings.workingadvantage.com/ 4 KB
2 KB 136ms
134ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/runtime.944678112fbe20a2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66591acd623449ceebd1141d1a49254c5a824bc966c247d7cf0e6275c487b317

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
Origin: https://lexmark.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Aug 2024 10:50:28 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
etag: W/"66bddd74-e4f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://lexmark.savings.workingadvantage.com, https://lexmark.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 8b4b331b8ac71e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.907166355836bac1.js Show response
lexmark.savings.workingadvantage.com/ 141 KB
47 KB 211ms
210ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/polyfills.907166355836bac1.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7fc858728287b5149cb2dce3f0e551674926497f5e788a8d5dc6e79b617e24b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
Origin: https://lexmark.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Aug 2024 10:50:28 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
etag: W/"66bddd74-234da"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://lexmark.savings.workingadvantage.com, https://lexmark.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 8b4b331b8ac81e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.fed71c9ab40863dc.js Show response
lexmark.savings.workingadvantage.com/ 163 KB
54 KB 138ms
137ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/scripts.fed71c9ab40863dc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1ef0577267ffcb026254a1a22d23ff6cafa02203c87c1664bc5b7910eaa34d6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=5184000; includeSubDomains
last-modified: Thu, 15 Aug 2024 10:50:28 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66bddd74-28d5f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8b4b331c9bf01e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.ddc42e01d2b1ccc9.js Show response
lexmark.savings.workingadvantage.com/ 5 MB
1 MB 136ms
134ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/main.ddc42e01d2b1ccc9.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6a3a23feab331acb3f48399a584a8b3946acdd679b7d31fca65933d3bbd7d47

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
Origin: https://lexmark.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Aug 2024 10:50:28 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
etag: W/"66bddd74-4e7d14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://lexmark.savings.workingadvantage.com, https://lexmark.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 8b4b331b8aca1e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 265 KB
88 KB 56ms
30ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f7e09cc0db40e8a2ad3ec28c8b71939dcc7c726e53d28b460abe369d8dfd741a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89853
x-xss-protection: 0
last-modified: Sat, 17 Aug 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 17 Aug 2024 16:56:49 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 10ms
9ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Sat, 17 Aug 2024 17:56:49 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 12ms
10ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Sat, 17 Aug 2024 17:56:49 GMT

GET
H3 200 styles.a942ee15af616dea.css
lexmark.savings.workingadvantage.com/ 97 KB
16 KB 136ms
135ms Stylesheet
text/css 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/styles.a942ee15af616dea.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d21d864eb3e2d7b49a318f9166bfc4ed33f96f0b2ada41bf97012effc623faa

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=5184000; includeSubDomains
last-modified: Thu, 15 Aug 2024 10:50:28 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66bddd74-18353"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-cache-status: DYNAMIC
cf-ray: 8b4b331c9bf61e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 62ms
17ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
Origin: https://lexmark.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 13 Aug 2024 14:24:57 GMT
x-content-type-options: nosniff
age: 354712
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Aug 2025 14:24:57 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 310 KB
103 KB 30ms
29ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1feb6f5d66a86cfca394727a81212e1c81801db5fdeaa6226ede9735357e0fd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 105163
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 17 Aug 2024 16:56:49 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 43ms
8ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 17 Aug 2024 15:15:05 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6104
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 17 Aug 2024 17:15:05 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 44ms
28ms XHR
application/json 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f10.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
lexmark.savings.workingadvantage.com/api/ 8 KB
3 KB 149ms
149ms XHR
application/json 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/api/info

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58d082577a9afc18c748a82afa2f1804aa3e17b12fb6bbc039a1e3238140bc97

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-1807d5686e9f397e----1723913809746
traceparent: 00-b5810ab982924ca2ab7221514aa86b00-1807d5686e9f397e-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjE4MDdkNTY4NmU5ZjM5N2UiLCJ0ciI6ImI1ODEwYWI5ODI5MjRjYTJhYjcyMjE1MTRhYTg2YjAwIiwidGkiOjE3MjM5MTM4MDk3NDYsInRrIjoiODg4MzEifX0=

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1fba-0Lt4EcGJhPjy346d+m89QJtI0kY"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://lexmark.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b331eeef91e18-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:48 GMT

GET
H3 200 marketplace-styles.css Show response
lexmark.savings.workingadvantage.com/api/lexmark/ 26 KB
5 KB 446ms
446ms XHR
text/css 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/api/lexmark/marketplace-styles.css

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8b8da9418b0d54acb8fb3a02dd3eba54c080167251cb687ad01036aeca3a310

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-17bbdb6de4cffb4b----1723913809747
traceparent: 00-392773a6f3b6d5df317f8d8359ba8100-17bbdb6de4cffb4b-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjE3YmJkYjZkZTRjZmZiNGIiLCJ0ciI6IjM5Mjc3M2E2ZjNiNmQ1ZGYzMTdmOGQ4MzU5YmE4MTAwIiwidGkiOjE3MjM5MTM4MDk3NDcsInRrIjoiODg4MzEifX0=

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"695b-YmuRE5EJOafTkb8ZHBiFp3jJKIg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://lexmark.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b331eeefc1e18-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:49 GMT

GET
H3 200 colors.css Show response
lexmark.savings.workingadvantage.com/api/lexmark/ 3 KB
834 B 158ms
158ms XHR
text/css 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/api/lexmark/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39d1f21353795c7a353b4a74ebb5fbb9df3eb3c7b0920704d2065f324cf4e2d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-48297d7499f0c9e8----1723913809748
traceparent: 00-3b997caa35a8ad64c119e24c2cb7c500-48297d7499f0c9e8-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjQ4Mjk3ZDc0OTlmMGM5ZTgiLCJ0ciI6IjNiOTk3Y2FhMzVhOGFkNjRjMTE5ZTI0YzJjYjdjNTAwIiwidGkiOjE3MjM5MTM4MDk3NDgsInRrIjoiODg4MzEifX0=

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"aaa-bJ28fj3BRyO3rRjmvdUG2/PxGMY"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://lexmark.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b331eef031e18-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:48 GMT

GET
H3

200

main.js Show response
lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/ Frame 7153
Redirect Chain

https://lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js?

8 KB
4 KB

16ms
16ms

Script
application/javascript

104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js?

Requested by

Protocol

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c90a145cbde43dfbcf48f14f92fb27a0f5f8de60794fef0d7a4a433bd135808

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray: 8b4b331f4f631e18-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sat, 17 Aug 2024 16:56:49 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js?
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray: 8b4b331eff051e18-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
236 B 17ms
15ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1176010927&t=pageview&_s=1&dl=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&ul=de-de&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=879921971&gjid=147241717&cid=2061865136.1723913810&tid=UA-2876877-9&_gid=1797749102.1723913810&_r=1&_slc=1&gtm=45He48e0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=0&npa=1&z=644902646

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 17 Aug 2024 16:56:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 61ms
22ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je48e0v9112553684z878847533za200zb78847533&_p=1723913809214&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=2061865136.1723913810&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1723913809&sct=1&seg=0&dl=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&dt=Beneplace%20Team%20Discounts&en=page_view&_fv=1&_ss=1&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&up.pb_site_name=lexmark&up.page_path=%2Fhome&up.user_id_value=&up.zip_code=NaN&tfd=1645
Requested by: Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2024 16:56:49 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
26 KB 37ms
11ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2602:816:5001::39 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Sat, 17 Aug 2024 16:56:49 GMT
strict-transport-security: max-age=300
x-amz-request-id: JKAA1R9626YKRNRP
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: ySGAc37U9z4tW2VHRN1/eocfzeA0FXNZ/FvGEBPKNicLNqSItwfEzXno+UCO6z7w3jlXk1NiiBs=
x-served-by: cache-fra-eddf8230024-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 1553

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 291 KB
97 KB 30ms
29ms Script
application/javascript 172.217.18.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f104.1e100.net

Software

Google Tag Manager /

Resource Hash

d7599aede8e0a7e897e2b8214aa65dce01123f5ce70b2ab80ec25dcf18bb1938

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99625
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 17 Aug 2024 16:56:49 GMT

POST
H3 200 8b4b331a495b1e18 Show response
lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 7153 0
686 B 31ms
27ms XHR
text/plain 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/jsd/r/8b4b331a495b1e18

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 8b4b3320186a1e18-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 favicon.ico
lexmark.savings.workingadvantage.com/ 9 KB
3 KB 124ms
123ms Other
text/html 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e071145bbbc60b61a7e12af9bae3c130ad8dae3baed8cb6857bdf5d4fe4f4746

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 15 Aug 2024 10:50:39 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 8b4b3320186e1e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 lexmark Show response
lexmark.savings.workingadvantage.com/api/controls/ 997 B
908 B 154ms
154ms XHR
application/json 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/api/controls/lexmark

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-be6fea30bfad4450----1723913809936
traceparent: 00-d612a9c8f5700b5c1f47d2ca2f7eae00-be6fea30bfad4450-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImJlNmZlYTMwYmZhZDQ0NTAiLCJ0ciI6ImQ2MTJhOWM4ZjU3MDBiNWMxZjQ3ZDJjYTJmN2VhZTAwIiwidGkiOjE3MjM5MTM4MDk5MzYsInRrIjoiODg4MzEifX0=

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://lexmark.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b332018751e18-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:49 GMT

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 151 B
640 B 406ms
343ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1767&ck=0&s=884fa18a72efb8b9&ref=https://lexmark.savings.workingadvantage.com/home&af=err,xhr,stn,ins,spa&be=1011&fe=643&dc=559&perf=%7B%22timing%22:%7B%22of%22:1723913808181,%22n%22:0,%22f%22:788,%22dn%22:789,%22dne%22:807,%22c%22:807,%22s%22:807,%22ce%22:823,%22rq%22:823,%22rp%22:1011,%22rpe%22:1014,%22di%22:1246,%22ds%22:1568,%22de%22:1570,%22dc%22:1652,%22l%22:1652,%22le%22:1654%7D,%22navigation%22:%7B%7D%7D
Requested by: Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 889400be70a8ed911d67aa43a14fb97973de76e03724d4c82c002e25a168ecad

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
access-control-expose-headers: Date
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
timing-allow-origin: https://lexmark.savings.workingadvantage.com
Content-Length: 151
x-served-by: cache-fra-etou8220159-FRA

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 17ms
16ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je48e0v9126564266za200&_p=1723913809214&gcd=13l3l3l2l3&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&ul=de-de&sr=1600x1200&cid=2061865136.1723913810&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&dt=Beneplace%20Team%20Discounts&sid=1723913809&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1807
Requested by: Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2024 16:56:49 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 401 dlk-compare Show response
lexmark.savings.workingadvantage.com/api/known/ 182 B
516 B 137ms
136ms XHR
application/json 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/api/known/dlk-compare?guid=c26apwfd6bkby9quyo186lnl9

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

170287bbbfc14739c9b3aa6ce30abb0669d418f01118028f4b06c198fdbdde1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-3eff588278b6e92e----1723913810222
traceparent: 00-406e5c97b0cd5de028117c613acad100-3eff588278b6e92e-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjNlZmY1ODgyNzhiNmU5MmUiLCJ0ciI6IjQwNmU1Yzk3YjBjZDVkZTAyODExN2M2MTNhY2FkMTAwIiwidGkiOjE3MjM5MTM4MTAyMjIsInRrIjoiODg4MzEifX0=

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by
etag: W/"b6-lGFIUF59ZyAYAhOl/ILN9N2OvBU"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://lexmark.savings.workingadvantage.com
cf-ray: 8b4b3321ea771e18-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
content-length: 182
alt-svc: h3=":443"; ma=86400

GET
H3 200 info
lexmark.savings.workingadvantage.com/api/ 9 KB
3 KB 155ms
155ms XHR
application/json 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.workingadvantage.com/api/info?authInfo=true

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://lexmark.savings.workingadvantage.com/home?DLK=c26apwfd6bkby9quyo186lnl9&utm_medium=July-22-2024-TrueCar-Remainder&utm_source=email&conv_source=zeta&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-9f2fb1f4b40c6cd9----1723913810224
traceparent: 00-b108cd6fb0db324575c75c7673030400-9f2fb1f4b40c6cd9-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjlmMmZiMWY0YjQwYzZjZDkiLCJ0ciI6ImIxMDhjZDZmYjBkYjMyNDU3NWM3NWM3NjczMDMwNDAwIiwidGkiOjE3MjM5MTM4MTAyMjQsInRrIjoiODg4MzEifX0=

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"237a-X5oeu8bQPIA/Wzkjh73gHZ0GwQo"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://lexmark.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b3321ea7a1e18-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:49 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
8ms Image
image/gif 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1176010927&t=pageview&_s=1&dl=https%3A%2F%2Flexmark.savings.workingadvantage.com%2F&ul=de-de&de=UTF-8&dt=Lexmark%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAACAAI~&jid=&gjid=&cid=2061865136.1723913810&tid=UA-2876877-9&_gid=1797749102.1723913810&gtm=45He48e0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=0&npa=1&z=2145507943

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2024 14:36:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 8434
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 www-wa_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
3 KB 185ms
140ms Other
image/png 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/www-wa_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 06 Jun 2023 16:55:52 GMT
server: cloudflare
etag: "647f6518-7f8"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 8b4b33224f272bd6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 2040

GET
H3 200 www-wa_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
0 185ms
185ms Other
image/png 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/www-wa_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 06 Jun 2023 16:55:52 GMT
server: cloudflare
etag: "647f6518-7f8"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 8b4b33224f272bd6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 2040

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 24 B
363 B 246ms
244ms XHR
image/gif 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2189&ck=0&s=884fa18a72efb8b9&ref=https://lexmark.savings.workingadvantage.com/
Requested by: Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: image/gif
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 24
x-served-by: cache-fra-etou8220159-FRA

GET
H3

200

sign-in Show response
auth.savings.workingadvantage.com/lexmark/
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?subdomain=lexmark&response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaig...
https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marke...

10 KB
3 KB

400ms
400ms

Document
text/html

104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace

Requested by

Host: lexmark.savings.workingadvantage.com
URL: https://lexmark.savings.workingadvantage.com/main.ddc42e01d2b1ccc9.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e57184b4e84c92b007d75d1adbc288d679bc9a029606786480e513ea0e75181c

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://lexmark.savings.workingadvantage.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8b4b3323fd071e18-FRA
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Sat, 17 Aug 2024 16:56:50 GMT
last-modified: Thu, 15 Aug 2024 10:53:03 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8b4b33230bd21e18-FRA
content-type: text/html; charset=utf-8
date: Sat, 17 Aug 2024 16:56:50 GMT
expires: Sat, 17 Aug 2024 16:56:49 GMT
location: /lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

POST collect
region1.google-analytics.com/g/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/jserrors/1/ 0
0

POST NRJS-2ebdf5b38afbaafd48e
bam.nr-data.net/events/1/ 0
0

POST collect
region1.google-analytics.com/g/ 0
0

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 678 KB
0 0ms
0ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 003cb3efad9c745c2a6b2771e6c4543c54063a0fead3e7f83cd9d4eb08cd0ebb

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
last-modified: Mon, 12 Aug 2024 13:12:57 GMT
server: AkamaiNetStorage
etag: "741b207f5b1f9b8b9d6ccca0207861a1:1723468377.545799"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://lexmark.savings.workingadvantage.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 161814
expires: Sat, 17 Aug 2024 17:56:49 GMT

GET
H3 200 new-relic-integration.js Show response
auth.savings.workingadvantage.com/assets/new-relic/ 51 KB
18 KB 129ms
127ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=5184000; includeSubDomains
last-modified: Thu, 15 Aug 2024 10:53:03 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66bdde0f-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8b4b332688731e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
0 2ms
2ms Stylesheet
text/css 2606:4700::6812:ba1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 13569832
x-jsd-version: 5.2.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27506
x-served-by: cache-fra-eddf8230122-FRA, cache-lga21962-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T5JCBTvN1Q%2BM1N0Q3%2BUc9fsG2aBGjs0ZV1ZBRtBUD5ha0sWO%2FqIrSuAtTI6%2BnCVbqnQC%2BqbjySWPNf4gSsq3tuB%2Fg4w89OwoCsuuxPS4Ciz1gemnJwgGDumi5QQwEwzVyIFESC4YzIUix9Se9ks%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8b4b331bba751d94-FRA

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 245 KB
80 KB 52ms
46ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

943519a4ad4d45d94d110a99540cb4253919e9a47693849d103a5cc988970cf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81828
x-xss-protection: 0

GET
H3 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
0 2ms
2ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 185141
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bSoDPOQX8tD1hYVaLcDd9Isc52k3vWjD0zKtOAyDZFfNNt2HSrfic%2B6bhFOnAWDwXeC6fYCP%2BlUI%2BU71jlgC5807o3vwJ1GLYxWj%2BH7oBBWcSEGBOE6ngIyON%2BpsgzrUVLfj28Ll"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8b4b331bae093a7a-FRA
expires: Thu, 07 Aug 2025 16:56:49 GMT

GET
H3 200 runtime.13338c5d9c83d0b6.js Show response
auth.savings.workingadvantage.com/ 1 KB
1 KB 126ms
124ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/runtime.13338c5d9c83d0b6.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

779700103eaa215226d17491070dd24cc4e6ae6533a0f3a4071140805119b45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
Origin: https://auth.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Aug 2024 10:52:56 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
etag: W/"66bdde08-488"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 8b4b332688741e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 polyfills.c9fbd39a06fd6489.js Show response
auth.savings.workingadvantage.com/ 122 KB
42 KB 161ms
160ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/polyfills.c9fbd39a06fd6489.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66e1743db2ebf35df542d5426deacd3e99faa65b8e95711c1d7f5377475d7a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
Origin: https://auth.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Aug 2024 10:52:56 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
etag: W/"66bdde08-1e711"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 8b4b332688761e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.fed71c9ab40863dc.js Show response
auth.savings.workingadvantage.com/ 163 KB
54 KB 219ms
217ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/scripts.fed71c9ab40863dc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1ef0577267ffcb026254a1a22d23ff6cafa02203c87c1664bc5b7910eaa34d6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=5184000; includeSubDomains
last-modified: Thu, 15 Aug 2024 10:52:56 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66bdde08-28d5f"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-cache-status: DYNAMIC
cf-ray: 8b4b332779d61e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.3b99f1cee365f5d6.js Show response
auth.savings.workingadvantage.com/ 2 MB
445 KB 120ms
119ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/main.3b99f1cee365f5d6.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe647cbaa45972daac1e77186c4337c7c4ebbb8b02fea33eea858c8dc00498f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
Origin: https://auth.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Aug 2024 10:52:56 GMT
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
etag: W/"66bdde08-1c1c1f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com, https://auth.savings.workingadvantage.com
access-control-allow-credentials: true, true
cf-ray: 8b4b332688781e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 265 KB
0 2ms
2ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f7e09cc0db40e8a2ad3ec28c8b71939dcc7c726e53d28b460abe369d8dfd741a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: br
last-modified: Sat, 17 Aug 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89853
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 17 Aug 2024 16:56:49 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
220 B 25ms
20ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Sat, 17 Aug 2024 17:56:51 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
220 B 26ms
21ms Script
application/x-javascript 2a02:26f0:480:f9d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f9d::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Sat, 17 Aug 2024 17:56:51 GMT

GET
H3 200 styles.835e5d0e9714cffa.css
auth.savings.workingadvantage.com/ 39 KB
8 KB 409ms
407ms Stylesheet
text/css 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/styles.835e5d0e9714cffa.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c6bfcfb1ba199b8a9cffc09a48ca4e9eaf43d3b71c9dce5cf8c52a702ebe73d

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=5184000; includeSubDomains
last-modified: Thu, 15 Aug 2024 10:52:56 GMT
server: cloudflare
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
etag: W/"66bdde08-9cf4"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-cache-status: DYNAMIC
cf-ray: 8b4b332779d81e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
0 1ms
1ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 13 Aug 2024 14:24:57 GMT
x-content-type-options: nosniff
age: 354712
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Aug 2025 14:24:57 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 310 KB
0 0ms
0ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1feb6f5d66a86cfca394727a81212e1c81801db5fdeaa6226ede9735357e0fd8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: br
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 105163
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 17 Aug 2024 16:56:49 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
0 1ms
1ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 15:15:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6104
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 17 Aug 2024 17:15:05 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 15 B
35 B 15ms
15ms XHR
text/plain 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1564723103&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Flexmark%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace%26redirect_uri%3Dhttps%253A%252F%252Flexmark.savings.workingadvantage.com%252Fhome%253FDLK%253Dc26apwfd6bkby9quyo186lnl9%2526utm_medium%253DJuly-22-2024-TrueCar-Remainder%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace%2526utm_content%253Dhome-link-marketplace&dr=https%3A%2F%2Flexmark.savings.workingadvantage.com%2F&ul=de-de&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=QACAAEABAAAAACAAI~&jid=&gjid=&cid=2061865136.1723913810&tid=UA-2876877-9&_gid=1797749102.1723913810&_slc=1&gtm=45He48e0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=0&npa=1&z=260691793

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 17 Aug 2024 16:56:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 291 KB
0 0ms
0ms Script
application/javascript 172.217.18.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f104.1e100.net

Software

Google Tag Manager /

Resource Hash

d7599aede8e0a7e897e2b8214aa65dce01123f5ce70b2ab80ec25dcf18bb1938

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:49 GMT
content-encoding: br
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99625
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 17 Aug 2024 16:56:49 GMT

POST
H3 204 collect
region1.google-analytics.com/g/ 0
0 15ms
15ms Fetch
text/plain 216.239.34.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je48e0v9112553684z878847533za200zb78847533&_p=1723913810973&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=2061865136.1723913810&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1723913809&sct=1&seg=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Flexmark%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace%26redirect_uri%3Dhttps%253A%252F%252Flexmark.savings.workingadvantage.com%252Fhome%253FDLK%253Dc26apwfd6bkby9quyo186lnl9%2526utm_medium%253DJuly-22-2024-TrueCar-Remainder%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace%2526utm_content%253Dhome-link-marketplace&dr=https%3A%2F%2Flexmark.savings.workingadvantage.com%2F&dt=Beneplace%20Team%20Discounts&en=page_view&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fauth.savings.workingadvantage.com%2Flexmark%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace%26redirect_uri%3Dhttps%253A%252F%252Flexmark.savings.workingadvantage.com%252Fhome%253FDLK%253Dc26apwfd6bkby9quyo186lnl9%2526utm_medium%253DJuly-22-2024-TrueCar-Remainder%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace%2526utm_content%253Dhome-link-marketplace&up.pb_site_name=auth&up.page_path=%2Flexmark%2Fsign-in&up.user_id_value=&up.zip_code=NaN&tfd=806
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2024 16:56:51 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 22ms
21ms XHR
application/json 172.217.16.202
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.202 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f10.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3 200 system-wide Show response
lexmark.savings.beneplace.com/api/notifications/ 2 B
756 B 217ms
176ms XHR
application/json 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.beneplace.com/api/notifications/system-wide

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 2
server: cloudflare
etag: W/"2-l9Fw4VUO7kr8CvBlt4zaMCqXZ0w"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b332a5f1930f0-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:50 GMT

GET
H3 200 info Show response
lexmark.savings.beneplace.com/api/ 9 KB
3 KB 655ms
614ms XHR
application/json 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

518c9f3f942847e26a55587f95e82b811898cae3858de171cea0975b86172a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"237a-X5oeu8bQPIA/Wzkjh73gHZ0GwQo"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b332a5f2130f0-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:51 GMT

GET
H3 200 info Show response
lexmark.savings.beneplace.com/api/ 9 KB
3 KB 800ms
141ms XHR
application/json 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

518c9f3f942847e26a55587f95e82b811898cae3858de171cea0975b86172a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"237a-X5oeu8bQPIA/Wzkjh73gHZ0GwQo"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b332e3b8f30f0-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:51 GMT

GET
H3 200 lexmark Show response
lexmark.savings.beneplace.com/api/controls/ 997 B
1 KB 230ms
190ms XHR
application/json 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.beneplace.com/api/controls/lexmark

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3e5-/4+gDMZIBxQ74K7O86EUHccGXBs"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b332a5f2330f0-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:50 GMT

GET
H3 200 marketplace-styles.css Show response
lexmark.savings.beneplace.com/api/lexmark/ 26 KB
5 KB 1073ms
1034ms XHR
text/css 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.beneplace.com/api/lexmark/marketplace-styles.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8b8da9418b0d54acb8fb3a02dd3eba54c080167251cb687ad01036aeca3a310

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"695b-YmuRE5EJOafTkb8ZHBiFp3jJKIg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b332a5f1e30f0-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:51 GMT

GET
H2 200 nr-spa.142f942f-1.239.1.min.js Show response
js-agent.newrelic.com/ 75 KB
0 1ms
1ms Script
application/javascript 2602:816:5001::39
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa.142f942f-1.239.1.min.js
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2602:816:5001::39 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id: sn0IxCI.MkvNIiRAoqe.awP2R5evqDa4
content-encoding: br
via: 1.1 varnish
date: Sat, 17 Aug 2024 16:56:49 GMT
x-amz-request-id: JKAA1R9626YKRNRP
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 25649
x-amz-id-2: ySGAc37U9z4tW2VHRN1/eocfzeA0FXNZ/FvGEBPKNicLNqSItwfEzXno+UCO6z7w3jlXk1NiiBs=
x-served-by: cache-fra-eddf8230024-FRA
last-modified: Wed, 18 Oct 2023 21:33:59 GMT
server: AmazonS3
etag: "929044c7a94ad93d4583f5b62538f46a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 1553

GET
H3 200 favicon.ico
auth.savings.workingadvantage.com/ 10 KB
3 KB 135ms
134ms Other
text/html 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e57184b4e84c92b007d75d1adbc288d679bc9a029606786480e513ea0e75181c

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 15 Aug 2024 10:53:03 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 8b4b332a4d721e18-FRA
alt-svc: h3=":443"; ma=86400

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/1/ 151 B
634 B 470ms
470ms XHR
text/plain 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1180&ck=0&s=aa5f3f2ca4f4d844&ref=https://auth.savings.workingadvantage.com/lexmark/sign-in&af=err,xhr,stn,ins,spa&be=564&fe=602&dc=591&perf=%7B%22timing%22:%7B%22of%22:1723913810383,%22n%22:0,%22r%22:3,%22re%22:165,%22f%22:165,%22dn%22:165,%22dne%22:165,%22c%22:165,%22s%22:165,%22ce%22:165,%22rq%22:166,%22rp%22:564,%22rpe%22:566,%22di%22:732,%22ds%22:1153,%22de%22:1155,%22dc%22:1164,%22l%22:1164,%22le%22:1166%7D,%22navigation%22:%7B%22rc%22:1%7D%7D
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 889400be70a8ed911d67aa43a14fb97973de76e03724d4c82c002e25a168ecad

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: text/plain
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-expose-headers: Date
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
Connection: keep-alive
timing-allow-origin: https://auth.savings.workingadvantage.com
Content-Length: 151
x-served-by: cache-fra-etou8220080-FRA

POST
H/1.1 200 NRJS-2ebdf5b38afbaafd48e Show response
bam.nr-data.net/events/1/ 24 B
360 B 132ms
131ms XHR
image/gif 162.247.243.29
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=1660&ck=0&s=aa5f3f2ca4f4d844&ref=https://auth.savings.workingadvantage.com/lexmark/sign-in
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: text/plain

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
content-type: image/gif
access-control-allow-origin: https://auth.savings.workingadvantage.com
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 24
x-served-by: cache-fra-etou8220056-FRA

GET
H3 200 auth Show response
lexmark.savings.beneplace.com/api/navigation/lexmark/auth_footer/US/ 959 B
1 KB 149ms
149ms XHR
application/json 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.beneplace.com/api/navigation/lexmark/auth_footer/US/auth

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f63e31ebf9b37ea9651067359238bfd61f6cd7dc7c6c0ea864e6f8c345f8f8b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"3bf-GIZgHybzmfj3d8rGD0L3UFFjORw"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b332e4ba030f0-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:51 GMT

GET
H3 200 onetrust Show response
lexmark.savings.beneplace.com/api/platform/options/ 505 B
1 KB 135ms
135ms XHR
application/json 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.beneplace.com/api/platform/options/onetrust

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

272b57b0c1521a35d2bc91f5b5c560c69e9dfd19631f60344473fd041236dba3

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"1f9-Kr7PpbVfhwU6XhszSqAL/52koPg"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b3330ee4330f0-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:51 GMT

POST
H3 200 known
auth.savings.workingadvantage.com/auth/ 30 B
861 B 345ms
343ms XHR
application/json 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/auth/known?subdomain=lexmark

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https:%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
tracestate: 88831@nr=0-1-2647367-1120218725-0b1853d0d5b4f4bf----1723913812649
traceparent: 00-900786f08df39283e74a5ba9048d5d00-0b1853d0d5b4f4bf-01
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjBiMTg1M2QwZDViNGY0YmYiLCJ0ciI6IjkwMDc4NmYwOGRmMzkyODNlNzRhNWJhOTA0OGQ1ZDAwIiwidGkiOjE3MjM5MTM4MTI2NDksInRrIjoiODg4MzEifX0=
Content-Type: application/json

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by
alt-svc: h3=":443"; ma=86400
content-length: 30
server: cloudflare
etag: W/"1e-ztFiTiHeG1Vvou6/AhasmuDPbdM"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b33311dc51e18-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:51 GMT

GET
H3 200 info Show response
lexmark.savings.beneplace.com/api/ 9 KB
3 KB 139ms
139ms XHR
text/html 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lexmark.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

518c9f3f942847e26a55587f95e82b811898cae3858de171cea0975b86172a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: https://auth.savings.workingadvantage.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8b4b33311e8530f0-FRA
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Sat, 17 Aug 2024 16:56:51 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
8ms Image
image/gif 142.250.184.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1564723103&t=pageview&_s=1&dl=https%3A%2F%2Fauth.savings.workingadvantage.com%2Flexmark%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace%26redirect_uri%3Dhttps%3A%252F%252Flexmark.savings.workingadvantage.com%252Fhome%253FDLK%253Dc26apwfd6bkby9quyo186lnl9%2526utm_medium%253DJuly-22-2024-TrueCar-Remainder%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace%2526utm_content%253Dhome-link-marketplace&dr=https%3A%2F%2Flexmark.savings.workingadvantage.com%2F&ul=de-de&de=UTF-8&dt=Lexmark%27s%20Savings%20Marketplace&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SACAAEABAAAAACAAI~&jid=&gjid=&cid=2061865136.1723913810&tid=UA-2876877-9&_gid=1797749102.1723913810&gtm=45He48e0n815QN8HWMv78847533za200&gcd=13l3l3l2l1&dma_cps=syphamo&dma=1&tag_exp=0&npa=1&z=1343975541

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 17 Aug 2024 14:36:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 8436
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 www-wa_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
0 0ms
0ms Other
image/png 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/www-wa_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

553eb2214968542fc611f924e588fadff8888bb46cfb282a844128ecd37e4b66

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 06 Jun 2023 16:55:52 GMT
server: cloudflare
etag: "647f6518-7f8"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 8b4b33224f272bd6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 2040

GET
H3 200 www-wa_favicon_01.png
controlpanel.savings.beneplace.com/uploads/ 2 KB
0 0ms
0ms Other
image/png 104.18.6.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.savings.beneplace.com/uploads/www-wa_favicon_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.6.126 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

553eb2214968542fc611f924e588fadff8888bb46cfb282a844128ecd37e4b66

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:50 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 06 Jun 2023 16:55:52 GMT
server: cloudflare
etag: "647f6518-7f8"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=2592000, s-maxage=600
accept-ranges: bytes
cf-ray: 8b4b33224f272bd6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 2040

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 46ms
25ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1505aa0792421f831935f4761a95f31462a3dd097c8bd00ad8e9c765c8065517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 17 Aug 2024 16:56:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Wbr2pAeg61Hfi+2FuD0cYA==
age: 33239
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6882
x-ms-lease-status: unlocked
last-modified: Thu, 15 Aug 2024 19:37:39 GMT
server: cloudflare
etag: 0x8DCBD61B8ECC160
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 17daece3-d01e-0027-110c-f009c3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8b4b3331edf6380e-FRA

GET
H2 200 9cb309ca-4688-401d-8c24-f640db524ba7.json Show response
cdn.cookielaw.org/consent/9cb309ca-4688-401d-8c24-f640db524ba7/ 5 KB
2 KB 82ms
56ms XHR
application/x-javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/9cb309ca-4688-401d-8c24-f640db524ba7/9cb309ca-4688-401d-8c24-f640db524ba7.json

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0beb218aea930a266def597aa1d6bffd8ae05f3d95d6595834695d9468a878db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 17 Aug 2024 16:56:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-md5: 9JDz6sLcyFtV6gLnahCAhQ==
content-length: 1759
x-ms-lease-status: unlocked
last-modified: Tue, 26 Mar 2024 12:14:20 GMT
server: cloudflare
etag: 0x8DC4D8E44052F23
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 3e0b1c83-301e-004c-12d2-9b8676000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8b4b33324d919259-FRA
expires: Sun, 18 Aug 2024 16:56:52 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
315 B 66ms
32ms XHR
application/json 2606:4700::6812:1c7f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1c7f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:52 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 8b4b3332dd582bcf-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202403.1.0/ 442 KB
107 KB 22ms
22ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 17 Aug 2024 16:56:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: kUodklFyKXDEOUEPkRF3YA==
age: 69036
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 109667
x-ms-lease-status: unlocked
last-modified: Tue, 16 Jul 2024 21:39:19 GMT
server: cloudflare
etag: 0x8DCA5DFBFFA9F82
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0edf8d45-001e-008f-6dc9-d7ddd6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8b4b33331f5f380e-FRA

GET
H3

429

Primary Request sign-in Show response
auth.savings.workingadvantage.com/lexmark/
Redirect Chain

https://auth.savings.workingadvantage.com/auth/authorize?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-market...
https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marke...

21 KB
22 KB

32ms
32ms

Document
text/html

104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/main.3b99f1cee365f5d6.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24efa3bd329f51a2dd5864fa6babe5af8c315c737db5e373f5549e6d0f435f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https:%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-chl-out: jKMGyDTa0z17niTCHJEznZvZjzPhgDke2r3bQYPEtI6YQHVLbkD9OmBwoSmXgNMxvqvy9Gj95OOpcwMluz06dtFOZvPhg3FgxgHFFmoU9PZQPDD4f6cWFYHd/ZOrx+C4TLzahVoQJc+eFB6uAARvsw==$FJrAPOXSIbwkpqOxyO9dGw==
cf-mitigated: challenge
cf-ray: 8b4b3334298c1e18-FRA
content-length: 21219
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Sat, 17 Aug 2024 16:56:53 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Accept-Encoding
x-content-options: nosniff
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.workingadvantage.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8b4b3333488f1e18-FRA
content-type: text/html; charset=utf-8
date: Sat, 17 Aug 2024 16:56:53 GMT
expires: Sat, 17 Aug 2024 16:56:52 GMT
location: /lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true
server: cloudflare
strict-transport-security: max-age=5184000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H2 200 en.json
cdn.cookielaw.org/consent/9cb309ca-4688-401d-8c24-f640db524ba7/018e7240-e394-7508-bd58-7ca1ecf69c8a/ 74 KB
19 KB 61ms
61ms Fetch
application/x-javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/9cb309ca-4688-401d-8c24-f640db524ba7/018e7240-e394-7508-bd58-7ca1ecf69c8a/en.json

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 17 Aug 2024 16:56:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-md5: ZQwhN58IBmdm4HP2Qijxdw==
content-length: 19028
x-ms-lease-status: unlocked
last-modified: Tue, 26 Mar 2024 12:14:30 GMT
server: cloudflare
etag: 0x8DC4D8E49F109DB
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 14c5b5e5-101e-009b-0693-d41eb2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8b4b33336ed89259-FRA
expires: Sun, 18 Aug 2024 16:56:53 GMT

GET
H2 200 otFlat.json
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/ 13 KB
3 KB 22ms
21ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/otFlat.json

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 17 Aug 2024 16:56:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: gWbZdVb/GsEUTnv/p/InTg==
age: 66524
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3041
x-ms-lease-status: unlocked
last-modified: Tue, 16 Jul 2024 21:39:12 GMT
server: cloudflare
etag: 0x8DCA5DFBBC2C661
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 0dc9a83c-301e-004b-0683-d8a210000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8b4b3333ef859259-FRA

GET
H2 200 otPcTab.json
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/v2/ 63 KB
13 KB 22ms
21ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/v2/otPcTab.json

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 17 Aug 2024 16:56:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: g2ypzSRDfu1jLUtMEi+hcQ==
age: 66524
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13599
x-ms-lease-status: unlocked
last-modified: Tue, 16 Jul 2024 21:39:15 GMT
server: cloudflare
etag: 0x8DCA5DFBD40DAA4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 5abeb306-601e-007a-13d4-d7f9c7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8b4b3333ef889259-FRA

GET
H2 200 otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/ 24 KB
4 KB 23ms
23ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/otCommonStyles.css

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 17 Aug 2024 16:56:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: 4ErYmXXFNbMLrnc9DrDTsg==
age: 66524
x-ms-lease-status: unlocked
last-modified: Tue, 16 Jul 2024 21:39:25 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 22a573b8-c01e-00bb-4ef1-d7727e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8b4b3333ef8a9259-FRA

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://auth.savings.workingadvantage.com/
Origin: https://auth.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 13 Aug 2024 14:41:49 GMT
x-content-type-options: nosniff
age: 353704
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14168
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:29:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Aug 2025 14:41:49 GMT

GET
H2 200 ot_guard_logo.svg
cdn.cookielaw.org/logos/static/ 497 B
490 B 20ms
20ms Fetch
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 17 Aug 2024 16:56:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 66524
x-ms-lease-status: unlocked
last-modified: Thu, 15 Aug 2024 19:37:40 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 692e0bc8-c01e-00b0-486f-ef6a0a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8b4b33343fd39259-FRA

GET Background_Blank_Logo_%23003466_Color.png
cdn.cookielaw.org/logos/d3646c5c-241f-4a3a-8e20-5a76f0100e08/f2f4a009-5f91-4fc5-b02d-6b124ca021fc/01934b4d-0e2b-459f-96f7-f90662b436dc/ 0
0

GET powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 0
0

GET
H3 200 v1 Show response
auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 90 KB
35 KB 25ms
24ms Script
application/javascript 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8b4b3334298c1e18

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a11f52468794280380f389e1e4a1da2db87efc999a1926708f0897159c2f8c83

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true&__cf_chl_rt_tk=PSuoECmI2EAq7z26GEYC.T2MmGSlzYQiclElKr4H2wU-1723913813-0.0.1.1-7295
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:53 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8b4b33349a021e18-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/g/ba7376691753/ 44 KB
15 KB 35ms
22ms Script
application/javascript 104.18.95.41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/g/ba7376691753/api.js?onload=IbcA8&render=explicit
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8b4b3334298c1e18
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c378a64a8916499372b3021c07797d63fc3914efd9ec6ab15ba69e6fc5c1efd

Request headers

Referer
Origin: https://auth.savings.workingadvantage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:53 GMT
content-encoding: br
last-modified: Tue, 13 Aug 2024 23:33:59 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
cross-origin-resource-policy: cross-origin
cf-ray: 8b4b3334ea239107-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 favicon.ico
auth.savings.workingadvantage.com/ 10 KB
10 KB 0ms
0ms Image
text/html 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth.savings.workingadvantage.com/favicon.ico

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Aug 2024 10:53:03 GMT
server: cloudflare
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 8b4b332a4d721e18-FRA
alt-svc: h3=":443"; ma=86400

GET
BLOB 200
OK d7d178cf-4756-4a28-b6e3-be70ecb04418
https://auth.savings.workingadvantage.com/ 13 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://auth.savings.workingadvantage.com/d7d178cf-4756-4a28-b6e3-be70ecb04418
Requested by: Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Length: 13
Content-Type: text/javascript

GET
H3 200 favicon.ico
auth.savings.workingadvantage.com/ 10 KB
0 0ms
0ms Other
text/html 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e57184b4e84c92b007d75d1adbc288d679bc9a029606786480e513ea0e75181c

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 16:56:51 GMT
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 15 Aug 2024 10:53:03 GMT
server: cloudflare
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 8b4b332a4d721e18-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 c1b18c6f2665ad4 Show response
auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1374878383:1723911815:QHcaUL4QiFB87fMb4AajYvqwPXxTqGgDmjxUcZVaSrI/8b4b3334298c1e18/ 16 KB
13 KB 40ms
38ms XHR
text/plain 104.18.16.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1374878383:1723911815:QHcaUL4QiFB87fMb4AajYvqwPXxTqGgDmjxUcZVaSrI/8b4b3334298c1e18/c1b18c6f2665ad4

Requested by

Host: auth.savings.workingadvantage.com
URL: https://auth.savings.workingadvantage.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8b4b3334298c1e18

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.16.216 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5b328899edaee6d8c3d5012ba69a1a80c5405b60c75ce7e944d8c2ccbb77634

Security Headers

Name	Value
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
CF-Challenge: c1b18c6f2665ad4
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 17 Aug 2024 16:56:53 GMT
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 8b4b33359b2f1e18-FRA
alt-svc: h3=":443"; ma=86400
cf-chl-gen: vjtnrHbBmlzLgftmdM/0EoQC6dzinGZ2J43J3bKfwXzp+AwhHIFsbklfBl8vKAIqH8gP+LMzMg==$PMHF+rqJNA4sVn5Y

GET
H3 200 /
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/n64ay/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Frame DA39 0
0 31ms
22ms Document
text/html 104.18.94.41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/n64ay/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/ba7376691753/api.js?onload=IbcA8&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.94.41 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8b4b33361ea79006-FRA
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Sat, 17 Aug 2024 16:56:53 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

GET
BLOB 200
OK 7d92e304-8895-44ab-9be4-61b0d1c653c6
https://auth.savings.workingadvantage.com/ 80 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://auth.savings.workingadvantage.com/7d92e304-8895-44ab-9be4-61b0d1c653c6
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f3418640c1204265881221580b9d1554424f6ed49549d408da50c690ab29f400

Request headers

Referer: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Length: 80
Content-Type: text/javascript

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je48e0v9112553684za200zb78847533&_p=1723913809214&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=2061865136.1723913810&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1723913809&sct=1&seg=0&dl=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3FDLK%3Dc26apwfd6bkby9quyo186lnl9%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&dt=Beneplace%20Team%20Discounts&en=scroll&ep.userId=&epn.percent_scrolled=90&_et=6&tfd=2773

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je48e0v9112553684za200zb78847533&_p=1723913809214&gcd=13l3l3l2l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&cid=2061865136.1723913810&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=3&sid=1723913809&sct=1&seg=0&dl=https%3A%2F%2Flexmark.savings.workingadvantage.com%2F&dt=Lexmark%27s%20Savings%20Marketplace&en=user_engagement&ep.userId=&_et=1119&tfd=2774

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2775&ck=0&s=884fa18a72efb8b9&ref=https://lexmark.savings.workingadvantage.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2776&ck=0&s=884fa18a72efb8b9&ref=https://lexmark.savings.workingadvantage.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/jserrors/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2776&ck=0&s=884fa18a72efb8b9&ref=https://lexmark.savings.workingadvantage.com/

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/events/1/NRJS-2ebdf5b38afbaafd48e?a=1120218725&sa=1&v=1.239.1&t=Unnamed%20Transaction&rst=2777&ck=0&s=884fa18a72efb8b9&ref=https://lexmark.savings.workingadvantage.com/

Domain: region1.google-analytics.com
URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je48e0v9126564266za200&_p=1723913809214&gcd=13l3l3l2l3&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&ul=de-de&sr=1600x1200&cid=2061865136.1723913810&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=ABAI&_s=2&dl=https%3A%2F%2Flexmark.savings.workingadvantage.com%2F&dt=Lexmark%27s%20Savings%20Marketplace&sid=1723913809&sct=1&seg=1&en=page_view&_ee=1&_et=247&tfd=2778

Domain: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/logos/d3646c5c-241f-4a3a-8e20-5a76f0100e08/f2f4a009-5f91-4fc5-b02d-6b124ca021fc/01934b4d-0e2b-459f-96f7-f90662b436dc/Background_Blank_Logo_%23003466_Color.png

Domain: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.workingadvantage.com/	1970-01-20 22:51:55	Name: __cf_bm Value: JUSr9Bg7ITxQoNzpbCCR4WWWdDOxDjTSTK6PQHuLFaw-1723913809-1.0.1.1-Qau8lOr5ZVcj93AOXecbnX37PWI1YvMGJTFKLImkRzfupI6WqsTthzME3LFtnnr9yAyKUMuINg13xakP7TpGRg
.workingadvantage.com/	1969-12-31 23:59:59	Name: _cfuvid Value: i94gtQdeCeNDQCzr5JN0fQQLlLgf_HpUh3JNWfLOo4w-1723913809186-0.0.1.1-604800000
.workingadvantage.com/	1970-01-20 22:53:20	Name: _gid Value: GA1.2.1797749102.1723913810
.workingadvantage.com/	1970-01-20 22:51:53	Name: _gat_UA-2876877-9 Value: 1
.workingadvantage.com/	1970-01-21 07:37:29	Name: cf_clearance Value: .PkkULynQDxzI46HslzAMzRYt2.KXtmus5Jyv5j0Qrk-1723913809-1.2.1.1-BGngnZESpyhh3shD5pbZY9_t8Kj3tbfxYHA4FHBXxBQMROWyDObXVGTATQW6s1J0K9BvMjViZ0Tfr0K0RLnvW52fifQyK1kS0cVXbQwLWp_a7RcmOPalgu9WFOugtTULHRRJPyvBVC_NxcMvQ7j5zDDwSmandrft00vvL9lLf7qOERXGLpXfCKJ.Gvi3IuHr8i9qi4iSE0SCEf5Qqt080UT5_w4B6L5CC8HTVjZrrLY4ZHolcFhbXhBVsb79nudjnJD2dRQzpoirLiaQ3ST5EyXS0Mc0oSA9cLKingTU6KP.Yjqq5Lt4JC6j0sV77qUnb5Sd9bzZHSBAYYaF6JpawOJOSXklUDgMiLL522p1wzRpI5gbAAmABYj7zwGdV8mL
.beneplace.com/	1970-01-20 22:51:55	Name: __cf_bm Value: _5RXigzxRzWSvWo5gjY_4VTRtQbC1aJ.o7lGEV.L.ig-1723913810-1.0.1.1-uPwCt1yF0HeTBNjBxmXpKCsznKYyBYvVwj3NZcuploPIVKxMToBQwDsM3YCd2pzcBT30Ytn8tuW.xAnSyCo4jw
.beneplace.com/	1969-12-31 23:59:59	Name: _cfuvid Value: h9WeajCIjhjvZugFYiUCRiu.aoHT..Yqek1H8Sq3A9o-1723913810419-0.0.1.1-604800000
.savings.workingadvantage.com/	1970-01-21 08:27:53	Name: split_test_groups Value: {}
.workingadvantage.com/	1970-01-21 08:27:53	Name: _ga Value: GA1.2.2061865136.1723913810
.workingadvantage.com/	1970-01-21 08:27:53	Name: _ga_2K753Z6D0L Value: GS1.2.1723913809.1.1.1723913812.0.0.0
.workingadvantage.com/	1970-01-21 07:37:29	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Sat+Aug+17+2024+18%3A56%3A53+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=202403.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=e7da88f2-1eab-44ff-883e-caed384b5d28&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Fauth.savings.workingadvantage.com%2Flexmark%2Fsign-in%3Fresponse_type%3Dcode%26client_id%3D9ezalirn45mF43imJTdf53%26utm_source%3Demail%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace%26redirect_uri%3Dhttps%3A%252F%252Flexmark.savings.workingadvantage.com%252Fhome%253FDLK%253Dc26apwfd6bkby9quyo186lnl9%2526utm_medium%253DJuly-22-2024-TrueCar-Remainder%2526utm_source%253Demail%2526conv_source%253Dzeta%2526utm_campaign%253Dhome-link-marketplace%2526utm_content%253Dhome-link-marketplace&groups=C0001%3A1%2CID007%3A0%2CC0003%3A0%2CC0002%3A0%2CGRP01%3A0%2CC0005%3A0%2CC0004%3A0
.workingadvantage.com/	1970-01-21 08:27:53	Name: _ga_FD2X5ZMELR Value: GS1.1.1723913809.1.1.1723913813.0.0.0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lexmark.savings.workingadvantage.com/api/known/dlk-compare?guid=c26apwfd6bkby9quyo186lnl9 Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://auth.savings.workingadvantage.com/lexmark/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&utm_source=email&utm_medium=July-22-2024-TrueCar-Remainder&utm_campaign=home-link-marketplace&utm_content=home-link-marketplace&redirect_uri=https%3A%2F%2Flexmark.savings.workingadvantage.com%2Fhome%3F%26utm_medium%3DJuly-22-2024-TrueCar-Remainder%26utm_source%3Demail%26conv_source%3Dzeta%26utm_campaign%3Dhome-link-marketplace%26utm_content%3Dhome-link-marketplace&auth_login=true Message: Failed to load resource: the server responded with a status of 429 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com challenges.cloudflare.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=5184000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
auth.savings.workingadvantage.com
bam.nr-data.net
cdn.cookielaw.org
cdn.jsdelivr.net
cdnjs.cloudflare.com
challenges.cloudflare.com
controlpanel.savings.beneplace.com
e.email.workingadvantage.com
fonts.gstatic.com
geolocation.onetrust.com
js-agent.newrelic.com
lexmark.savings.beneplace.com
lexmark.savings.workingadvantage.com
maps.googleapis.com
region1.google-analytics.com
www.google-analytics.com
www.googletagmanager.com
bam.nr-data.net
cdn.cookielaw.org
region1.google-analytics.com
104.17.25.14
104.18.16.216
104.18.6.126
104.18.94.41
104.18.95.41
142.250.184.238
162.247.243.29
172.217.16.202
172.217.18.104
2001:4860:4802:32::36
216.239.34.36
2602:816:5001::39
2606:4700::6812:1c7f
2606:4700::6812:572a
2606:4700::6812:ba1f
2a00:1450:4001:808::200a
2a00:1450:4001:809::200e
2a00:1450:4001:80e::2008
2a00:1450:4001:82a::2003
2a02:26f0:480:f9d::1e80
96.47.20.26
003cb3efad9c745c2a6b2771e6c4543c54063a0fead3e7f83cd9d4eb08cd0ebb
05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9
0beb218aea930a266def597aa1d6bffd8ae05f3d95d6595834695d9468a878db
0c90a145cbde43dfbcf48f14f92fb27a0f5f8de60794fef0d7a4a433bd135808
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
119b3e07743b35015d62b6eedf3e9c6b625587c7c40587541e4653bc29fed6bc
1505aa0792421f831935f4761a95f31462a3dd097c8bd00ad8e9c765c8065517
170287bbbfc14739c9b3aa6ce30abb0669d418f01118028f4b06c198fdbdde1d
1feb6f5d66a86cfca394727a81212e1c81801db5fdeaa6226ede9735357e0fd8
24efa3bd329f51a2dd5864fa6babe5af8c315c737db5e373f5549e6d0f435f27
272b57b0c1521a35d2bc91f5b5c560c69e9dfd19631f60344473fd041236dba3
2c6bfcfb1ba199b8a9cffc09a48ca4e9eaf43d3b71c9dce5cf8c52a702ebe73d
39d1f21353795c7a353b4a74ebb5fbb9df3eb3c7b0920704d2065f324cf4e2d5
462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
518c9f3f942847e26a55587f95e82b811898cae3858de171cea0975b86172a3c
553eb2214968542fc611f924e588fadff8888bb46cfb282a844128ecd37e4b66
58d082577a9afc18c748a82afa2f1804aa3e17b12fb6bbc039a1e3238140bc97
66591acd623449ceebd1141d1a49254c5a824bc966c247d7cf0e6275c487b317
66e1743db2ebf35df542d5426deacd3e99faa65b8e95711c1d7f5377475d7a5c
779700103eaa215226d17491070dd24cc4e6ae6533a0f3a4071140805119b45f
7c378a64a8916499372b3021c07797d63fc3914efd9ec6ab15ba69e6fc5c1efd
7d21d864eb3e2d7b49a318f9166bfc4ed33f96f0b2ada41bf97012effc623faa
7fc858728287b5149cb2dce3f0e551674926497f5e788a8d5dc6e79b617e24b9
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
889400be70a8ed911d67aa43a14fb97973de76e03724d4c82c002e25a168ecad
9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
943519a4ad4d45d94d110a99540cb4253919e9a47693849d103a5cc988970cf7
a11f52468794280380f389e1e4a1da2db87efc999a1926708f0897159c2f8c83
b017bfb984b00d66e38ede36599b6c5650d3bed3011fc37a6ff5f041b1aa1a8b
bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
c1ef0577267ffcb026254a1a22d23ff6cafa02203c87c1664bc5b7910eaa34d6
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b
cdaf31a1071286676944848c1e53c284a611e39473e322a75caf358b1b24e19d
d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0
d6a3a23feab331acb3f48399a584a8b3946acdd679b7d31fca65933d3bbd7d47
d7599aede8e0a7e897e2b8214aa65dce01123f5ce70b2ab80ec25dcf18bb1938
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e071145bbbc60b61a7e12af9bae3c130ad8dae3baed8cb6857bdf5d4fe4f4746
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e57184b4e84c92b007d75d1adbc288d679bc9a029606786480e513ea0e75181c
e5b328899edaee6d8c3d5012ba69a1a80c5405b60c75ce7e944d8c2ccbb77634
e8b8da9418b0d54acb8fb3a02dd3eba54c080167251cb687ad01036aeca3a310
e9433f83f20500145850d5aabddced402dcfc94e310072e9a3f545df0bdb9f96
f3418640c1204265881221580b9d1554424f6ed49549d408da50c690ab29f400
f63e31ebf9b37ea9651067359238bfd61f6cd7dc7c6c0ea864e6f8c345f8f8b9
f7e09cc0db40e8a2ad3ec28c8b71939dcc7c726e53d28b460abe369d8dfd741a
fc1632a8200468ed5c029f578c9e977251a3ea0e46c2d361d3cfe55487b8f750
fe647cbaa45972daac1e77186c4337c7c4ebbb8b02fea33eea858c8dc00498f3

auth.savings.workingadvantage.com Open in urlscan Pro 104.18.16.216 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

102 Requests

88 %HTTPS

48 %IPv6

13 Domains

18 Subdomains

21 IPs

3 Countries

2794 kBTransfer

13065 kBSize

12 Cookies

1 Outgoing links

Page URL History

Redirected requests

102 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

auth.savings.workingadvantage.com Open in urlscan Pro
104.18.16.216 Public Scan

Screenshot
Live screenshot

Full Image

102
Requests

88 %
HTTPS

48 %
IPv6

13
Domains

18
Subdomains

21
IPs

3
Countries

2794 kB
Transfer

13065 kB
Size

12
Cookies

102 HTTP transactions
1 data transactions