refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::ac40:9595 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.npvnt7trk.com/4rqsj/79c6g4/?sub2=goldcamp16b
Effective URL:
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&...
Submission: On August 01 via api (August 1st 2024, 8:40:17 am UTC) from US — Scanned from US

Summary HTTP 142 Redirects Links 21 Behaviour Indicators

Summary

This website contacted 45 IPs in 1 countries across 39 domains to perform 142 HTTP transactions. The main IP is 2606:4700:4400::ac40:9595, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 737277.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 22nd 2023. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.36.162.171 34.36.162.171	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 3	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
13	2606:4700:440... 2606:4700:4400::ac40:9595	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.173.219.102 18.173.219.102	16509 (AMAZON-02) (AMAZON-02)
1	3.18.206.181 3.18.206.181	16509 (AMAZON-02) (AMAZON-02)
1	2600:1408:c40... 2600:1408:c400:18e::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	18.164.124.11 18.164.124.11	16509 (AMAZON-02) (AMAZON-02)
9	2606:4700:303... 2606:4700:3036::ac43:b89e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:400d:c02::5f	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	34.199.85.59 34.199.85.59	14618 (AMAZON-AES) (AMAZON-AES)
1	108.139.54.225 108.139.54.225	16509 (AMAZON-02) (AMAZON-02)
15	2607:f8b0:400... 2607:f8b0:400d:c0f::61	15169 (GOOGLE) (GOOGLE)
1	52.70.36.245 52.70.36.245	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.39.248 63.140.39.248	14618 (AMAZON-AES) (AMAZON-AES)
2 4	2606:4700::68... 2606:4700::6812:895	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6 7	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
2 2	209.85.232.154 209.85.232.154	15169 (GOOGLE) (GOOGLE)
1 1	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	68.67.160.132 68.67.160.132	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2607:f8b0:400... 2607:f8b0:400d:c07::65	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c0f::9b	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:400d:c1d::5e	15169 (GOOGLE) (GOOGLE)
2	54.88.63.116 54.88.63.116	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.38.236 63.140.38.236	14618 (AMAZON-AES) (AMAZON-AES)
1	108.139.29.79 108.139.29.79	16509 (AMAZON-02) (AMAZON-02)
2	2600:1408:c40... 2600:1408:c400:396::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f00... 2a03:2880:f003:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	15.204.44.77 15.204.44.77	16276 (OVH) (OVH)
1	2600:9000:23c... 2600:9000:23cb:9400:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	209.85.144.156 209.85.144.156	15169 (GOOGLE) (GOOGLE)
10	151.101.129.44 151.101.129.44	54113 (FASTLY) (FASTLY)
1	3.163.245.4 3.163.245.4	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:251... 2600:9000:2514:7800:a:8e7d:9900:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2606:4700:1::... 2606:4700:1::6813:824c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	35.211.178.172 35.211.178.172	15169 (GOOGLE) (GOOGLE)
1 1	104.36.113.107 104.36.113.107	62713 (AS-PUBMATIC) (AS-PUBMATIC)
12	2607:f8b0:400... 2607:f8b0:400d:c07::9b	15169 (GOOGLE) (GOOGLE)
9	2a04:4e42::300 2a04:4e42::300	54113 (FASTLY) (FASTLY)
2	3.227.141.85 3.227.141.85	14618 (AMAZON-AES) (AMAZON-AES)
4	35.190.43.134 35.190.43.134	15169 (GOOGLE) (GOOGLE)
1 1	2600:1f18:730... 2600:1f18:730:b110:ba1c:c150:99a8:df4b	14618 (AMAZON-AES) (AMAZON-AES)
1	34.202.182.84 34.202.182.84	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f10... 2a03:2880:f103:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	147.135.104.198 147.135.104.198	16276 (OVH) (OVH)
4	23.220.128.196 23.220.128.196	16625 (AKAMAI-AS) (AKAMAI-AS)
12	2607:f8b0:400... 2607:f8b0:400d:c1d::69	15169 (GOOGLE) (GOOGLE)
1	2600:1901:0:7... 2600:1901:0:7628::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	35.169.136.249 35.169.136.249	14618 (AMAZON-AES) (AMAZON-AES)
142	45

1 34.36.162.171 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 171.162.36.34.bc.googleusercontent.com

www.npvnt7trk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.76.131 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2606:4700:4400::ac40:9595 (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.219.102 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-219-102.jfk52.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.18.206.181 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-18-206-181.us-east-2.compute.amazonaws.com

cs-cdn.deviceatlas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1408:c400:18e::1e80 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.164.124.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-124-11.jfk50.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:3036::ac43:b89e (United States)

ASN13335 (CLOUDFLARENET, US)

fonts.cdnfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c02::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.199.85.59 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-199-85-59.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.54.225 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-54-225.jfk50.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2607:f8b0:400d:c0f::61 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.70.36.245 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-70-36-245.compute-1.amazonaws.com

quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.39.248 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-39-248.data.adobedc.net

somni.rocketmortgage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:895 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

action.dstillery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
action.media6degrees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 35.71.131.137 (United States) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.85.232.154 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: qt-in-f154.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.132 (Colonia, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.64.151.101 (San Francisco, United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:400d:c07::65 (Morganton, United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c0f::9b (Morganton, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c1d::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.88.63.116 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-88-63-116.compute-1.amazonaws.com

script.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.38.236 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-236.data.adobedc.net

adobedc.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.29.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-79.jfk50.r.cloudfront.net

ads.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1408:c400:396::1931 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:100:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.204.44.77 (Hillsboro, United States)

ASN16276 (OVH, FR)
PTR: ext.sor136.incmdb.net

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23cb:9400:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.85.144.156 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: qv-in-f156.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.129.44 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.163.245.4 (United States)

ASN16509 (AMAZON-02, US)

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2514:7800:a:8e7d:9900:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.pmsrv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:1::6813:824c (United States)

ASN13335 (CLOUDFLARENET, US)

a.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.211.178.172 (North Charleston, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.36.113.107 (United States) 1 redirects

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2607:f8b0:400d:c07::9b (Morganton, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a04:4e42::300 (United States)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.227.141.85 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-141-85.compute-1.amazonaws.com

psp.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.190.43.134 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 134.43.190.35.bc.googleusercontent.com

tr.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b110:ba1c:c150:99a8:df4b (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.202.182.84 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-182-84.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f103:181:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 147.135.104.198 (Hillsboro, United States)

ASN16276 (OVH, FR)
PTR: ns106987.ip-147-135-104.us

pix.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.220.128.196 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-220-128-196.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2607:f8b0:400d:c1d::69 (Morganton, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:7628:: (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

tr6.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.169.136.249 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-169-136-249.compute-1.amazonaws.com

trc.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 1198 trc.taboola.com — Cisco Umbrella Rank: 1123	24 KB
15	google.com analytics.google.com — Cisco Umbrella Rank: 238 www.google.com — Cisco Umbrella Rank: 10	1 KB
15	doubleclick.net 2 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 363 stats.g.doubleclick.net — Cisco Umbrella Rank: 252 googleads.g.doubleclick.net — Cisco Umbrella Rank: 77	21 KB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	1 MB
13	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 737277 static-msql-prod.refinance.quickenloans.com — Cisco Umbrella Rank: 979756 trackpixel.refinance.quickenloans.com content.refinance.quickenloans.com cdn.mortgage.quickenloans.com Failed	374 KB
9	cdnfonts.com fonts.cdnfonts.com — Cisco Umbrella Rank: 9520	186 KB
7	adsrvr.org 6 redirects insight.adsrvr.org — Cisco Umbrella Rank: 1486 match.adsrvr.org — Cisco Umbrella Rank: 505	5 KB
6	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 7428 psp.pushnami.com — Cisco Umbrella Rank: 30686 trc.pushnami.com — Cisco Umbrella Rank: 7212	19 KB
5	snapchat.com tr.snapchat.com — Cisco Umbrella Rank: 1202 tr6.snapchat.com — Cisco Umbrella Rank: 1340	640 B
4	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 1235	4 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 319 quicken.demdex.net — Cisco Umbrella Rank: 158178 adobedc.demdex.net — Cisco Umbrella Rank: 9446	3 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	3 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 534	15 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 4784 rp.liadm.com — Cisco Umbrella Rank: 1645 rp4.liadm.com — Cisco Umbrella Rank: 4911	37 KB
3	revjet.com ads.revjet.com — Cisco Umbrella Rank: 9159 pix.revjet.com — Cisco Umbrella Rank: 8879	9 KB
3	anura.io script.anura.io — Cisco Umbrella Rank: 64799 ads.anura.io — Cisco Umbrella Rank: 79849	25 KB
3	lmbahsj2.com 1 redirects www.lmbahsj2.com	20 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 108	3 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 499	1 KB
2	mgid.com a.mgid.com — Cisco Umbrella Rank: 11382	6 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 236	72 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 1417	25 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 1102	1 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 383	2 KB
2	media6degrees.com action.media6degrees.com — Cisco Umbrella Rank: 16532	955 B
2	dstillery.com 2 redirects action.dstillery.com — Cisco Umbrella Rank: 12871	996 B
1	pubmatic.com 1 redirects simage2.pubmatic.com — Cisco Umbrella Rank: 1358	528 B
1	pmsrv.co c.pmsrv.co — Cisco Umbrella Rank: 131128	4 KB
1	sc-static.net sc-static.net — Cisco Umbrella Rank: 1413	21 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 176	21 KB
1	gstatic.com fonts.gstatic.com	33 KB
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 555	2 KB
1	rocketmortgage.com somni.rocketmortgage.com — Cisco Umbrella Rank: 192547	470 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 2536	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1223	7 KB
1	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 521	81 KB
1	deviceatlas.com cs-cdn.deviceatlas.com — Cisco Umbrella Rank: 147009	22 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 7072	7 KB
1	npvnt7trk.com 1 redirects www.npvnt7trk.com	615 B
142	39

	Domain	Requested by
18	trc.taboola.com	cdn.taboola.com
15	www.googletagmanager.com	refinance.quickenloans.com www.googletagmanager.com trackpixel.refinance.quickenloans.com
12	www.google.com
12	googleads.g.doubleclick.net	www.googletagmanager.com
9	fonts.cdnfonts.com	static-msql-prod.refinance.quickenloans.com fonts.cdnfonts.com client
5	match.adsrvr.org	4 redirects
5	refinance.quickenloans.com	www.datadoghq-browser-agent.com
4	ct.pinterest.com	s.pinimg.com
4	tr.snapchat.com	sc-static.net
4	content.refinance.quickenloans.com	refinance.quickenloans.com static-msql-prod.refinance.quickenloans.com
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
3	bat.bing.com	refinance.quickenloans.com bat.bing.com
3	analytics.google.com	www.datadoghq-browser-agent.com
3	www.lmbahsj2.com	1 redirects trackpixel.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	trc.pushnami.com	www.datadoghq-browser-agent.com
2	pix.revjet.com	ads.revjet.com
2	www.facebook.com
2	psp.pushnami.com	www.datadoghq-browser-agent.com
2	x.bidswitch.net	2 redirects
2	a.mgid.com	refinance.quickenloans.com
2	connect.facebook.net	refinance.quickenloans.com connect.facebook.net
2	s.pinimg.com	refinance.quickenloans.com s.pinimg.com
2	script.anura.io	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	dsum-sec.casalemedia.com	1 redirects refinance.quickenloans.com
2	ib.adnxs.com	2 redirects
2	cm.g.doubleclick.net	2 redirects
2	insight.adsrvr.org	2 redirects
2	action.media6degrees.com	refinance.quickenloans.com
2	action.dstillery.com	2 redirects
2	dpm.demdex.net	1 redirects refinance.quickenloans.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
1	tr6.snapchat.com	sc-static.net
1	rp4.liadm.com
1	rp.liadm.com	1 redirects
1	simage2.pubmatic.com	1 redirects
1	c.pmsrv.co	trackpixel.refinance.quickenloans.com
1	sc-static.net	refinance.quickenloans.com
1	cdn.taboola.com	refinance.quickenloans.com
1	www.googleadservices.com	trackpixel.refinance.quickenloans.com
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	refinance.quickenloans.com
1	ads.anura.io	www.datadoghq-browser-agent.com
1	adobedc.demdex.net	assets.adobedtm.com
1	fonts.gstatic.com	fonts.googleapis.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	pixel.rubiconproject.com	1 redirects
1	somni.rocketmortgage.com	assets.adobedtm.com
1	quicken.demdex.net	assets.adobedtm.com
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	assets.adobedtm.com	refinance.quickenloans.com
1	cs-cdn.deviceatlas.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
1	www.npvnt7trk.com	1 redirects
0	cdn.mortgage.quickenloans.com Failed	trackpixel.refinance.quickenloans.com
142	57

This site contains links to these domains. Also see Links.

Domain
www.lowermybills.com
privacyportal-cdn.onetrust.com
www.quickenloans.com
www.quickencompare.com
www.amerisave.com
www.credible.com
www.fhfa.gov
capitalmarkets.fanniemae.com
www.jdpower.com
www.starleafsquare.com
quickenloans.com
www.nmlsconsumeraccess.org

Subject Issuer	Validity	Valid
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2023-12-22` - `2024-12-21`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M03	`2024-01-03` - `2025-01-31`	a year	crt.sh
*.deviceatlas.com Go Daddy Secure Certificate Authority - G2	`2024-03-04` - `2025-04-05`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-09` - `2025-08-09`	a year	crt.sh
*.pushnami.com Amazon RSA 2048 M02	`2024-02-03` - `2025-03-03`	a year	crt.sh
cdnfonts.com WE1	`2024-07-23` - `2024-10-21`	3 months	crt.sh
upload.video.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
cloudflareinsights.com WE1	`2024-07-06` - `2024-10-04`	3 months	crt.sh
*.datadoghq-browser-agent.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-30` - `2025-08-03`	a year	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
somni.rocketmortgage.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-19` - `2025-02-18`	a year	crt.sh
*.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.gstatic.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
script.anura.io Amazon RSA 2048 M03	`2023-10-16` - `2024-11-13`	a year	crt.sh
adobedc.demdex.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-22` - `2024-11-21`	a year	crt.sh
ads.anura.io Amazon RSA 2048 M03	`2024-04-29` - `2025-05-27`	a year	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-30` - `2024-08-07`	9 days	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-05-10` - `2024-08-08`	3 months	crt.sh
*.revjet.com GlobalSign GCC R6 AlphaSSL CA 2023	`2024-03-27` - `2025-04-28`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M03	`2023-12-02` - `2024-12-29`	a year	crt.sh
*.googleadservices.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-30` - `2024-12-31`	5 months	crt.sh
sc-static.net Amazon RSA 2048 M03	`2023-12-21` - `2025-01-18`	a year	crt.sh
pmsrv.co Amazon RSA 2048 M02	`2023-09-16` - `2024-10-14`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2024-03-14` - `2025-04-15`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 04	`2024-06-19` - `2024-12-16`	6 months	crt.sh
mgid.com WE1	`2024-07-07` - `2024-10-05`	3 months	crt.sh
*.snap.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-23` - `2025-07-22`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Frame ID: 1F94667DEEB84B6E839C85C34A6388F8
Requests: 94 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: 7292C6F6028CDAEF84CE3CAF03655AFC
Requests: 1 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: 96B301AEF3A92DA5B83B7B659E2E3BEF
Requests: 33 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: 33ABCFEEE13CD794EF11F8738686B503
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=409e6a74-8d7f-465e-87b0-cc6eb99f3a76&u_scsid=21b3ed45-988c-49ac-8f72-4027e8c3b8e1&u_sclid=68435379-7f7c-4444-a391-69bb92f21e05
Frame ID: FCE02FBA6935EC6231EE3070BA648C80
Requests: 1 HTTP requests in this frame

Frame: https://ct.pinterest.com/ct.html
Frame ID: 68C830ADB672C08FABAB34EB14549C92
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Calculate New Payment - Start Here | Quicken Loans

Page URL History Show full URLs

http://www.npvnt7trk.com/4rqsj/79c6g4/?sub2=goldcamp16b HTTP 307
https://www.npvnt7trk.com/4rqsj/79c6g4/?sub2=goldcamp16b HTTP 302
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=28101854db9b4efb8b7c8ba266dd7cad HTTP 302
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Page Statistics

142
Requests

95 %
HTTPS

43 %
IPv6

39
Domains

57
Subdomains

45
IPs

1
Countries

2391 kB
Transfer

7567 kB
Size

80
Cookies

21 Outgoing links

These are links going to different origins than the main page.

URL: https://www.lowermybills.com/legal/stateprivacy/
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/calculator-refinance
Title: Free Mortgage Payment Calculator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/home-equity-rate-table/
Title: Second Mortgage Payment Calculator

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/calculator-affordability
Title: Home Value Estimator

Search URL Search Domain Scan URL

URL: https://www.quickencompare.com/loans/home-equity-loans/home-equity-loan-amount-calculator/
Title: Free Estimated Home Equity Calculator

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/mortgage-rates
Title: See Today's Rates

Search URL Search Domain Scan URL

URL: https://www.amerisave.com/rates/
Title: Rates

Search URL Search Domain Scan URL

URL: https://www.amerisave.com/loan-programs/cash-out-refinance/
Title: here

Search URL Search Domain Scan URL

URL: https://www.credible.com/personal-loan-prequalification
Title: Rates shown

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: https://capitalmarkets.fanniemae.com/media/20371/display
Title: https://capitalmarkets.fanniemae.com/media/20371/display

Search URL Search Domain Scan URL

URL: https://www.jdpower.com/
Title: jdpower.com

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/privacy-policy/
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/state-privacy/
Title: State Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/disclosures-licenses/
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://www.quickenloans.com/legal/ad-targeting/
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://www.starleafsquare.com/o-nrpx-d41-18fc5e526fb936daac7301f127413de5
Title: Unsubscribe

Search URL Search Domain Scan URL

URL: https://quickenloans.com/
Title: QuickenLoans.com

Search URL Search Domain Scan URL

URL: http://www.nmlsconsumeraccess.org/
Title: www.nmlsconsumeraccess.org

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.npvnt7trk.com/4rqsj/79c6g4/?sub2=goldcamp16b HTTP 307
https://www.npvnt7trk.com/4rqsj/79c6g4/?sub2=goldcamp16b HTTP 302
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=28101854db9b4efb8b7c8ba266dd7cad HTTP 302
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1722501609329 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1722501609329

Request Chain 21

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId] HTTP 302
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]

Request Chain 22

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:4ld0kml&fmt=3 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZjhiMzhkMjItN2M1My00NGY1LTg2OTMtMTBiMjM2ODZkNDQ2&gdpr=0&gdpr_consent=&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23686d446 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=ZjhiMzhkMjItN2M1My00NGY1LTg2OTMtMTBiMjM2ODZkNDQ2&gdpr=0&gdpr_consent=&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23686d446&google_tc= HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23686d446&google_gid=CAESEG3F-lGLeeT8ZlqeQ0TMeQs&google_cver=1 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f8b38d22-7c53-44f5-8693-10b23686d446&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23686d446 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3Df8b38d22-7c53-44f5-8693-10b23686d446 HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=322558327468909658&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23686d446 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expiration=1725093610&gdpr=0&gdpr_consent= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expiration=1725093610&gdpr=0&gdpr_consent=&C=1

Request Chain 58

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId= HTTP 302
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=

Request Chain 69

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:3ohu1zr&fmt=3 HTTP 302
https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch HTTP 302
https://x.bidswitch.net/ul_cb/syncd?dsp_id=93&user_group=1&user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=f8b38d22-7c53-44f5-8693-10b23686d446&r=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dpubmatic HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic

Request Chain 97

https://rp.liadm.com/j?dtstmp=1722501612625&aid=a-06d7&se=e30&duid=ddc3c751f117--01j46hhghefwxhgdtz9v8z7x0e&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&wpn=lc-bundle&cd=.quickenloans.com HTTP 302
https://rp4.liadm.com/j?dtstmp=1722501612625&aid=a-06d7&se=e30&duid=ddc3c751f117--01j46hhghefwxhgdtz9v8z7x0e&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&wpn=lc-bundle&cd=.quickenloans.com&i6=MmEwZDo1NjAwOjI0OjE1MDA6MTAxMTo1ZjY4Ojg1NjU6ZDAwNw%3D%3D&n3pc=true

142 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
refinance.quickenloans.com/
Redirect Chain

http://www.npvnt7trk.com/4rqsj/79c6g4/?sub2=goldcamp16b
https://www.npvnt7trk.com/4rqsj/79c6g4/?sub2=goldcamp16b
https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=28101854db9b4efb8b7c8ba266dd7cad
https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&aff...

113 KB
24 KB

666ms
537ms

Document
text/html

2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

96c6a879728eb34cc7530ac66b53761a7f4058b273498992288cb5a5ec92f775

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8ac4858a49564267-EWR
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Thu, 01 Aug 2024 08:40:08 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

Redirect headers

accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 388
content-type: text/html; charset=utf-8
date: Thu, 01 Aug 2024 08:40:07 GMT
location: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
server: nginx
vary: Origin
via: 1.1 google
x-eflow-request-id: ce0610eb-5623-49aa-a4df-38ef404385c7

GET
H2 200 main.295c0579d8f2b006f5d8.css
static-msql-prod.refinance.quickenloans.com/ 402 KB
49 KB 115ms
35ms Stylesheet
text/css 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04550338ea0fa27b014ce834bae7d1b6c53dedbcb8366fc1687d3d4d1622c262

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:08 GMT
x-amz-version-id: VoGRJa_i0HkW5N7u8g8ZTjafGIulUwYg
via: 1.1 ed0934ec01ea9cc7d841313a8f4658f0.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: BOS50-P4
age: 418
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 23 Jul 2024 04:27:12 GMT
server: cloudflare
etag: W/"e426722650d987bd540b9188d7a38460"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 8ac4858e6f3a4217-EWR
x-amz-cf-id: 3EGQ50tVpZYb2pU4krju92ajdpEWoBZ8fIXRD5Qz0okfRcfTtBtEsA==
expires: Thu, 01 Aug 2024 12:40:08 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 21 KB
7 KB 58ms
8ms Script
application/x-javascript 18.173.219.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.173.219.102 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-173-219-102.jfk52.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 06:57:50 GMT
content-encoding: gzip
via: 1.1 a3cc1cfce2f0f18de36e3834e18556b8.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-cf-pop: JFK52-P1
age: 6138
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6759
x-xss-protection: 1; mode=block
last-modified: Thu, 26 Oct 2023 12:27:20 GMT
server: AmazonS3
etag: "15864ce88fa79a3e954417d0c3396798"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: mpRSEhuGTp9PVJnXrbUTHhin3p48dc-l0NEoTU_XLJGPWzbtzTeuVQ==

GET
H2 200 dacs.js Show response
cs-cdn.deviceatlas.com/ 21 KB
22 KB 459ms
44ms Script
application/javascript 3.18.206.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cs-cdn.deviceatlas.com/dacs.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

3.18.206.181 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-18-206-181.us-east-2.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

145029bd46ef6268a3683431599d1cc5e9b0153c2c5bf840f931e78da99ee2a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 24 Jan 2024 11:56:56 GMT
server: nginx/1.17.9
accept-ch: DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data
etag: "cfe6e4ceafbea9f6e6c1edad91770ce9"
x-cache: HIT
content-type: application/javascript
cache-control: no-cache
accept-ranges: bytes
content-length: 21896
expires: Thu, 01 Aug 2024 08:40:08 GMT

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
918 B 102ms
26ms Script
application/javascript 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a760071de574910b7f9d8d897a11a4027f41b5724ee2ac0a98eb6f4267e83438

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-6538859d8502035f0edc.js
date: Thu, 01 Aug 2024 08:40:08 GMT
via: 1.1 4a1ea8b67dc2325b2469ed51d3e186ac.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P2
age: 265
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 15 Jul 2024 20:50:53 GMT
server: cloudflare
etag: W/"57c24d6179ba06572b6aaa8f10a17c8b"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8ac4858e6cdb5e7d-EWR
x-amz-cf-id: 3zr-LnD-SQy6V0t70M1MtOHDSi8xnPknIgWU3z4IzIuICyaIGnydKw==
expires: Thu, 01 Aug 2024 12:40:08 GMT

GET
H2 200 launch-099982a746cc.min.js Show response
assets.adobedtm.com/b14636b10888/a3ec7ef1f366/ 257 KB
81 KB 129ms
13ms Script
application/x-javascript 2600:1408:c400:18e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:18e::1e80 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:08 GMT
content-encoding: gzip
last-modified: Mon, 02 Oct 2023 19:55:09 GMT
server: AkamaiNetStorage
etag: "b31a1f9e9f88d2133e2b3a9abeeddcd7:1696276509.604687"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 82392
expires: Thu, 01 Aug 2024 09:40:08 GMT

GET
H2 200 5fa1b4cbe02a560012bcbdf7 Show response
api.pushnami.com/scripts/v1/push/ 92 KB
19 KB 108ms
10ms Script
application/javascript 18.164.124.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/5fa1b4cbe02a560012bcbdf7
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.124.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-124-11.jfk50.r.cloudfront.net
Software: /
Resource Hash: 71ca1526b583a6283752d155fada0ed1a64f1ea43cf17d88f4d39cfc315cc7d9

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:38:53 GMT
content-encoding: gzip
via: 1.1 730892e4ac77b2223b5a9c9e3efa1152.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P7
age: 76
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: kIb_c3OuFUiKbAJlesP5buQg2WochFnzOaupBF0qxWK7fWs3mFrO8Q==

GET
H3 200 stack-ssi
fonts.cdnfonts.com/css/ 1 KB
739 B 85ms
20ms Stylesheet
text/css 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/stack-ssi
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76b65310895e8341f3804e1f3d436a0910928874964daf20f6e2d7a8a69553f4

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2771813
cf-polished: origSize=1385
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Sun, 30 Jun 2024 06:43:15 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=05elN%2BzDjXi5g12Ps8%2Ft3Ayd%2FjG%2BN0eSUA1ln%2FTE59NPXfH2LU7WGY9MJxZYNAPWEjX%2Fxp9L9ZZE7cJgOqC5DuF6o4rwNyzD%2BO5xdf9SCHCTxjrsyPltgbOeCKfzQigoRMI0nFi1ls1g4UWqGBQjE00%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 8ac4858f1d7d7271-EWR

GET
H3 200 myriad-pro
fonts.cdnfonts.com/css/ 2 KB
730 B 90ms
24ms Stylesheet
text/css 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/myriad-pro
Requested by: Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ebc3cd1d0af023685181ad52ed67b334bad44ea95407db09b40c2de15fcc165

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 12157611
cf-polished: origSize=2010
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 13 Mar 2024 15:33:17 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A92cpLymYoWWRGWY4examtGAUlgmX3LjJHR6U7ExRrK5lctfIHT7%2BSJfZtmQOCBidG020nOLcTWWgyVBhx4wSToaenNWFZpdh%2F8X2yCgXjI4Mm2XmQiXIjauTBnJN9c%2FQOvgz7Iibj6SL0MtFyiku%2BA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 8ac4858f1d817271-EWR

GET
H2 200 css2
fonts.googleapis.com/ 875 B
500 B 115ms
66ms Stylesheet
text/css 2607:f8b0:400d:c02::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c02::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4d2816f1f714364675a3a4ff25db96f2a5677b6cce94e150e61250bfdde4d258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Aug 2024 08:40:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 08:35:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Aug 2024 08:40:08 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
778 B 112ms
63ms Stylesheet
text/css 2607:f8b0:400d:c02::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c02::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

971b2673f92ee01c1b6e98372fdefdd4f0a83714167783eba0671fa0d966f9f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Aug 2024 08:40:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 08:40:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Aug 2024 08:40:08 GMT

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
1 KB 79ms
30ms Stylesheet
text/css 2607:f8b0:400d:c02::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c02::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fef95b324850099ff32808fb88cbf0af034d69cc4558110ea65e3b323fc17d0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Aug 2024 08:40:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 08:40:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Aug 2024 08:40:08 GMT

GET
H2 200 css2
fonts.googleapis.com/ 427 B
376 B 113ms
65ms Stylesheet
text/css 2607:f8b0:400d:c02::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c02::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Aug 2024 08:40:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 08:40:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Aug 2024 08:40:08 GMT

GET
H2 200 main.295c0579d8f2b006f5d8.js Show response
static-msql-prod.refinance.quickenloans.com/ 1 MB
246 KB 29ms
28ms Script
application/javascript 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ae904f99709154ef6b0806efa4f5e7d1f123c251152048fe67b995d4c2a519b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:08 GMT
x-amz-version-id: 2m7JSXz558BmNXNfWMOMm.U4m8koFSkT
via: 1.1 d0e1eddb352a668abc455b46657c9df8.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: BOS50-P4
age: 445
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 23 Jul 2024 04:27:12 GMT
server: cloudflare
etag: W/"6ca984ac5094c7b1037824e798301d63"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8ac4858f3fcd4217-EWR
x-amz-cf-id: snm37eR_mcNBGbpm7UyyP11BddjIoPyq5SOYC9TlnqVZYBypoSkrxw==
expires: Thu, 01 Aug 2024 12:40:08 GMT

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 63ms
35ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
server: cloudflare
etag: W/"2024.6.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8ac48590bf584239-EWR

GET
H2 200 pixel-6538859d8502035f0edc.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 191 KB
24 KB 23ms
21ms Script
application/javascript 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91fbc5ef95019e78b753b40035db36fff0944a684a9c6b379f3a708742ce376c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
content-encoding: gzip
via: 1.1 bd3e3884ce6fe1fd36336541cce9ec7e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P2
age: 5765
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 15 Jul 2024 20:20:43 GMT
server: cloudflare
etag: W/"5e7748e0cafd4baeedc276507619c916"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8ac48591cfc85e7d-EWR
x-amz-cf-id: 95QytghIMnic4NTlQziYkQthL6wQwawNGEKyAQejq9ItW4gk3iJJow==
expires: Thu, 01 Aug 2024 12:40:09 GMT

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1722501609329
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1722501609329

609 B
1 KB

18ms
18ms

XHR
application/json

34.199.85.59
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1722501609329

Requested by

Protocol

Server

34.199.85.59 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-199-85-59.compute-1.amazonaws.com

Software

Resource Hash

3e39730ce0162fca499ed41db299944e95ddc11e6ce0cdebab5a77f503c0bb44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

dcs: dcs-prod-va6-1-v062-0096e5f67.edge-va6.demdex.com 2 ms
pragma: no-cache
date: Thu, 01 Aug 2024 08:40:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: yXLwKJlbTXQ=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 444
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-va6-2-v062-003c5833c.edge-va6.demdex.com 0 ms
pragma: no-cache
date: Thu, 01 Aug 2024 08:40:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: /uEqgujfTvk=
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1722501609329
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 95ms
11ms Script
application/javascript 108.139.54.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.54.225 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-54-225.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:39:32 GMT
content-encoding: br
via: 1.1 4d3480855260c7e16c3a1df3eafacee6.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P1
age: 38
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: J-8yc4RJeBR07js3VnaVaboSjqFmwLrc4TwiWqtLV_Ppa7euGE2Jzg==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 282 KB
96 KB 84ms
33ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7e2a43755b059701fb71d85865b49ba7b820fcf7992ac872759b39deb4510329

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 98013
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:09 GMT

GET
H2 200 dest5.html
quicken.demdex.net/ Frame 7292 0
0 128ms
13ms Document
text/html 52.70.36.245
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.70.36.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-70-36-245.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 01 Aug 2024 08:40:09 GMT
dcs: dcs-prod-va6-2-v062-087e34e81.edge-va6.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 18 Jul 2024 10:29:20 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: +kyzKRt7TzI=

GET
H2 200 id Show response
somni.rocketmortgage.com/ 48 B
470 B 149ms
22ms XHR
application/x-javascript 63.140.39.248
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.rocketmortgage.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=63776234351305717241014217055262637781&ts=1722501609454

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.39.248 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-39-248.data.adobedc.net

Software

jag /

Resource Hash

dffe0e2e7fb07ab2d5364148df80e97e6c8b92b91d717b62f8be16a1bab37757

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 318 KB
104 KB 33ms
31ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a43cb5fd157cbb53c4d8bb46f719096c0eff6c917e5c208a7a9cee4cde5aac43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 106192
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 01 Aug 2024 08:40:09 GMT

GET
H2

200

nsjs Show response
action.media6degrees.com/orbserv/
Redirect Chain

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]

5 B
609 B

49ms
46ms

Script
text/html

2606:4700::6812:895
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Server: 2606:4700::6812:895 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:09 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=ISO-8859-1
content-language: en-US
access-control-allow-origin: *
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
cf-ray: 8ac48594e8181869-EWR

Redirect headers

location: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=sitewide&ncv=66&dstOrderId=[OrderId]
access-control-allow-origin: *
date: Thu, 01 Aug 2024 08:40:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ac48594afff1869-EWR
content-type: text/html; charset=iso-8859-1

GET
H2

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:4ld0kml&fmt=3
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZjhiMzhkMjItN2M1My00NGY1LTg2OTMtMTBiMjM2ODZkNDQ2&gdpr=0&gdpr_consent=&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23...
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm=&google_sc=&google_hm=ZjhiMzhkMjItN2M1My00NGY1LTg2OTMtMTBiMjM2ODZkNDQ2&gdpr=0&gdpr_consent=&ttd_tdid=f8b38d22-7c53-44f5-8693-10b...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23686d446&google_gid=CAESEG3F-lGLeeT8ZlqeQ0TMeQs&google_cver=1
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=f8b38d22-7c53-44f5-8693-10b23686d446&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23686d446
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3Df8b38d22-7c53-44f5-8693-10b23686d446
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=322558327468909658&ttd_tdid=f8b38d22-7c53-44f5-8693-10b23686d446
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expiration=1725093610&gdpr=0&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expiration=1725093610&gdpr=0&gdpr_consent=&C=1

43 B
335 B

23ms
22ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expiration=1725093610&gdpr=0&gdpr_consent=&C=1
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gO5sVj322T8ic3qFddpCOOz%2BnkXMkPcDKsSibQg4r9HftOf4Gk%2B9O8vYPolSK7FYmDr77KfPzMoV0Ff8qalimW3zWPuVhJuoO5rCHqG5Z67R1K3S9fsjJvfAvHDGOFkHytEqMsudxJPJ0g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8ac4859dacd07c9c-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:11 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5yVbg4bk26QKtZaFZh4TSyj%2F2mAip%2F0YyI459bOd%2FdZon%2BGCIJn5zOsNyzDVCu1CU40EkkVCftTFEmOfcn2P9y9Idd78beRMcWAtnGkF9llXk2KqVkHE%2BCTM46hdQeSZwbVEBxRgx0dsJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=39&external_user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expiration=1725093610&gdpr=0&gdpr_consent=&C=1
cache-control: no-cache
cf-ray: 8ac4859d7cb97c9c-EWR
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 5 KB
4 KB 197ms
195ms XHR
application/json 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

28bb3e785d321d6894a00d87bb527924a07fe94407a2d1051b8d04fd1c42455b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Authorization: Bearer null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"1552-7S9O8i+7tgI9QYVwBa20bah9cNk"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 8ac48593ddee4267-EWR
x-xss-protection: 1; mode=block

POST
H2 204 collect Show response
analytics.google.com/g/ 0
261 B 110ms
24ms Fetch
text/plain 2607:f8b0:400d:c07::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je47v0v9169491831z89137104487za200zb9137104487&_p=1722501609352&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=95250752&cid=1359296134.1722501610&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1722501609&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2057
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c07::65 Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
261 B 92ms
23ms Ping
text/plain 2607:f8b0:400d:c0f::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-RXLL9Z7XBK&cid=1359296134.1722501610&gtm=45je47v0v9169491831z89137104487za200zb9137104487&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0&tag_exp=95250752
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c0f::9b Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect Show response
analytics.google.com/g/ 0
45 B 72ms
25ms Fetch
text/plain 2607:f8b0:400d:c07::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je47v0v9169491831z89137104487za200zb9137104487&_p=1722501609352&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=95250752&cid=1359296134.1722501610&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=2&sid=1722501609&sct=1&seg=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_et=5&tfd=2101
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c07::65 Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
794 B 80ms
24ms Image
image/png 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
via: 1.1 5af2699243b550d789ef9dce0b522ed2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 5382
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Mon, 11 Mar 2024 13:46:57 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8ac48595aacd5e7d-EWR
x-amz-cf-id: woQnwNXNgm6YznUnxf5BCG6_jPC9pwMoa8291mGr3ncF-NqB2MDVUg==
expires: Thu, 01 Aug 2024 12:40:09 GMT

GET
H2 200 ql-logo.svg
content.refinance.quickenloans.com/msql/ 6 KB
3 KB 49ms
26ms Image
image/svg+xml 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/ql-logo.svg

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb57016a52d5e27a1e665601b50d185449b9344b0bb286b65e39441951c38bc9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
via: 1.1 63e5db8fd97232226f8cad7e0eb103f6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: BOS50-P4
age: 2101
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jul 2024 17:48:08 GMT
server: cloudflare
etag: W/"79fff40a65e4aef58a1ccfe7540ddb3a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8ac48595aace5e7d-EWR
x-amz-cf-id: BF0qM06_s15mH7f1qFF8-YfRl5FR9YeH-oyGV9LA1E2l_GNzBvdHfQ==
expires: Thu, 01 Aug 2024 12:40:09 GMT

GET
H2 200 home-icon.png
content.refinance.quickenloans.com/msql/ 499 B
721 B 48ms
25ms Image
image/png 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/home-icon.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64a6e8d00c22b320355dc737581468bfe44b606aecbfe2fc7d2d57ea4c1c2ad8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
via: 1.1 c4d0da6268789cfda9bb5da1f3f8fc58.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 2101
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 499
x-xss-protection: 1; mode=block
last-modified: Wed, 24 Apr 2024 14:40:34 GMT
server: cloudflare
etag: "0b1942df486abf0cbd77b876c966c942"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8ac48595aac95e7d-EWR
x-amz-cf-id: xqEYpIUESDEaM1zEbGi3CKb2EBSVZToClwlnpmOBsMfgfwITXR6rHw==
expires: Thu, 01 Aug 2024 12:40:09 GMT

GET
H3 200 MYRIADPRO-COND.woff
fonts.cdnfonts.com/s/492/ 59 KB
59 KB 44ms
28ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-COND.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55cbdff52a4ce0061ff5347c7003f6086224a8f5b5d7d3afa3feb420ec8585b5

Request headers

Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 8496606
alt-svc: h3=":443"; ma=86400
content-length: 60044
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "ea8c-5d73bbca4b3e7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BFro2mZA2ytAADThuk0D0ToYVEQdVMIQ3r7%2BFxc06t%2FoaeYMBdUSOqyb%2FhXsd7TqzY0uOjWJ7ysz%2B%2BajNO4k34dOWUHH1sgQXmQmc7RIMh1LLKv588SA867GLJyuvyKO3t32jOhkFSStJAcxpcx%2FBbw%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8ac485960d6ec35a-EWR

GET
H3 200 MYRIADPRO-BOLD.woff
fonts.cdnfonts.com/s/492/ 61 KB
62 KB 36ms
22ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLD.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 962f8da44a5e7f4416402f6bc4a7165ab26cef621f6c24cb74f5e8db5fdc5f9e

Request headers

Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7203404
alt-svc: h3=":443"; ma=86400
content-length: 62676
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "f4d4-5d73bbca4afff"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c3zzzLG%2B3MYIMBMZDnmS6%2Be1ZkhClyJs0dTBzBabRBWFCdNiCNBp2%2FZj5rIplaCRsqXZ3MXrf9Pel%2BTu2Cu880TMwPAoyS4M1jhYKCYis3g%2FG2i9HT1lJ%2FHcpVTMGPbBE62lByFV1H2YM3ERpRrH9pE%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8ac485960d6dc35a-EWR

GET
H3 200 MYRIADPRO-SEMIBOLD.woff
fonts.cdnfonts.com/s/492/ 61 KB
61 KB 64ms
50ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-SEMIBOLD.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f6b883d93b2767c0d04efeeeb65ac92a170c1d966fefc635586d233e5f318cc

Request headers

Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7203404
alt-svc: h3=":443"; ma=86400
content-length: 62448
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "f3f0-5d73bbca4b7cf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NuSVywkttJiX3Ki1ThMLa%2B8hz2AktMcY6MA2vJ81UWNaL%2FA6WN9lZkVp77GMh1smAFxZyx5uUjl9J3pEzupTgtEbLHwLBO5SPwQb9fi6vhBM7%2FbTPV1JxC8F91KPSMs0L2okcO1M4HGcvkpz4P4c1AY%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8ac485960d6fc35a-EWR

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
33 KB 254ms
24ms Font
font/woff2 2607:f8b0:400d:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c1d::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 12:13:16 GMT
x-content-type-options: nosniff
age: 592014
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 25 Jul 2025 12:13:16 GMT

GET
H2 200 request.js Show response
script.anura.io/ 70 KB
25 KB 350ms
27ms Script
application/javascript 54.88.63.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/request.js?instance=3439535758&exid=732aad5a-8038-55bc-8b92-429beb2b2135&source=affl_everflow_ql-lre_9_809&campaign=2&441401573053

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.295c0579d8f2b006f5d8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.88.63.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-88-63-116.compute-1.amazonaws.com

Software

nginx /

Resource Hash

71e1de449b1b4c9146707a32498eee2f5751b3ac8a5917ab3d795ceadf0e41d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2 200 down-arrow.png
content.refinance.quickenloans.com/msql/ 333 B
530 B 27ms
26ms Image
image/png 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/down-arrow.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29502f440e5e16b564bbd6922c08e44a959ef72aff8c4e41d9ecb57cb3bc2e06

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
via: 1.1 a1546fc751225809c39b89ba9e8d715c.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: JFK50-P5
age: 2972
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Miss from cloudfront
content-length: 333
x-xss-protection: 1; mode=block
last-modified: Wed, 24 Apr 2024 14:40:34 GMT
server: cloudflare
etag: "b162a14dca2f70ac6f002b415f11d717"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8ac48595daed5e7d-EWR
x-amz-cf-id: WJVTY56nxagkLfnSBxOst_jyIElOQfBofOMJMqs0U53Rr9sqr_jjAQ==
expires: Thu, 01 Aug 2024 12:40:09 GMT

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
133 B 127ms
125ms XHR
text/plain 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 01 Aug 2024 08:40:10 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 8ac48595eef34267-EWR
content-length: 2
x-xss-protection: 1; mode=block

POST
H2 200 interact Show response
adobedc.demdex.net/ee/v1/ 1 KB
1005 B 356ms
41ms Fetch
application/json 63.140.38.236
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://adobedc.demdex.net/ee/v1/interact?configId=b1d8d3c2-1fda-4646-9d8a-484cec8d3f55&requestId=50986d09-cbfb-4673-ab79-2785c7d00d8a

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/b14636b10888/a3ec7ef1f366/launch-099982a746cc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.236 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-236.data.adobedc.net

Software

jag /

Resource Hash

a07888b4c398f688e7d5650efc8fa03b95733acd12492b85ee623bb116ddb708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Thu, 01 Aug 2024 08:40:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: jag
vary: Origin
content-type: application/json;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Retry-After, X-Adobe-Edge, X-Request-ID
x-adobe-edge: VA6;7
access-control-allow-credentials: true
x-konductor: N/A
cache-control: no-cache, no-store, max-age=0, no-transform, private
x-xss-protection: 1; mode=block
x-request-id: 50986d09-cbfb-4673-ab79-2785c7d00d8a

GET
H3 200 myriad-pro
fonts.cdnfonts.com/css/ 2 KB
479 B 17ms
16ms Stylesheet
text/css 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/css/myriad-pro
Requested by: Host: client
URL: about:client
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ebc3cd1d0af023685181ad52ed67b334bad44ea95407db09b40c2de15fcc165

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 12157612
cf-polished: origSize=2010
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 13 Mar 2024 15:33:17 GMT
cf-bgj: minify
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8zumiTFS%2FKp1L8PHZ7Fr0MRKAnLNCvESUUcouEHQ6SRPk2cXZyVWl1AoOhlAzlcZBXaPAdZ1AyHSunul%2BVaK%2F0sbuFTXbsujzMRJMBJaXJKPQfWy9SlQ249h6G5I3GkBOYnkbat0R6MPcLsa5UQbDRA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 8ac48595f9037271-EWR

GET
H3 200 MYRIADPRO-COND.woff
fonts.cdnfonts.com/s/492/ 59 KB
468 B 23ms
17ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-COND.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55cbdff52a4ce0061ff5347c7003f6086224a8f5b5d7d3afa3feb420ec8585b5

Request headers

Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 8496606
alt-svc: h3=":443"; ma=86400
content-length: 60044
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "ea8c-5d73bbca4b3e7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xhQcej4DaiSP%2BduX2Ln3mVzldB76rSFywpH5H9ovdi7NA6m%2FOVpBgaFzr9g6p%2B57zkEb4ah6TXWZeMDX5qQg120G26SYIyRrjd83nY%2BgtQxbfU6W%2BrR3ioQIRPw8LficxheuKIsRBFPeE06bX55L%2BpY%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8ac485964d85c35a-EWR

GET
H3 200 MYRIADPRO-BOLD.woff
fonts.cdnfonts.com/s/492/ 61 KB
467 B 27ms
21ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-BOLD.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 962f8da44a5e7f4416402f6bc4a7165ab26cef621f6c24cb74f5e8db5fdc5f9e

Request headers

Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7203404
alt-svc: h3=":443"; ma=86400
content-length: 62676
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "f4d4-5d73bbca4afff"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R86pSX1phR8cMTFHuKJ9za2lMqHW38CV2nAOjN69kgN%2FaExN%2BA0eH47bqWg451LS%2FoIWZqpjyg2iAJ5IR%2B%2BuJ7ubRcQe5iEIIenKOJgMll8GeYTxhZgd3thSxCxUIbvoIwx3iD6M%2B1R5NisL008ckJE%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8ac485964d83c35a-EWR

GET
H3 200 MYRIADPRO-SEMIBOLD.woff
fonts.cdnfonts.com/s/492/ 61 KB
465 B 18ms
17ms Font
font/woff 2606:4700:3036::ac43:b89e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.cdnfonts.com/s/492/MYRIADPRO-SEMIBOLD.woff
Requested by: Host: fonts.cdnfonts.com
URL: https://fonts.cdnfonts.com/css/myriad-pro
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f6b883d93b2767c0d04efeeeb65ac92a170c1d966fefc635586d233e5f318cc

Request headers

Referer: https://fonts.cdnfonts.com/css/myriad-pro
Origin: https://refinance.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:09 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7203404
alt-svc: h3=":443"; ma=86400
content-length: 62448
last-modified: Sat, 05 Feb 2022 02:00:51 GMT
server: cloudflare
etag: "f3f0-5d73bbca4b7cf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pBYd5u1cppF6EsRGk5bVGMSL3XH%2F9DppWMhK41zvxaW%2BwlqFhw0EicFo2gKMdwnrpgFeVfenUh3KbZDhFU0vfUGb%2BVqpjkpk65MOu1PBDKX3tRZwxQActOl0oBclDXW4v4g%2FTQoaBZi6If4BEdjYVA8%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8ac485966d8ac35a-EWR

GET
H2 200 showads.js Show response
ads.anura.io/ 0
353 B 341ms
10ms XHR
application/javascript 108.139.29.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.anura.io/showads.js?888697267251
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.29.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-29-79.jfk50.r.cloudfront.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 31 Jul 2024 08:47:14 GMT
content-encoding: gzip
via: 1.1 3a80316ee74668c7049eb31054a07168.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: JFK50-P2
age: 85976
vary: Accept-Encoding
x-cache: Hit from cloudfront
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: application/javascript; charset=utf-8
x-amz-cf-id: FZ48jaGcs6-H9-tzTDyhlJT6POKzfUT75yhCXDBUVOIHDfIt6fY2nQ==

POST
H2 200 response.json Show response
script.anura.io/ 141 B
479 B 149ms
97ms XHR
application/json 54.88.63.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/response.json?270996614042

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.88.63.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-88-63-116.compute-1.amazonaws.com

Software

nginx /

Resource Hash

10ee1493f65ab91319c722c59b8e1a4a55f412fde0090099a28bc3dd12505c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
access-control-allow-methods: POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
82 KB 41ms
41ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

664e7f850d51fb786462fbb6138e88648924ce5f8620909ba5b68ed86e33a83a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 83555
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ Frame 96B3 5 KB
2 KB 130ms
19ms Script
application/javascript 2600:1408:c400:396::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:396::1931 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: bc581e601e42cbba8d5ac49ef3d056be95ab802edaa6cf0e9e3325b568c5cd06

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
x-cdn: akamai
etag: "5163e66e3b4356855f8057aaeca66d13"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=7200
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 1880

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 211 KB
76 KB 42ms
41ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6bc18b0601123d29ccebf315d1efea0339607c22b507e684bf8a20726732ff16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77709
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 96B3 224 KB
60 KB 59ms
18ms Script
application/x-javascript 2a03:2880:f003:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

eaa003d85cb77f94fcae98396e583ce01d0c375b57235402c884ef8a792b951e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 01 Aug 2024 08:40:11 GMT
document-policy: force-load-at-top
x-fb-server-load: 29
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58677
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=12, mss=1328, tbw=2804, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: 2YAqhOvHgJBinX9EQ/qQIUGPWhQ2iLbSaHA+KtQgFUwheWOtJp/noqI6PuqRy8yusupfgqZOEn0xbzQBE/bMag==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics Show response
ads.revjet.com/ Frame 96B3 19 KB
8 KB 546ms
82ms Script
application/javascript 15.204.44.77
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 15.204.44.77 Hillsboro, United States, ASN16276 (OVH, FR),
Reverse DNS: ext.sor136.incmdb.net
Software: nginx /
Resource Hash: 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: gzip
last-modified: Thu, 25 May 2023 10:09:28 GMT
server: nginx
etag: W/"646f33d8-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Thu, 01 Aug 2024 08:50:11 GMT

GET
H2 200 a-06d7.min.js Show response
b-code.liadm.com/ Frame 96B3 101 KB
36 KB 126ms
20ms Script
application/javascript 2600:9000:23cb:9400:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:23cb:9400:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 72c1bab19ae1dc60cc73c71c0a8f59777c85913e59e2b4487cd11e70bd928c23

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Wed, 31 Jul 2024 14:24:53 GMT
content-encoding: gzip
via: 1.1 c3fb7b0c0d3cbd002fed2c3d958d111e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P1
age: 65718
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public,max-age=86400
x-amz-cf-id: 7hQTUA0H-H7worNABz3FUi9ZS4ejQ8HCw3EvkrAQjpSFbKy_KWc1ng==

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 57 KB
21 KB 468ms
398ms Script
text/javascript 209.85.144.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.144.156 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

qv-in-f156.1e100.net

Software

cafe /

Resource Hash

49652ad86154be80557ff54bff8ffca4a611acbe4d70bbc174be39e8472de17f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21174
x-xss-protection: 0
server: cafe
etag: 61132669705791137
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 235 KB
84 KB 69ms
68ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cfe2ce3b6696acd7732129aac3b7d0965a9d5e5378807181bd60366af53ff2ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85620
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1390358/ Frame 96B3 70 KB
21 KB 121ms
44ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ed3a08819903124c49a5f15918f258da7de92e465f896373939027cfcc128f2f

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-amz-version-id: gPaogD_gpZZiqxVZArBrUInoMTpbipZ5
content-encoding: gzip
via: 1.1 varnish
date: Thu, 01 Aug 2024 08:40:11 GMT
x-amz-request-id: D41J0MD08ZCB7P3K
age: 36
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: PENDING
fastly-restarts: 1
x-amz-id-2: 7K9u15PTkAHHTf872THwcBdXNKMTbkCYszg3ghEg9WAB4X290ui5EeHFkxRWjhEWV9QgJ5xnK11+Sbp+oFuQmXgGkjwWehRC
x-served-by: cache-lga21982-LGA
content-length: 21483
last-modified: Wed, 31 Jul 2024 17:47:05 GMT
server: AmazonS3
x-timer: S1722501611.266989,VS0,VE28
etag: "0adb89dc843be5a5a12a7ed6ffb52e16"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 75
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 6299

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 235 KB
84 KB 100ms
96ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3882cb94f5c15ad9e7bfaf249ab971b3289591f7c4f78468793dc7fc99c76d4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85572
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
90 KB 56ms
53ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

16c13c95bfb1a406440202c5f0fc03876a3c38b7c61a2021d58a49257649e93b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92066
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 264 KB
91 KB 57ms
53ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11388547050

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3d96e01f4ebdabab6186506d95a252586d8c70817fba7562a1ee59b0f11a71d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92977
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET deviceAtlasLmb.min.js
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame 96B3 0
0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
85 KB 64ms
62ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d07fac71031c18e56501f2088fc28668898b5c4c2fa5e99befcad2923a23ec66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86542
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H2

200

nsjs Show response
action.media6degrees.com/orbserv/
Redirect Chain

https://action.dstillery.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=
https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=

5 B
346 B

52ms
48ms

Script
text/html

2606:4700::6812:895
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=
Protocol: H2
Server: 2606:4700::6812:895 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=ISO-8859-1
content-language: en-US
access-control-allow-origin: *
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
cf-ray: 8ac4859e4c0d1869-EWR

Redirect headers

location: https://action.media6degrees.com/orbserv/nsjs?adv=cl170983716918148&ns=8486&nc=Visited&ncv=66&dstOrderId=
access-control-allow-origin: *
date: Thu, 01 Aug 2024 08:40:11 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8ac4859e0bfa1869-EWR
content-type: text/html; charset=iso-8859-1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
90 KB 61ms
60ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

574ecd9adca6e51d1a61699f3ddce3b7d486dcf3958d2e075888d77d443ab6d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 92070
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
85 KB 67ms
66ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ae4668f7b6dd3e01040152ac401d1c1ad8806f3d9a764036eae4d53ec684a218

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 86556
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 265 KB
91 KB 84ms
84ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11380533681

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f0bb758c1bd7e5b74a11804a30ecc949a151072b8497ec95bd67cbb7aad1544

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93068
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame 96B3 49 KB
21 KB 89ms
37ms Script
application/javascript 3.163.245.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.163.245.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: dc242f2acb69deaa2c17cce616c89430cd666771b2e8303465bbfdc340d39663

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: gzip
via: 1.1 79985f6b7b9f366996e2a85ef814999e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: JFK52-P2
x-cache: Miss from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 21227
x-amz-cf-id: ct-x_7P_8Zd1uZNVVkQSWGKCLKrIF_8CIgr_XsIHWkMZaVfBFKmZsw==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 265 KB
91 KB 84ms
76ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

63c29888acf03229f56580e1e8276d6e336268a6cb24a72f4540ad2da3a6cf3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 93130
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H2 200 src Show response
c.pmsrv.co/v2/conversion/ Frame 96B3 3 KB
4 KB 374ms
171ms Script
text/javascript 2600:9000:2514:7800:a:8e7d:9900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2514:7800:a:8e7d:9900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: / Express
Resource Hash: d8cbc596bdee9ceb0f3b176892acfb59f5535b3ab2f7f3da519a9c59a7389531

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:11 GMT
via: 1.1 c2439c5d69ec72a2ab666c2eba104244.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P8
etag: W/"d6b-5FvrY9MCXV5zpCr/QL4U12UJSL0"
x-powered-by: Express
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
content-length: 3435
x-amz-cf-id: 74xBnhJaIGVxDe_WBBe8mglUfw4BkIDUVG7bodxGLprQZwtmdrYM7A==
expires: -1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 235 KB
84 KB 83ms
78ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6ea9771d6aeb5a8a0e73da36e951f9dbe02e009e41e880511daa6732cb4f40e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85663
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 60 KB
19 KB 73ms
47ms Script
text/javascript 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-6538859d8502035f0edc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1a6435ec41848bb2da51f6c469d1168e15993000f11a96638cbd488b06ba3ad4

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: 915e2815-1b5f-45ee-a0ce-332091416475
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
14 KB 210ms
35ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

abd0c69608a1a4b0ce5f6056bc20bcf62a2a29271a4cf5e33fa1f53bf7cb19cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Thu, 01 Aug 2024 08:40:11 GMT
last-modified: Sat, 13 Jul 2024 20:42:16 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EE33E93C3B814AFCAB096E1DA8DB1E5E Ref B: EWR30EDGE1421 Ref C: 2024-08-01T08:40:11Z
etag: "044982565d5da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 14183

GET
H3 200 mgsensor.js Show response
a.mgid.com/ Frame 96B3 17 KB
6 KB 114ms
30ms Script
application/javascript 2606:4700:1::6813:824c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a.mgid.com/mgsensor.js?d=1722501611215

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:1::6813:824c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45d2c055791d072ed388bb395f90aaebf2425189bbd03942b8f60855ba4f6988

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
x-mg-request-uuid: e9c07983-66b3-4328-a812-9ed9545766e4
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 8ac4859f58d60f46-EWR
alt-svc: h3=":443"; ma=86400

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=gr40a3z&ct=0:3ohu1zr&fmt=3
https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch
https://x.bidswitch.net/ul_cb/syncd?dsp_id=93&user_group=1&user_id=f8b38d22-7c53-44f5-8693-10b23686d446&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=f8b38d22-7c53-44f5-8693-10b23686d446&r=https%3A%2F%2Fmatch.adsrvr.org%2...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic

70 B
509 B

16ms
16ms

Image
image/gif

35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
Protocol: H2
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:12 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Redirect headers

location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
date: Thu, 01 Aug 2024 08:40:11 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 hub
api.pushnami.com/scripts/v1/ Frame 33AB 0
0 44ms
10ms Document
text/html 18.164.124.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/5fa1b4cbe02a560012bcbdf7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.164.124.11 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-164-124-11.jfk50.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 1552
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Thu, 01 Aug 2024 08:14:19 GMT
vary: accept-encoding
via: 1.1 16af463a01c5a83f3019835cbbb82152.cloudfront.net (CloudFront)
x-amz-cf-id: KlA87-yFyk1oW1t0ODcg_h_C8HHV7I9VIEvyLMWqHjcWu7lsiPkWKg==
x-amz-cf-pop: JFK50-P7
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
178 B 17ms
15ms XHR
text/plain 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8ac4859e3c2c4267-EWR

GET
H2 200 1736491679707345 Show response
connect.facebook.net/signals/config/ Frame 96B3 56 KB
12 KB 20ms
14ms Script
application/x-javascript 2a03:2880:f003:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1736491679707345?v=2.9.162&r=stable&domain=refinance.quickenloans.com&hme=e67e7d148043b3a377ad0eb1c82669792a67ba5e3bb5734b69e611ae38f939ca&ex_m=68%2C115%2C102%2C106%2C59%2C3%2C95%2C67%2C15%2C92%2C85%2C49%2C52%2C163%2C166%2C178%2C174%2C175%2C177%2C28%2C96%2C51%2C74%2C176%2C158%2C161%2C171%2C172%2C179%2C124%2C39%2C33%2C136%2C14%2C48%2C184%2C183%2C126%2C17%2C38%2C1%2C41%2C63%2C64%2C65%2C69%2C89%2C16%2C13%2C91%2C88%2C87%2C103%2C50%2C105%2C37%2C104%2C29%2C25%2C159%2C162%2C133%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C55%2C60%2C62%2C72%2C97%2C26%2C73%2C8%2C7%2C77%2C46%2C20%2C99%2C98%2C100%2C93%2C9%2C19%2C18%2C82%2C54%2C80%2C32%2C71%2C0%2C90%2C31%2C79%2C84%2C45%2C44%2C83%2C36%2C4%2C86%2C78%2C42%2C34%2C81%2C2%2C35%2C61%2C40%2C101%2C43%2C76%2C66%2C107%2C58%2C57%2C30%2C94%2C56%2C53%2C47%2C75%2C70%2C23%2C108

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ef6a21426925e25578d6a866a4c3f2549884b1641df6eadcdb503a3005b0e7e5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 01 Aug 2024 08:40:11 GMT
document-policy: force-load-at-top
x-fb-server-load: 32
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 12275
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=18, rtx=0, c=64, mss=1328, tbw=64210, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: vbVecfKBsivkEZsBukhqMmZadteAeTUodSKpTVjFEDSOgSe8wWsIhGrJPII/BmgCAxPvWxsxcJW9+iLEjhANFg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
82 KB 35ms
35ms Script
application/javascript 2607:f8b0:400d:c0f::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0f::61 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6fd2808ab117281f81c16fe81db1cb44eb34deec8505b766a324ac9ff86ecccf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 83537
x-xss-protection: 0
last-modified: Thu, 01 Aug 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Aug 2024 08:40:11 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 3 KB
2 KB 126ms
40ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1722501611666&cv=11&fst=1722501611666&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-966730890

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f20634369cec6fd35d15adcbb1a7ad959020f0efcdc7d37501186efd577b002

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:11 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1582
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 96B3 0
381 B 300ms
297ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1722501611690&ref=null&cv=20240731-17-RELEASE&tos=4&ssd=1&scd=0&ler=other&it=JS_PIXEL&mrir=u&vi=1722501611681
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 22
date: Thu, 01 Aug 2024 08:40:11 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 21726
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501612.832343,VS0,VE22
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 96B3 0
665 B 297ms
295ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1722501611697&ref=null&cv=20240731-17-RELEASE&tos=10&ssd=1&scd=0&ler=other&it=JS_PIXEL&mrir=u&vi=1722501611681
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 18
date: Thu, 01 Aug 2024 08:40:11 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 16585
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501612.832364,VS0,VE18
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 96B3 0
319 B 298ms
296ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1722501611701&ref=null&cv=20240731-17-RELEASE&tos=14&ssd=1&scd=0&ler=other&it=JS_PIXEL&mrir=u&vi=1722501611681
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 21
date: Thu, 01 Aug 2024 08:40:11 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 19438
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501612.832348,VS0,VE21
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 main.cb788166.js Show response
s.pinimg.com/ct/lib/ Frame 96B3 81 KB
23 KB 18ms
17ms Script
application/javascript 2600:1408:c400:396::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.cb788166.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:c400:396::1931 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 7fe7c08d3fdf1d7273da63b3998eb368679c1b24f9a0011365ee61d616928063

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
x-cdn: akamai
etag: "1769eb1fe2ab5455788cc4ecd006dd77"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 23536

OPTIONS
H2 200 unip
trc.taboola.com/1390358/log/3/ Frame 0
0 129ms
17ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=page_view&tim=1722501611690&ref=null&cv=20240731-17-RELEASE&tos=4&ssd=1&scd=0&ler=other&it=JS_PIXEL&mrir=u&vi=1722501611681
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:11 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 1145
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501612.810378,VS0,VE2
x-vcl-time-ms: 2

OPTIONS
H2 200 unip
trc.taboola.com/1467390/log/3/ Frame 0
0 124ms
18ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=page_view&tim=1722501611697&ref=null&cv=20240731-17-RELEASE&tos=10&ssd=1&scd=0&ler=other&it=JS_PIXEL&mrir=u&vi=1722501611681
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:11 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 915
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501612.810359,VS0,VE2
x-vcl-time-ms: 2

OPTIONS
H2 200 unip
trc.taboola.com/1074476/log/3/ Frame 0
0 121ms
18ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=page_view&tim=1722501611701&ref=null&cv=20240731-17-RELEASE&tos=14&ssd=1&scd=0&ler=other&it=JS_PIXEL&mrir=u&vi=1722501611681
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:11 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 724
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501612.810479,VS0,VE1
x-vcl-time-ms: 1

POST
H2 200 psp Show response
psp.pushnami.com/api/ 2 B
152 B 36ms
35ms Fetch
text/html 3.227.141.85
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.227.141.85 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-227-141-85.compute-1.amazonaws.com
Software: / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
key: 5fa1b4cbe02a560012bcbdf7
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Thu, 01 Aug 2024 08:40:11 GMT
x-powered-by: Express
content-length: 2
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
content-type: text/html; charset=utf-8

GET
H2 200 409e6a74-8d7f-465e-87b0-cc6eb99f3a76.json Show response
tr.snapchat.com/config/com/ Frame 96B3 100 B
401 B 150ms
86ms Fetch
application/json 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/config/com/409e6a74-8d7f-465e-87b0-cc6eb99f3a76.json?v=3.24.0-2407292126

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

0de7beadf73727d4f4f2b1fe7383e5a8f5481ca4dc3c0d0cfc13ac41818630b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

accept: application/json
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
observe-browsing-topics: ?1
content-type: application/json
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 37
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100

GET
H2 200 i
tr.snapchat.com/cm/ Frame FCE0 0
0 103ms
52ms Document
text/html 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=409e6a74-8d7f-465e-87b0-cc6eb99f3a76&u_scsid=21b3ed45-988c-49ac-8f72-4027e8c3b8e1&u_sclid=68435379-7f7c-4444-a391-69bb92f21e05

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: clear h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 672
content-type: text/html
date: Thu, 01 Aug 2024 08:40:11 GMT
server: API Gateway
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
x-envoy-upstream-service-time: 2

OPTIONS
H2 204 psp
psp.pushnami.com/api/ Frame 0
0 129ms
27ms Preflight 3.227.141.85
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://psp.pushnami.com/api/psp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.227.141.85 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-227-141-85.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: key
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
date: Thu, 01 Aug 2024 08:40:11 GMT
vary: Access-Control-Request-Headers
x-powered-by: Express

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11380533681/ 3 KB
2 KB 41ms
40ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11380533681/?random=1722501611960&cv=11&fst=1722501611960&bg=ffffff&guid=ON&async=1&gtm=45be47v0v9168885163za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11380533681

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78bbddc86def009bab33de1ce934e8ed1a86e98e803af5c427a52067ff7e4896

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1589
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/ 3 KB
2 KB 36ms
35ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/755089552/?random=1722501612027&cv=11&fst=1722501612027&bg=ffffff&guid=ON&async=1&gtm=45be47v0v9188392713za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250752&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-755089552

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9291473ecd53f774aa51f295d3353604e16ebaea8afd670f52da4a633acd20c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1591
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/ 3 KB
2 KB 34ms
33ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866176763/?random=1722501612104&cv=11&fst=1722501612104&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15c8df6f6dd3c5c620cd9d99be21e6ad78fa2911a56629b6988f8b76a83ffb99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1579
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 3 KB
2 KB 36ms
35ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1722501612145&cv=11&fst=1722501612145&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250752&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fef172cbc1c10eaab6f686157bf2a113e02a3534a7141deeed219d49bdc7f94b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1583
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/ 3 KB
2 KB 35ms
35ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10910338944/?random=1722501612195&cv=11&fst=1722501612195&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200zb9137104487&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8fd5c14c2ac546f1e6c7f761bea4f0d86540f9da252ecc338927cea46824122

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1590
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 3 KB
2 KB 33ms
33ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1722501612247&cv=11&fst=1722501612247&bg=ffffff&guid=ON&async=1&gtm=45be47v0v9188725454za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-865435318

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f8de7e8f13dce60e351f07387b6170aa4dc9fd6882d83e57fe9335162e8c47e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1590
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11388547050/ 3 KB
2 KB 32ms
31ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11388547050/?random=1722501612294&cv=11&fst=1722501612294&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250752&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11388547050

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0867dac148a1a880381148a9e30518847a98b00a7c6c451509c806cc6bb702e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1581
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 3 KB
2 KB 34ms
33ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1722501612339&cv=11&fst=1722501612339&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-700319321

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a51fa87795b50e3bd6d1c1e6a370ec00a28cbb2dfc42a5148dffe219231c3590

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1578
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 3 KB
2 KB 32ms
31ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1722501612381&cv=11&fst=1722501612381&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250752&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-813495030

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d7c914b272783dd5ac7c843367508879a41fca860a7859c3f00b4b69c776f4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1579
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 3 KB
2 KB 33ms
33ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1722501612441&cv=11&fst=1722501612441&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-857412364

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

933b8cf4183887b176a2743be178b4f18237136d6df72865f3988b4145f0bf82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1578
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 p
tr.snapchat.com/ Frame 96B3 0
16 B 63ms
50ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 01 Aug 2024 08:40:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

j Show response
rp4.liadm.com/ Frame 96B3
Redirect Chain

https://rp.liadm.com/j?dtstmp=1722501612625&aid=a-06d7&se=e30&duid=ddc3c751f117--01j46hhghefwxhgdtz9v8z7x0e&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pke...
https://rp4.liadm.com/j?dtstmp=1722501612625&aid=a-06d7&se=e30&duid=ddc3c751f117--01j46hhghefwxhgdtz9v8z7x0e&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pk...

13 B
347 B

105ms
17ms

XHR
application/json

34.202.182.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1722501612625&aid=a-06d7&se=e30&duid=ddc3c751f117--01j46hhghefwxhgdtz9v8z7x0e&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&wpn=lc-bundle&cd=.quickenloans.com&i6=MmEwZDo1NjAwOjI0OjE1MDA6MTAxMTo1ZjY4Ojg1NjU6ZDAwNw%3D%3D&n3pc=true
Protocol: H2
Server: 34.202.182.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-182-84.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:12 GMT
x-pixel-event-id: d6aa4740-6ec4-42d7-acba-38a795200812
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: null
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 13

Redirect headers

location: https://rp4.liadm.com/j?dtstmp=1722501612625&aid=a-06d7&se=e30&duid=ddc3c751f117--01j46hhghefwxhgdtz9v8z7x0e&tv=v2.14.3&pu=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&wpn=lc-bundle&cd=.quickenloans.com&i6=MmEwZDo1NjAwOjI0OjE1MDA6MTAxMTo1ZjY4Ojg1NjU6ZDAwNw%3D%3D&n3pc=true
access-control-allow-origin: https://refinance.quickenloans.com
date: Thu, 01 Aug 2024 08:40:12 GMT
access-control-expose-headers: *
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET

GET
H2 200 247005605.js Show response
bat.bing.com/p/action/ 334 B
407 B 26ms
21ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/247005605.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0170197caffee3d73fe659b2b65d4c50b88310d98752d7dba0e7988e7dfe4376

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Thu, 01 Aug 2024 08:40:12 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 473E5DAC39E84C41BFF84C3B7CADF75F Ref B: EWR30EDGE1421 Ref C: 2024-08-01T08:40:12Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=1800

GET
H2 200 /
www.facebook.com/tr/ Frame 96B3 0
274 B 71ms
17ms Image
text/plain 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com&rl=https%3A%2F%2Frefinance.quickenloans.com&if=true&ts=1722501612665&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4124&fbp=fb.1.1722501612659.303180311400436567&pm=1&hrl=1fab8f&cdl=API_unavailable&it=1722501611542&coo=false&cs_cc=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=10, mss=1328, tbw=2832, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 01 Aug 2024 08:40:12 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ Frame 96B3 67 B
3 KB 154ms
100ms Image
image/png 2a03:2880:f103:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1736491679707345&ev=PageView&dl=https%3A%2F%2Frefinance.quickenloans.com&rl=https%3A%2F%2Frefinance.quickenloans.com&if=true&ts=1722501612665&sw=1600&sh=1200&v=2.9.162&r=stable&ec=0&o=4124&fbp=fb.1.1722501612659.303180311400436567&pm=1&hrl=1fab8f&cdl=API_unavailable&it=1722501611542&coo=false&cs_cc=1&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:181:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: zstd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Thu, 01 Aug 2024 08:40:12 GMT
document-policy: force-load-at-top
x-fb-server-load: 49
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7398088092420255351", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=12, rtx=0, c=14, mss=1328, tbw=3150, tp=-1, tpl=-1, uplat=85, ullat=0
pragma: no-cache
x-fb-debug: D9OrU5Vkj3WAKlwqopNGDgXud9k7HQjBtjViacGL2jXWVBi9SsoXNDiNGe712VBc8PUNTZGFi+MIYlmXprqUJA==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7398088092420255351"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/ 3 KB
2 KB 32ms
31ms Script
text/javascript 2607:f8b0:400d:c07::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/848879802/?random=1722501612694&cv=11&fst=1722501612694&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200zb9137104487&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c07::9b Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

385c19302a417ad7d4a619c580512da349d0f23943874d8941bebe6aa406a555

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1592
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 click Show response
www.lmbahsj2.com/sdk/ 85 B
455 B 59ms
49ms Fetch
application/json 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/sdk/click?effp=a17cbee3cb466a7ca3de9788bdd00c28&sec_ch_ua_platform=&sec_ch_ua_platform_version=&sec_ch_ua_model=&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&oid=9&affid=809&__cc=&async=json&__qp=pkey1%7Cpkey2%7Cpkey3%7Cpkey%7Csourceid%7Csid%7Ccmpid%7Ccrtid%7Coid%7Caffid%7C_ef_transaction_id%7Cutm_medium%7Cutm_source%7Cutm_content&__rf=&__efckuq=94
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 731ef6ff5bfd375264ec948b8a73fb450237c6e29c7031b1b430f7b8626ffd61

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:12 GMT
via: 1.1 google
server: nginx
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-allow-credentials: true
x-eflow-request-id: 8b207142-783d-4d51-a1d7-adf6668c72c6
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

GET
H2 200 pd2259 Show response
pix.revjet.com/track/ Frame 96B3 46 B
221 B 304ms
80ms Script
text/javascript 147.135.104.198
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd2259?__noscript=false&__cbf=revjet.callbacks.cb1722501612730&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.104.198 Hillsboro, United States, ASN16276 (OVH, FR),
Reverse DNS: ns106987.ip-147-135-104.us
Software: /
Resource Hash: 793376e088c57eaf66276084945d190297cafe1357b0ed021c6e1a6c7386c693

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:13 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 pd3876 Show response
pix.revjet.com/track/ Frame 96B3 46 B
222 B 303ms
80ms Script
text/javascript 147.135.104.198
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pix.revjet.com/track/pd3876?__noscript=false&__cbf=revjet.callbacks.cb1722501612736&location=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&referrer=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=FIXED&typeOfLoan=&loanRefiPurpose=
Requested by: Host: ads.revjet.com
URL: https://ads.revjet.com/analytics?acu=3394
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.135.104.198 Hillsboro, United States, ASN16276 (OVH, FR),
Reverse DNS: ns106987.ip-147-135-104.us
Software: /
Resource Hash: 2c5f9c0ff5daa90dfb3d75f65576cb8ddbf6068f32bcc4dbac48ead1e20460a6

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:13 GMT
content-length: 46
content-type: text/javascript

GET
H2 200 / Show response
ct.pinterest.com/user/ Frame 96B3 327 B
733 B 139ms
45ms XHR
application/json 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&cb=1722501612781&dep=2%2CPAGE_LOAD

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.cb788166.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

5612e07185add6333ccf39345089eedafce9235ae2770f3e3c93e88805532780

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.12dfda17.1722501612.1b400f71
x-envoy-upstream-service-time: 0
alt-svc: h3=":443"; ma=600
content-length: 187
x-pinterest-rid: 1640242658919379
pin-unauth: dWlkPU5qYzRPVE5tTXpJdE1tTmxNaTAwTmpFMkxUbGxPVFl0Tm1SbVpEUmlZVGxsWVdWag
pragma: no-cache
referrer-policy: origin
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
pinterest-version: 24566c1eacfd475e71889db2e24a77832ef4e778
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/966730890/ 42 B
64 B 84ms
35ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/966730890/?random=1722501611666&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLctSRE0vQVTStNstlFqCXRIc2PWA9SBVcJwPtZhKGGpL9bDVz&random=1972819952&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p
tr6.snapchat.com/ Frame 96B3 0
207 B 94ms
45ms Ping
text/plain 2600:1901:0:7628::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://tr6.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:7628:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 01 Aug 2024 08:40:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1
via: 1.1 google, 1.1 google
server: API Gateway
alt-svc: clear, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 /
www.google.com/pagead/1p-user-list/11380533681/ 42 B
64 B 72ms
31ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11380533681/?random=1722501611960&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0v9168885163za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLpJSGydpYltFaa82FTeBS0iC8G-jUcdJsfWPWNJBFO0Mv717_&random=3187040321&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/755089552/ 42 B
64 B 81ms
40ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/755089552/?random=1722501612027&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0v9188392713za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250752&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLQCLuOd-sFI3pSkBVPBoXFPUYzctAhQg_4vyBp1L6oX40KaVy&random=2906925414&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866176763/ 42 B
64 B 81ms
41ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866176763/?random=1722501612104&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLftSji1yqxiFkXVktbpYVIQnMsRdZeSoHGmnqYbVWHpz4ClN-&random=1294824062&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10866179376/ 42 B
64 B 73ms
33ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10866179376/?random=1722501612145&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250752&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLsE7_3S24Q3q5ZCxLBpl5bfA37WY1j60roDBAx2wqHPNjvwns&random=3800874227&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10910338944/ 42 B
64 B 74ms
35ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10910338944/?random=1722501612195&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200zb9137104487&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLehAMzbfBUqFcAfpPLd5gor_Ajc2kXgGckPZ-jewxtH3bHY8d&random=2094867296&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/865435318/ 42 B
64 B 34ms
30ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/865435318/?random=1722501612247&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0v9188725454za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLCMORkhvEQ7lfgZCoY3n61MYwuhoGP3jfLAZJF2vLBOvqiOrQ&random=2594796013&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/11388547050/ 42 B
64 B 36ms
32ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11388547050/?random=1722501612294&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250752&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLK6cHvwnRqCe11M6eb4abvCNA5ih5l7ZIBhOBXYewS0tza4o3&random=1329979685&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/700319321/ 42 B
64 B 52ms
48ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/700319321/?random=1722501612339&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLTTXiWHUf5vBrYaDnAq6uW0M8ujdxTz9mLYuYZbqugmisOUcX&random=105110827&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/813495030/ 42 B
64 B 38ms
34ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/813495030/?random=1722501612381&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250752&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLKvNwBSHYBg4TRmIJoXGrn4oH3iCayghxxfBt_6sWQrtBl_Rd&random=2579221594&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/v3/ Frame 96B3 35 B
507 B 123ms
47ms Fetch
image/gif 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/v3/?tid=2620075802369&pd=%7B%22em%22%3A%22%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D%22%2C%22ref%22%3A%22https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D%22%2C%22if%22%3Atrue%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%22cb788166%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1722501612797

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.cb788166.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.12dfda17.1722501612.1b400f73
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
pinterest-version: 24566c1eacfd475e71889db2e24a77832ef4e778
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 35
x-pinterest-rid: 3501038877297593
expires: Sat, 01 Jan 2000 00:00:00 GMT

OPTIONS
H2 204 track
trc.pushnami.com/api/push/ Frame 0
0 79ms
23ms Preflight 35.169.136.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.136.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-136-249.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: key
Access-Control-Request-Method: POST
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Accept,Authorization,Content-Type,If-None-Match,key
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-expose-headers: WWW-Authenticate,Server-Authorization
access-control-max-age: 86400
cache-control: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT

POST
H2 200 track Show response
trc.pushnami.com/api/push/ 2 B
168 B 70ms
68ms Fetch
text/html 35.169.136.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.pushnami.com/api/push/track
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.169.136.249 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-169-136-249.compute-1.amazonaws.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/
key: 5fa1b4cbe02a560012bcbdf7
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Thu, 01 Aug 2024 08:40:12 GMT
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
content-length: 2
content-type: text/html; charset=utf-8

GET
H3 200 /
www.google.com/pagead/1p-user-list/857412364/ 42 B
64 B 36ms
32ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/857412364/?random=1722501612441&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLLovOQnJ9jMOd8RgirtZUEX0Qp_-wcxCwi-An0Eyie2wYw9fK&random=1098367686&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
360 B 22ms
22ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=247005605&Ver=2&mid=3a3545fd-5998-4bee-84af-9f985fbd0c8e&sid=ab11a6e04fe111efafdacdf78598267a&vid=ab120f804fe111ef99d0ffbf27d0758d&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&kw=refinance,%20mortgage,%20mortgages,%20refinancing,%20mortgage%20rates,%20refinance%20mortgage,%20refinance%20rates,%20refinancing%20rates,%20refinancing%20home,%20home%20loan,%20home%20loans,%20equity%20loans,%20home%20equity%20loans,%20home%20equity%20loan,%20second%20mortgage,%20home%20equity%20loan%20rates,%20credit%20card%20consolidation,%20debt%20loans,%20credit%20card%20debt%20consolidation,%20bad%20credit%20loans,%20debt%20free,%20bad%20credit,%20debt%20help,%20debt%20solutions,%20money%20management,%20credit%20card%20debt,%20personal%20loan,%20bad%20credit%20mortgage,%20mortgage%20calculator&p=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&r=&lt=3597&evt=pageLoad&sv=1&cdb=AQAQ&rn=695927

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 01 Aug 2024 08:40:12 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3BC70948AE174EBA916C90D191899640 Ref B: EWR30EDGE1421 Ref C: 2024-08-01T08:40:12Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/848879802/ 42 B
64 B 59ms
55ms Image
image/gif 2607:f8b0:400d:c1d::69
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/848879802/?random=1722501612694&cv=11&fst=1722499200000&bg=ffffff&guid=ON&async=1&gtm=45be47v0za200zb9137104487&gcd=13l3l3l3l1&dma=0&tag_exp=95250753&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&hn=www.googleadservices.com&frm=0&tiba=Calculate%20New%20Payment%20-%20Start%20Here%20%7C%20Quicken%20Loans&npa=0&pscdl=noapi&auid=1553210888.1722501610&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDaQooLSO9k6w-oWOuL6iR5Z0C_OT7vLn132YGkJvJl2kjtbedUpXTC&random=1892571223&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c1d::69 Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:12 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 token_create.js Show response
ct.pinterest.com/static/ct/ Frame 96B3 4 KB
2 KB 38ms
33ms Script
application/javascript 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/static/ct/token_create.js

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.cb788166.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

cd56592299c1c670fb97ef28bcb50048508c01879ecb23b71364aecc0483e202

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-cdn: akamai
akamai-grn: 0.12dfda17.1722501612.1b4010ec
etag: "19c94b308deaf8fbf050b4fca2fa21b7"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=7200
content-length: 2108

GET
H2 200 ct.html
ct.pinterest.com/ Frame 68C8 0
0 69ms
21ms Document
text/html 23.220.128.196
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/ct.html

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.cb788166.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.220.128.196 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-220-128-196.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

akamai-grn: 0.12dfda17.1722501612.1b40119f
alt-svc: h3=":443"; ma=600
cache-control: max-age=86400
content-encoding: gzip
content-length: 323
content-type: text/html; charset=utf-8
date: Thu, 01 Aug 2024 08:40:13 GMT
pinterest-version: 24566c1eacfd475e71889db2e24a77832ef4e778
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
vary: Accept-Encoding
x-cdn: akamai
x-envoy-upstream-service-time: 0
x-pinterest-rid: 8724071739804697

POST
H3 200 p
tr.snapchat.com/ Frame 96B3 0
16 B 51ms
47ms Ping
text/plain 35.190.43.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.43.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.43.190.35.bc.googleusercontent.com

Software

API Gateway /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 01 Aug 2024 08:40:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains
via: 1.1 google, 1.1 google
server: API Gateway
access-control-allow-origin: https://refinance.quickenloans.com
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 favicon.ico
refinance.quickenloans.com/ 113 KB
23 KB 904ms
903ms Other
text/html 2606:4700:4400::ac40:9595
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/favicon.ico

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9595 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

fe4997532f09ccfb417e0213d7bc40c7ab8e8e46617d4c74fcfcf39dff7e6a73

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:13 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 8ac485a999e64267-EWR
x-xss-protection: 1; mode=block
expires: Thu, 01 Aug 2024 12:40:13 GMT

GET
H3 200 1x1.gif
a.mgid.com/ Frame 96B3 43 B
269 B 29ms
28ms Image
image/gif 2606:4700:1::6813:824c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.mgid.com/1x1.gif?id=608665&type=c&tg=&r=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&nv=1&clid=&d=1722501613108

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:1::6813:824c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 01 Aug 2024 08:40:13 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif
cf-ray: 8ac485a9fe8b0f46-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43

GET
H2 204 unip Show response
trc.taboola.com/1074476/log/3/ Frame 96B3 0
439 B 28ms
26ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=2305&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1722501613993&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 18
date: Thu, 01 Aug 2024 08:40:14 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 16584
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501614.012297,VS0,VE18
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1390358/log/3/ Frame 96B3 0
62 B 32ms
31ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=2307&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1722501613995&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 23
date: Thu, 01 Aug 2024 08:40:14 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 21254
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501614.012246,VS0,VE23
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip Show response
trc.taboola.com/1467390/log/3/ Frame 96B3 0
288 B 30ms
29ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=2307&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1722501613995&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 21
date: Thu, 01 Aug 2024 08:40:14 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 19364
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501614.012224,VS0,VE21
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 unip
trc.taboola.com/1074476/log/3/ Frame 0
0 10ms
9ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=2305&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1722501613993&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:14 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 1011
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501614.998932,VS0,VE2
x-vcl-time-ms: 2

OPTIONS
H2 200 unip
trc.taboola.com/1390358/log/3/ Frame 0
0 10ms
9ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=2307&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1722501613995&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:14 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 1326
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501614.999382,VS0,VE2
x-vcl-time-ms: 2

OPTIONS
H2 200 unip
trc.taboola.com/1467390/log/3/ Frame 0
0 10ms
9ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=2307&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=1500&msa=0&tim=1722501613995&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:14 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 1030
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501614.000306,VS0,VE2
x-vcl-time-ms: 2

POST
H2 204 collect Show response
analytics.google.com/g/ 0
54 B 23ms
21ms Fetch
text/plain 2607:f8b0:400d:c07::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-RXLL9Z7XBK&gtm=45je47v0v9169491831za200zb9137104487&_p=1722501609352&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=95250752&cid=1359296134.1722501610&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=3&sid=1722501609&sct=1&seg=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D809%26pkey2%3D2%26pkey3%3De79f018ce33c4b5bab6331378cf58ce6%26pkey%3D28101854db9b4efb8b7c8ba266dd7cad%26sourceid%3Daffl_everflow_ql-lre_9_809%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D809%26_ef_transaction_id%3De79f018ce33c4b5bab6331378cf58ce6%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=scroll&epn.percent_scrolled=90&_et=12&tfd=7102
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400d:c07::65 Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Aug 2024 08:40:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 unip
trc.taboola.com/1074476/log/3/ Frame 96B3 0
439 B 34ms
33ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=5316&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1722501617003&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 22
date: Thu, 01 Aug 2024 08:40:17 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 21086
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501617.019353,VS0,VE22
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip
trc.taboola.com/1390358/log/3/ Frame 96B3 0
101 B 34ms
32ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=5317&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1722501617005&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 18
date: Thu, 01 Aug 2024 08:40:17 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 16578
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501617.025369,VS0,VE18
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 unip
trc.taboola.com/1467390/log/3/ Frame 96B3 0
62 B 36ms
33ms XHR
image/gif 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=5317&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1722501617005&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://refinance.quickenloans.com/
Attribution-Reporting-Eligible: trigger
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-vcl-time-ms: 21
date: Thu, 01 Aug 2024 08:40:17 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 19437
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-lga21982-LGA
pragma: no-cache
server: nginx
x-timer: S1722501617.024883,VS0,VE21
content-type: image/gif
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 unip
trc.taboola.com/1074476/log/3/ Frame 0
0 9ms
8ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1074476/log/3/unip?en=pre_d_eng_tb&tos=5316&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1722501617003&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:17 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 704
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501617.009019,VS0,VE2
x-vcl-time-ms: 2

OPTIONS
H2 200 unip
trc.taboola.com/1390358/log/3/ Frame 0
0 13ms
13ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1390358/log/3/unip?en=pre_d_eng_tb&tos=5317&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1722501617005&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:17 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 1105
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501617.009466,VS0,VE5
x-vcl-time-ms: 5

OPTIONS
H2 200 unip
trc.taboola.com/1467390/log/3/ Frame 0
0 11ms
11ms Preflight 2a04:4e42::300
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1467390/log/3/unip?en=pre_d_eng_tb&tos=5317&scd=0&ssd=1&est=1722501611686&ver=36&isls=true&src=i&invt=3000&msa=0&tim=1722501617005&mrir=u&vi=1722501611681&ref=null&cv=20240731-17-RELEASE&ler=other&it=JS_PIXEL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://refinance.quickenloans.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-origin: https://refinance.quickenloans.com
allow: GET, HEAD, POST, TRACE, OPTIONS
content-length: 0
date: Thu, 01 Aug 2024 08:40:17 GMT
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
server: nginx
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-to-nlb-rtt: 1048
x-served-by: cache-lga21949-LGA
x-service-version: v1
x-timer: S1722501617.010243,VS0,VE4
x-vcl-time-ms: 4

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.mortgage.quickenloans.com
URL: https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js

Verdicts & Comments Add Verdict or Comment

50 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

80 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 22:29:48	Name: X-AB Value: fdcf6e462b6e488abffd4929ae370321
.liadm.com/j	1970-01-21 08:04:21	Name: lidid Value: 8243be2c-3789-4269-8316-16b4ac1642fe
www.npvnt7trk.com/	1970-01-20 22:30:09	Name: uniqueClick_79c6g4 Value: 8200de8e-fb71-4898-9456-4ccd5b8a47f7:1722501607
www.npvnt7trk.com/	1970-01-21 00:37:57	Name: transaction_id Value: 28101854db9b4efb8b7c8ba266dd7cad
www.lmbahsj2.com/	1970-01-20 22:29:48	Name: uniqueClick_FGXLG Value: 340ed0c0-e927-4d6f-bf3a-cba453b31f38:1722501607
.quickenloans.com/	1970-01-21 07:13:57	Name: visitorId Value: a242d92f-5890-4bb9-9d8b-767ef3a2e35d
refinance.quickenloans.com/	1970-01-21 07:13:57	Name: visitorId Value: a242d92f-5890-4bb9-9d8b-767ef3a2e35d
refinance.quickenloans.com/	1970-01-20 22:38:26	Name: contentTarget Value: %7B%22sourceId%22%3A%22affl_everflow_ql-lre_9_809%22%7D
.demdex.net/	1970-01-21 02:47:33	Name: demdex Value: 63988664762166351401035740610397747741
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
refinance.quickenloans.com/	1970-01-20 22:28:22	Name: _dd_s Value: rum=0&expire=1722502509481
.quickenloans.com/	1970-01-21 00:37:57	Name: _gcl_au Value: 1.1.1553210888.1722501610
.quickenloans.com/	1970-01-21 08:04:21	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 179643557%7CMCIDTS%7C19937%7CMCMID%7C63776234351305717241014217055262637781%7CMCAAMLH-1723106409%7C7%7CMCAAMB-1723106409%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1722508809s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.5.0
.adsrvr.org/	1970-01-21 07:13:57	Name: TDID Value: f8b38d22-7c53-44f5-8693-10b23686d446
.quickenloans.com/	1970-01-21 08:04:21	Name: _ga Value: GA1.1.1359296134.1722501610
.demdex.net/	1970-01-21 02:47:33	Name: dextp Value: 21-1-1722501609619\|771-1-1722501609720
.agkn.com/	1970-01-21 07:13:57	Name: ab Value: 0001%3AVFd4cgUDhleK1DdVT1r26hb%2BKc2kXU%2B0
.quickenloans.com/	1970-01-21 08:04:21	Name: _ga_RXLL9Z7XBK Value: GS1.1.1722501609.1.1.1722501609.60.0.0
.dpm.demdex.net/	1970-01-21 02:47:33	Name: dpm Value: 63988664762166351401035740610397747741
.media6degrees.com/	1970-01-21 02:47:33	Name: acs Value: 014020i0j0k1shj6qxxzt10xzt10xzt10
refinance.quickenloans.com/	1970-01-20 22:38:26	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNzMyYWFkNWEtODAzOC01NWJjLThiOTItNDI5YmViMmIyMTM1IiwidmlzaXRvcklkIjoiYTI0MmQ5MmYtNTg5MC00YmI5LTlkOGItNzY3ZWYzYTJlMzVkIiwic2Vzc2lvbklkIjoiZmE3NGU2ZTUtNjNjOC00Zjk5LTk1ZDItZjZlNzE4YzJjOThjIiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiI4MDkiLCJwa2V5MiI6IjIiLCJwa2V5MyI6ImU3OWYwMThjZTMzYzRiNWJhYjYzMzEzNzhjZjU4Y2U2IiwicGtleSI6IjI4MTAxODU0ZGI5YjRlZmI4YjdjOGJhMjY2ZGQ3Y2FkIiwic291cmNlSWQiOiJhZmZsX2V2ZXJmbG93X3FsLWxyZV85XzgwOSIsInNpZCI6IjkiLCJjbXBpZCI6IjkiLCJjcnRpZCI6IiIsIm9pZCI6IjkiLCJhZmZpZCI6IjgwOSIsIl9lZl90cmFuc2FjdGlvbl9pZCI6ImU3OWYwMThjZTMzYzRiNWJhYjYzMzEzNzhjZjU4Y2U2IiwidXRtX21lZGl1bSI6ImFmZmlsaWF0ZSIsInV0bV9zb3VyY2UiOiJub2NhcGFkcy5jb20iLCJ1dG1fY29udGVudCI6IiIsImFnZSI6bnVsbCwiZGV2aWNlIjpudWxsLCJmb3JjZU5hbWVzIjpudWxsLCJmb3JjZUlwIjpudWxsLCJmb3JjZVRlc3RJZHMiOm51bGwsImlucXVpcnlJZCI6bnVsbCwiaW5xdWlyeVNpZ25hdHVyZSI6bnVsbCwiaXNUZXN0IjpudWxsLCJsZXZlbE9mRWR1Y2F0aW9uIjpudWxsLCJtb2lkIjpudWxsLCJwcm9wZXJ0eVN0YXRlQ29kZSI6bnVsbCwicmVzb2x1dGlvbiI6IiIsInR0VHJhY2VJZCI6bnVsbCwicHJvdmlkZXJJZCI6bnVsbCwicWxzIjpudWxsLCJzdGlkIjpudWxsLCJvdmtleSI6bnVsbCwib3ZyYXciOm51bGwsIm92bXRjIjpudWxsLCJtb3J0Z2FnZUJhbGFuY2VSYW5nZSI6bnVsbCwiZGF0ZU5vdyI6MTcyMjUwMTYwOTQxNiwicmFuZG9tTnVtYmVyIjo4MDk3NCwibWFya2V0aW5nT2ZmZXJJZCI6bnVsbCwidGltZU9uRm9ybVN0YXJ0VGltZSI6IjIwMjQtMDgtMDFUMDg6NDA6MDkuNTY5WiIsIm9yaWdpblJlcXVlc3RlZFVyaSI6Imh0dHBzOi8vcmVmaW5hbmNlLnF1aWNrZW5sb2Fucy5jb20iLCJwcmVzZW50YXRpb25OYW1lIjoiMjkyMTQ5Ml9RTF9MUkVfTGFuZGluZ18yMDI0LTA3LTE1IiwiZGVzdGluYXRpb25VcmwiOiJodHRwczovL3JlZmluYW5jZS5xdWlja2VubG9hbnMuY29tLz9wa2V5MT04MDkmcGtleTI9MiZwa2V5Mz1lNzlmMDE4Y2UzM2M0YjViYWI2MzMxMzc4Y2Y1OGNlNiZwa2V5PTI4MTAxODU0ZGI5YjRlZmI4YjdjOGJhMjY2ZGQ3Y2FkJnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbHJlXzlfODA5JnNpZD05JmNtcGlkPTkmY3J0aWQ9Jm9pZD05JmFmZmlkPTgwOSZfZWZfdHJhbnNhY3Rpb25faWQ9ZTc5ZjAxOGNlMzNjNGI1YmFiNjMzMTM3OGNmNThjZTYmdXRtX21lZGl1bT1hZmZpbGlhdGUmdXRtX3NvdXJjZT1ub2NhcGFkcy5jb20mdXRtX2NvbnRlbnQ9IiwidmVydGljYWxOYW1lIjoiTVNRTF9MUkVfTEFORElORyIsInJlZmVycmluZ1VyaSI6IiIsImZsb3dJZCI6Ik1TUUxfTFJFX1dIQU1fTEFORElOR19WRVJUSUNBTF9GTE9XXzEiLCJ0ZXN0SWQiOjIxNzUxNzQsImNsaWVudElwQWRkcmVzcyI6IjJhMGQ6NTYwMDoyNDoxNTAwOjEwMTE6NWY2ODo4NTY1OmQwMDciLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoWDExOyBMaW51eCB4ODZfNjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjcuMC4wLjAgU2FmYXJpLzUzNy4zNiIsImJvdCI6ZmFsc2UsImlhdCI6MTcyMjUwMTYwOX0.Xg5vlMbCubEvN8IkObq_dsh9w5Bojd_qjk1lrlyCDnIguwdXJ-xfAQPL4EW5QCM1WspKm_Apl6v3FyhoL7ugdv0fHTvqKWtgITpTZUsAka50dDTcJOPgHWnz6g_DVAde1FCJMf5zKj8PX6kECwzm36gjjMhcgHTeokgBb7A8MALhIrLfSl_6NkcNKmD_erAC1JToYdWx9uNmJir_z3euXyx0WigaRGdeL1GuAd2c00kzBPphMwcKklfhY6VddC-TtFIQSeZU207-LOeKHNNT57zUlBnCJQYwitXWQST2uCqEdHLCBZUPkMtFsdr97-U0RaOsRhOD9e4fMbfAgN01ghJfQ4ze4q1mhwurkznCegfvyvLeEOGAXuNzxtF7uImkfaeAHSXnIK4ERQ4n9k-9DZSHK3e4plWap1huVGPh7P1Xi2QwWhZhXJp2mGWtvJ3i611ptm1lBch7bsu-g-HK1msK-TW409NBEW32iGj6YPDLpdhrUbbTzW2eUr6m-ZO6pCkQBhtr4z0r16QWUUHSWEARTQdi9AySVteOo0K0nFrvUI8NUmplH8_YBSGt5DwI1SnKI5IoIPIT5MAsqi1b0H2FLuSkM6kiqJp5a87YB5jxvfqKlpbSG50ZbXKJsEY1FhZoz52q4mLRwCkxgkPoCDQRlSwIee1jdG0YpEqOlc19zNZqHuwIcQ5r1Yo6up83cVZeF8VoqLA098lEO1HFwHXrKEdglT-3D_GOLL_nmY2X1ysWGcxvoht3ZE4YfwO23j5Rd8OCld0Cg2rf--mCmTNss7TDOSGAUjBIqbHlml9r01qYIMUo8Qmu5T-2jg7ogyNu6O86k0JbAjC77QaRDxgzJUyTWN5ch1v2Chrk540Q1lqgv9QnisW3uEXIk_6xNzM5ZKkOxiV-blkEvCHkPFJz3yuY76Cemz_2TJivxTnH1s1bR6cUVtU4QzfscrRk3R3nfFCBFYSbyOMjIHAd8dIcxkU_kMgtx95z-KPBRjgpsJhE3h9FeGcMmWZM8k6kw9y-hHNsjDIreWpjg9lawi8MXeBW5fQFq9CyLVztcZrKSwS3KKYY5wYd6-dfHoDbAFWM6lnvu2J2KiY3U59OJrWCJJb3oE9B6UdASZGpdZEWcIEMfuwP91hvT5shaU-FYTdhCxZ2r2GhRTQCSL-XphRlhhwVTvwveTdWIpd9iV27u6ZXqcUAxWvpUvTb3fwzV7pWnzizfgWbfub8ATMqtkVxFjI4xZ7x6Mh1wDIgxOr2412JiobSnz_1-3TGsfO8EVyw_lqdSS1jL10KGnxGpkend-ghwOjVNO42uFHgZXOJcxK1tFtj_gVUdfYaA7EMnCZt8A7AWvX33ZBpI1RbDw
.doubleclick.net/	1970-01-21 08:04:21	Name: IDE Value: AHWqTUnBRa6B4Ds_L5jYZ4XRxtRRVXop1Bbyk_Eir5yy8cvIvhYi5rfrfyEwiXSg9Gc
.quickenloans.com/	1970-01-20 22:28:23	Name: kndctr_5D60123F5245B13E0A490D45_AdobeOrg_cluster Value: va6
.quickenloans.com/	1970-01-21 07:57:09	Name: kndctr_5D60123F5245B13E0A490D45_AdobeOrg_identity Value: CiY2Mzc3NjIzNDM1MTMwNTcxNzI0MTAxNDIxNzA1NTI2MjYzNzc4MVIQCPP14uiQMhgBKgNWQTYwA_AB8_Xi6JAy
.quickenloans.com/	1970-01-21 08:04:21	Name: mbox Value: session#63776234351305717241014217055262637781-JvKwAJ#1722503470
.quickenloans.com/	1970-01-20 22:28:23	Name: mboxEdgeCluster Value: 34
.rubiconproject.com/	1970-01-21 07:13:57	Name: audit_p Value: 1\|LOv5E4XJTTV7XZ7VI3NouYOJeN3c+pi/C5q+pXTFrA3FwpmMCvAS5uCf5qgPoxHwDDn5xDRCMBEwHTRO1/p4iHX0qfg68IpFQAPcN3ARK861UaQz5ysdHEASJ9dyx5DkmT5dnsDShXWpUX8F1BcILMadHNFyYXC73RjpF1iIs2jREvsM2ra73MRmS8gGs6ylTlon0IrnE1p4+byUJuUHKNl4Am3SUH3rwETMVR8lnVPictVKI3nW/ZSmfFa9k+2RfCCm1vF3Tgn8ih/oL8+08tuVaVkDFDbShAUs62yL6R/QD5U7tEfUTQ==
.rubiconproject.com/	1970-01-21 07:13:57	Name: khaos Value: LZB0ZGWK-1L-21RI
.rubiconproject.com/	1970-01-21 07:13:57	Name: khaos_p Value: LZB0ZGWK-1L-21RI
.rubiconproject.com/	1970-01-21 07:13:57	Name: audit Value: 1\|LOv5E4XJTTV7XZ7VI3NouYOJeN3c+pi/C5q+pXTFrA3FwpmMCvAS5uCf5qgPoxHwDDn5xDRCMBEwHTRO1/p4iHX0qfg68IpFQAPcN3ARK861UaQz5ysdHEASJ9dyx5DkmT5dnsDShXWpUX8F1BcILMadHNFyYXC73RjpF1iIs2jREvsM2ra73MRmS8gGs6ylTlon0IrnE1p4+byUJuUHKNl4Am3SUH3rwETMVR8lnVPictVKI3nW/ZSmfFa9k+2RfCCm1vF3Tgn8ih/oL8+08tuVaVkDFDbShAUs62yL6R/QD5U7tEfUTQ==
.adnxs.com/	1970-01-21 00:37:57	Name: XANDR_PANID Value: cnYD0VelZmIaPn3mLKs4arF5NZBNedJLaXg7PfHiX-PDeyVOObRIh4dKmTUlxOh2VRreXks9tN6HtKFgyKMtth3DpGeku5CgNebXFWbvXLw.
.adnxs.com/	1970-01-21 08:04:21	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 00:37:57	Name: uuid2 Value: 322558327468909658
.casalemedia.com/	1970-01-21 07:13:57	Name: CMID Value: ZqtJ60t3uUIAADfrAOiLJgAA
.casalemedia.com/	1970-01-21 00:37:57	Name: CMPS Value: 043
.casalemedia.com/	1970-01-21 00:37:57	Name: CMPRO Value: 043
.media6degrees.com/	1970-01-21 02:47:33	Name: clid Value: 2shj6qx01170cczrvwjefmrk000020025y020v02802
.media6degrees.com/	1970-01-21 02:47:33	Name: sglst Value: 44ye004t02np3k8q0np388qe
.mortgage.quickenloans.com/	1970-01-20 22:28:23	Name: __cf_bm Value: chWQy4fZEV.3trr.MIu5OAMZb0IeaM_lp4C1PcM1V_k-1722501611-1.0.1.1-kD2pHDA1mIWJ5FA43Z1Hn9dNjRCWTSwqTPytzqfPxk901aQ4Wgiznjd3DMrgHKSTbLSvB5tT14vGUtGWWKHLxg
.bidswitch.net/	1970-01-21 07:13:57	Name: tuuid Value: 20326c07-3d07-43ff-80a7-038e935474c5
.bidswitch.net/	1970-01-21 07:13:57	Name: c Value: 1722501611
.bidswitch.net/	1970-01-21 07:13:57	Name: tuuid_lu Value: 1722501611
.mgid.com/	1970-01-20 22:28:23	Name: __cf_bm Value: nG1KBGl7.HRqIaDHRwIpw6ixo.LqcU1_zMIkI086yVQ-1722501611-1.0.1.1-4cri8ksm16mYZaJI08KLrkmM2uByoN0OLaxJJy0W.hA7Dns1TtRjxIUvf78nVDJin2yTPnLPD0aqAagCRt_l0w
.pmsrv.co/	1970-01-21 00:39:45	Name: _pmedia_opt-out Value: 1
.quickenloans.com/	1970-01-21 07:58:08	Name: _scid Value: 39e956c7-f6e6-4a9e-9486-7e1bef25d037
.quickenloans.com/	1970-01-21 07:58:08	Name: _scid_r Value: 39e956c7-f6e6-4a9e-9486-7e1bef25d037
.pubmatic.com/	1970-01-21 00:37:57	Name: KRTBCOOKIE_377 Value: 6810-f8b38d22-7c53-44f5-8693-10b23686d446&KRTB&22918-f8b38d22-7c53-44f5-8693-10b23686d446&KRTB&22926-f8b38d22-7c53-44f5-8693-10b23686d446&KRTB&23031-f8b38d22-7c53-44f5-8693-10b23686d446
.pubmatic.com/	1970-01-20 23:11:33	Name: PugT Value: 1722501611
.adsrvr.org/	1970-01-21 07:13:57	Name: TDCPM Value: CAESFQoGZ29vZ2xlEgsIgrmU3vKDmT0QBRIWCgdydWJpY29uEgsIyNqU3vKDmT0QBRIXCghhcHBuZXh1cxILCLzWiufyg5k9EAUSFQoGY2FzYWxlEgsIvvyK5_KDmT0QBRIYCgliaWRzd2l0Y2gSCwik0Pnp8oOZPRAFEhcKCHB1Ym1hdGljEgsI8v_L7PKDmT0QBRgFOAFCBCICCAE.
.quickenloans.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .quickenloans.com
.quickenloans.com/	1970-01-21 08:04:21	Name: _lc2_fpi Value: ddc3c751f117--01j46hhghefwxhgdtz9v8z7x0e
.quickenloans.com/	1970-01-21 08:04:21	Name: _lc2_fpi_meta Value: {%22w%22:1722501612078}
.snapchat.com/	1970-01-21 07:49:57	Name: sc_at Value: v2\|H4sIAAAAAAAAAE3GwRHAIAgEwIqYORBB7IZEqMLi882+VqcdQSkNSJN6LHrSD+UbbVmlHeOyYrOLTLCx3F/xAVkjDwxAAAAA
.taboola.com/	1970-01-21 07:13:57	Name: receive-cookie-deprecation Value: 1
.taboola.com/	1970-01-21 07:13:57	Name: t_gid Value: fe4f9548-819d-4068-9f2b-ffe2044b0feb-tuctda4cf6b
.taboola.com/	1970-01-21 07:13:57	Name: t_pt_gid Value: fe4f9548-819d-4068-9f2b-ffe2044b0feb-tuctda4cf6b
.tapad.com/	1970-01-20 23:54:45	Name: TapAd_TS Value: 1722501612271
.tapad.com/	1970-01-20 23:54:45	Name: TapAd_DID Value: 46139a3d-a92b-4a73-80f6-1b8e1f63c4e5
.tapad.com/	1970-01-20 23:54:45	Name: TapAd_3WAY_SYNCS Value:
.refinance.quickenloans.com/	1970-01-21 00:37:57	Name: MgidSensorNVis Value: 1
.refinance.quickenloans.com/	1970-01-21 00:37:57	Name: MgidSensorHref Value: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
.quickenloans.com/	1970-01-21 07:58:08	Name: _sctr Value: 1%7C1722420000000
.quickenloans.com/	1970-01-21 00:37:57	Name: _fbp Value: fb.1.1722501612659.303180311400436567
.liadm.com/	1970-01-21 08:04:21	Name: lidid Value: 8243be2c-3789-4269-8316-16b4ac1642fe
.quickenloans.com/	1970-01-20 22:38:26	Name: _ScCbts Value: %5B%5D
www.lmbahsj2.com/	1970-01-20 22:29:48	Name: uniqueClick Value: 3146413c-eb55-4a83-91ab-c3b0bf6a517a:1722501612
www.lmbahsj2.com/	1970-01-21 00:37:57	Name: transaction_id Value: e79f018ce33c4b5bab6331378cf58ce6\|e79f018ce33c4b5bab6331378cf58ce6
.quickenloans.com/	1970-01-20 22:29:48	Name: _uetsid Value: ab11a6e04fe111efafdacdf78598267a
.quickenloans.com/	1970-01-21 07:49:57	Name: _uetvid Value: ab120f804fe111ef99d0ffbf27d0758d
.quickenloans.com/	1970-01-20 23:11:33	Name: ef_witness Value: 1
.quickenloans.com/	1970-01-20 23:11:33	Name: ef_affid Value: 809
.quickenloans.com/	1970-01-20 23:11:33	Name: ef_tid_c_o_9 Value: e79f018ce33c4b5bab6331378cf58ce6
.quickenloans.com/	1970-01-20 23:11:33	Name: ef_tid_c_a_1 Value: e79f018ce33c4b5bab6331378cf58ce6
.bing.com/	1970-01-21 07:49:57	Name: MUID Value: 02713CC13EF1691A3D7A280F3F5968E2
.bat.bing.com/	1970-01-20 22:38:26	Name: MR Value: 0
.pinterest.com/	1970-01-21 07:13:57	Name: ar_debug Value: 1
.refinance.quickenloans.com/	1970-01-21 07:13:57	Name: _pin_unauth Value: dWlkPU5qYzRPVE5tTXpJdE1tTmxNaTAwTmpFMkxUbGxPVFl0Tm1SbVpEUmlZVGxsWVdWag
.revjet.com/	1970-01-21 08:04:21	Name: trx Value: 4887258821234836938
.refinance.quickenloans.com/	1970-01-20 22:28:23	Name: __cf_bm Value: kF1zVwTwRNOHl4c1GUWWZu2DbZLWc1b9LONQs5w1ixM-1722501613-1.0.1.1-WjQw3x0dXE.yYJpSuwHbH119VwyWVeW20JDoD9g7m40udaDnLZdVXlURAs8_Bxdwx6EgkDoxaIsuCboTb8OqpA
.mgid.com/	1970-01-21 07:13:57	Name: muidn Value: o71djGhFZoE1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	error	URL: https://refinance.quickenloans.com/?pkey1=809&pkey2=2&pkey3=e79f018ce33c4b5bab6331378cf58ce6&pkey=28101854db9b4efb8b7c8ba266dd7cad&sourceid=affl_everflow_ql-lre_9_809&sid=9&cmpid=9&crtid=&oid=9&affid=809&_ef_transaction_id=e79f018ce33c4b5bab6331378cf58ce6&utm_medium=affiliate&utm_source=nocapads.com&utm_content= Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mgid.com
action.dstillery.com
action.media6degrees.com
adobedc.demdex.net
ads.anura.io
ads.revjet.com
analytics.google.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
bat.bing.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cm.g.doubleclick.net
connect.facebook.net
content.refinance.quickenloans.com
cs-cdn.deviceatlas.com
ct.pinterest.com
dpm.demdex.net
dsum-sec.casalemedia.com
fonts.cdnfonts.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
insight.adsrvr.org
match.adsrvr.org
pix.revjet.com
pixel.rubiconproject.com
psp.pushnami.com
quicken.demdex.net
refinance.quickenloans.com
rp.liadm.com
rp4.liadm.com
s.pinimg.com
sc-static.net
script.anura.io
simage2.pubmatic.com
somni.rocketmortgage.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
stats.g.doubleclick.net
tr.snapchat.com
tr6.snapchat.com
trackpixel.refinance.quickenloans.com
trc.pushnami.com
trc.taboola.com
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
www.npvnt7trk.com
x.bidswitch.net
cdn.mortgage.quickenloans.com
104.36.113.107
108.139.29.79
108.139.54.225
147.135.104.198
15.204.44.77
151.101.129.44
172.64.151.101
18.164.124.11
18.173.219.102
209.85.144.156
209.85.232.154
23.220.128.196
2600:1408:c400:18e::1e80
2600:1408:c400:396::1931
2600:1901:0:7628::
2600:1f18:730:b110:ba1c:c150:99a8:df4b
2600:9000:23cb:9400:8:8845:1500:93a1
2600:9000:2514:7800:a:8e7d:9900:93a1
2606:4700:1::6813:824c
2606:4700:3036::ac43:b89e
2606:4700:4400::ac40:9595
2606:4700::6810:5049
2606:4700::6812:895
2607:f8b0:400d:c02::5f
2607:f8b0:400d:c07::65
2607:f8b0:400d:c07::9b
2607:f8b0:400d:c0f::61
2607:f8b0:400d:c0f::9b
2607:f8b0:400d:c1d::5e
2607:f8b0:400d:c1d::69
2620:1ec:c11::237
2a03:2880:f003:100:face:b00c:0:3
2a03:2880:f103:181:face:b00c:0:25de
2a04:4e42::300
3.163.245.4
3.18.206.181
3.227.141.85
34.199.85.59
34.202.182.84
34.36.162.171
35.169.136.249
35.190.43.134
35.201.76.131
35.211.178.172
35.71.131.137
52.70.36.245
54.88.63.116
63.140.38.236
63.140.39.248
68.67.160.132
69.173.151.100
0170197caffee3d73fe659b2b65d4c50b88310d98752d7dba0e7988e7dfe4376
02e5bf47b2473c1da7a39a25b14f0f5d9857142842d33def047e492f9f610cb9
04550338ea0fa27b014ce834bae7d1b6c53dedbcb8366fc1687d3d4d1622c262
0de7beadf73727d4f4f2b1fe7383e5a8f5481ca4dc3c0d0cfc13ac41818630b3
10ee1493f65ab91319c722c59b8e1a4a55f412fde0090099a28bc3dd12505c9c
145029bd46ef6268a3683431599d1cc5e9b0153c2c5bf840f931e78da99ee2a6
15c8df6f6dd3c5c620cd9d99be21e6ad78fa2911a56629b6988f8b76a83ffb99
16c13c95bfb1a406440202c5f0fc03876a3c38b7c61a2021d58a49257649e93b
1a6435ec41848bb2da51f6c469d1168e15993000f11a96638cbd488b06ba3ad4
1f0bb758c1bd7e5b74a11804a30ecc949a151072b8497ec95bd67cbb7aad1544
28bb3e785d321d6894a00d87bb527924a07fe94407a2d1051b8d04fd1c42455b
29502f440e5e16b564bbd6922c08e44a959ef72aff8c4e41d9ecb57cb3bc2e06
2c5f9c0ff5daa90dfb3d75f65576cb8ddbf6068f32bcc4dbac48ead1e20460a6
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
2ebc3cd1d0af023685181ad52ed67b334bad44ea95407db09b40c2de15fcc165
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
385c19302a417ad7d4a619c580512da349d0f23943874d8941bebe6aa406a555
3882cb94f5c15ad9e7bfaf249ab971b3289591f7c4f78468793dc7fc99c76d4d
3d96e01f4ebdabab6186506d95a252586d8c70817fba7562a1ee59b0f11a71d6
3e39730ce0162fca499ed41db299944e95ddc11e6ce0cdebab5a77f503c0bb44
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
45d2c055791d072ed388bb395f90aaebf2425189bbd03942b8f60855ba4f6988
49652ad86154be80557ff54bff8ffca4a611acbe4d70bbc174be39e8472de17f
4d2816f1f714364675a3a4ff25db96f2a5677b6cce94e150e61250bfdde4d258
4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b
55cbdff52a4ce0061ff5347c7003f6086224a8f5b5d7d3afa3feb420ec8585b5
5612e07185add6333ccf39345089eedafce9235ae2770f3e3c93e88805532780
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
574ecd9adca6e51d1a61699f3ddce3b7d486dcf3958d2e075888d77d443ab6d7
5ae904f99709154ef6b0806efa4f5e7d1f123c251152048fe67b995d4c2a519b
5f20634369cec6fd35d15adcbb1a7ad959020f0efcdc7d37501186efd577b002
63c29888acf03229f56580e1e8276d6e336268a6cb24a72f4540ad2da3a6cf3e
64a6e8d00c22b320355dc737581468bfe44b606aecbfe2fc7d2d57ea4c1c2ad8
664e7f850d51fb786462fbb6138e88648924ce5f8620909ba5b68ed86e33a83a
6bc18b0601123d29ccebf315d1efea0339607c22b507e684bf8a20726732ff16
6ea9771d6aeb5a8a0e73da36e951f9dbe02e009e41e880511daa6732cb4f40e5
6f8de7e8f13dce60e351f07387b6170aa4dc9fd6882d83e57fe9335162e8c47e
6fd2808ab117281f81c16fe81db1cb44eb34deec8505b766a324ac9ff86ecccf
71ca1526b583a6283752d155fada0ed1a64f1ea43cf17d88f4d39cfc315cc7d9
71e1de449b1b4c9146707a32498eee2f5751b3ac8a5917ab3d795ceadf0e41d2
72c1bab19ae1dc60cc73c71c0a8f59777c85913e59e2b4487cd11e70bd928c23
731ef6ff5bfd375264ec948b8a73fb450237c6e29c7031b1b430f7b8626ffd61
76b65310895e8341f3804e1f3d436a0910928874964daf20f6e2d7a8a69553f4
78bbddc86def009bab33de1ce934e8ed1a86e98e803af5c427a52067ff7e4896
793376e088c57eaf66276084945d190297cafe1357b0ed021c6e1a6c7386c693
7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3
7e2a43755b059701fb71d85865b49ba7b820fcf7992ac872759b39deb4510329
7fe7c08d3fdf1d7273da63b3998eb368679c1b24f9a0011365ee61d616928063
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f6b883d93b2767c0d04efeeeb65ac92a170c1d966fefc635586d233e5f318cc
91fbc5ef95019e78b753b40035db36fff0944a684a9c6b379f3a708742ce376c
933b8cf4183887b176a2743be178b4f18237136d6df72865f3988b4145f0bf82
962f8da44a5e7f4416402f6bc4a7165ab26cef621f6c24cb74f5e8db5fdc5f9e
96c6a879728eb34cc7530ac66b53761a7f4058b273498992288cb5a5ec92f775
971b2673f92ee01c1b6e98372fdefdd4f0a83714167783eba0671fa0d966f9f7
a07888b4c398f688e7d5650efc8fa03b95733acd12492b85ee623bb116ddb708
a43cb5fd157cbb53c4d8bb46f719096c0eff6c917e5c208a7a9cee4cde5aac43
a51fa87795b50e3bd6d1c1e6a370ec00a28cbb2dfc42a5148dffe219231c3590
a760071de574910b7f9d8d897a11a4027f41b5724ee2ac0a98eb6f4267e83438
a9291473ecd53f774aa51f295d3353604e16ebaea8afd670f52da4a633acd20c
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
abd0c69608a1a4b0ce5f6056bc20bcf62a2a29271a4cf5e33fa1f53bf7cb19cb
ae4668f7b6dd3e01040152ac401d1c1ad8806f3d9a764036eae4d53ec684a218
afedde1315a1103168065ff8a76bef2f117cfad411b3d19b80ddf2c29272d5b7
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
bb57016a52d5e27a1e665601b50d185449b9344b0bb286b65e39441951c38bc9
bc581e601e42cbba8d5ac49ef3d056be95ab802edaa6cf0e9e3325b568c5cd06
cd56592299c1c670fb97ef28bcb50048508c01879ecb23b71364aecc0483e202
cfe2ce3b6696acd7732129aac3b7d0965a9d5e5378807181bd60366af53ff2ab
d07fac71031c18e56501f2088fc28668898b5c4c2fa5e99befcad2923a23ec66
d0867dac148a1a880381148a9e30518847a98b00a7c6c451509c806cc6bb702e
d7c914b272783dd5ac7c843367508879a41fca860a7859c3f00b4b69c776f4e5
d8cbc596bdee9ceb0f3b176892acfb59f5535b3ab2f7f3da519a9c59a7389531
d8fd5c14c2ac546f1e6c7f761bea4f0d86540f9da252ecc338927cea46824122
dc242f2acb69deaa2c17cce616c89430cd666771b2e8303465bbfdc340d39663
dffe0e2e7fb07ab2d5364148df80e97e6c8b92b91d717b62f8be16a1bab37757
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaa003d85cb77f94fcae98396e583ce01d0c375b57235402c884ef8a792b951e
ed3a08819903124c49a5f15918f258da7de92e465f896373939027cfcc128f2f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6a21426925e25578d6a866a4c3f2549884b1641df6eadcdb503a3005b0e7e5
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
fe4997532f09ccfb417e0213d7bc40c7ab8e8e46617d4c74fcfcf39dff7e6a73
fef172cbc1c10eaab6f686157bf2a113e02a3534a7141deeed219d49bdc7f94b
fef95b324850099ff32808fb88cbf0af034d69cc4558110ea65e3b323fc17d0e

refinance.quickenloans.com Open in urlscan Pro 2606:4700:4400::ac40:9595 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

142 Requests

95 %HTTPS

43 %IPv6

39 Domains

57 Subdomains

45 IPs

1 Countries

2391 kBTransfer

7567 kBSize

80 Cookies

21 Outgoing links

Page URL History

Redirected requests

142 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::ac40:9595 Public Scan

Screenshot
Live screenshot

Full Image

142
Requests

95 %
HTTPS

43 %
IPv6

39
Domains

57
Subdomains

45
IPs

1
Countries

2391 kB
Transfer

7567 kB
Size

80
Cookies

142 HTTP transactions
0 data transactions