auth.savings.beneplace.com Open in urlscan Pro
104.18.37.20 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://e.email.workingadvantage.com/click?EbGVpbGEubGVnYWxAbWVtb3JpYWxoZXJtYW5uLm9yZw/CeyJtaWQiOiIxNzA3MjQzNjk3OTQ0NGZjZWVhZDlkMmJmI...
Effective URL:
https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3...
Submission: On February 06 via manual (February 6th 2024, 7:30:15 pm UTC) from US — Scanned from DE

Summary HTTP 65 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 20 IPs in 5 countries across 16 domains to perform 65 HTTP transactions. The main IP is 104.18.37.20, located in and belongs to CLOUDFLARENET, US. The main domain is auth.savings.beneplace.com. The Cisco Umbrella rank of the primary domain is 141194.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 1st 2023. Valid for: a year.

This is the only time auth.savings.beneplace.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	96.47.24.171 96.47.24.171	46263 (EDIALOG) (EDIALOG)
3 24	104.18.37.20 104.18.37.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a02:26f0:350... 2a02:26f0:3500:58e::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	54.247.78.255 54.247.78.255	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1	63.140.62.27 63.140.62.27	15224 (OMNITURE) (OMNITURE)
3	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1	13.32.27.83 13.32.27.83	16509 (AMAZON-02) (AMAZON-02)
1	18.66.122.29 18.66.122.29	16509 (AMAZON-02) (AMAZON-02)
2	199.38.167.54 199.38.167.54	54312 (ROCKETFUEL) (ROCKETFUEL)
2 2	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1 2	185.89.210.82 185.89.210.82	29990 (ASN-APPNEX) (ASN-APPNEX)
1	54.157.9.158 54.157.9.158	14618 (AMAZON-AES) (AMAZON-AES)
2	2606:4700::68... 2606:4700::6811:3b8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
65	20

1 96.47.24.171 (United States) 1 redirects

ASN46263 (EDIALOG, US)
PTR: n.dwr.com.mx1.bm16.maas.zetaglobal.net

e.email.workingadvantage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 104.18.37.20 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

memorialhermann.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
auth.savings.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:3500:58e::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.247.78.255 (Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-247-78-255.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.27 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-27.data.adobedc.net

smetrics.beneplace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.83 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-83.fra56.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-29.fra60.r.cloudfront.net

cdn.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.38.167.54 (United States)

ASN54312 (ROCKETFUEL, US)

com-wag3.netmng.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.134 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f134.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.82 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.157.9.158 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-9-158.compute-1.amazonaws.com

people.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:3b8 (United States)

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	beneplace.com 3 redirects memorialhermann.savings.beneplace.com smetrics.beneplace.com — Cisco Umbrella Rank: 141849 auth.savings.beneplace.com — Cisco Umbrella Rank: 141194	1 MB
7	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 460	327 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27 region1.google-analytics.com — Cisco Umbrella Rank: 2029	21 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	258 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 challenges.cloudflare.com — Cisco Umbrella Rank: 5168	41 KB
3	doubleclick.net 2 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 79 ad.doubleclick.net — Cisco Umbrella Rank: 163	3 KB
2	adnxs.com 1 redirects secure.adnxs.com — Cisco Umbrella Rank: 490	2 KB
2	netmng.com com-wag3.netmng.com — Cisco Umbrella Rank: 133940	5 KB
2	boomtrain.com cdn.boomtrain.com — Cisco Umbrella Rank: 5754 people.api.boomtrain.com — Cisco Umbrella Rank: 6199 events.api.boomtrain.com Failed	31 KB
2	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 362	65 KB
1	google.com adservice.google.com — Cisco Umbrella Rank: 98	401 B
1	rezync.com live.rezync.com — Cisco Umbrella Rank: 1645	7 KB
1	gstatic.com fonts.gstatic.com	14 KB
1	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 239	685 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 324	25 KB
1	workingadvantage.com 1 redirects e.email.workingadvantage.com — Cisco Umbrella Rank: 170273	592 B
65	16

	Domain	Requested by
17	memorialhermann.savings.beneplace.com	1 redirects memorialhermann.savings.beneplace.com
7	auth.savings.beneplace.com	2 redirects memorialhermann.savings.beneplace.com auth.savings.beneplace.com
7	assets.adobedtm.com	memorialhermann.savings.beneplace.com assets.adobedtm.com auth.savings.beneplace.com
4	www.googletagmanager.com	memorialhermann.savings.beneplace.com auth.savings.beneplace.com
3	www.google-analytics.com	memorialhermann.savings.beneplace.com
2	challenges.cloudflare.com	auth.savings.beneplace.com challenges.cloudflare.com
2	secure.adnxs.com	1 redirects memorialhermann.savings.beneplace.com
2	ad.doubleclick.net	2 redirects
2	com-wag3.netmng.com	memorialhermann.savings.beneplace.com
2	region1.google-analytics.com	www.googletagmanager.com
2	cdnjs.cloudflare.com	memorialhermann.savings.beneplace.com auth.savings.beneplace.com
2	maps.googleapis.com	memorialhermann.savings.beneplace.com auth.savings.beneplace.com
1	people.api.boomtrain.com	memorialhermann.savings.beneplace.com
1	adservice.google.com	memorialhermann.savings.beneplace.com
1	cdn.boomtrain.com	memorialhermann.savings.beneplace.com
1	live.rezync.com	memorialhermann.savings.beneplace.com
1	stats.g.doubleclick.net	memorialhermann.savings.beneplace.com
1	smetrics.beneplace.com	memorialhermann.savings.beneplace.com
1	fonts.gstatic.com	memorialhermann.savings.beneplace.com
1	dpm.demdex.net	assets.adobedtm.com
1	cdn.jsdelivr.net	memorialhermann.savings.beneplace.com auth.savings.beneplace.com
1	e.email.workingadvantage.com	1 redirects
0	events.api.boomtrain.com Failed	memorialhermann.savings.beneplace.com
65	23

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com

Subject Issuer	Validity	Valid
beneplace.com Cloudflare Inc ECC CA-3	`2023-12-01` - `2024-11-30`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
smetrics.beneplace.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-05-05` - `2024-06-04`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.rezync.com Amazon RSA 2048 M02	`2023-10-25` - `2024-11-21`	a year	crt.sh
*.boomtrain.com Amazon RSA 2048 M02	`2024-01-10` - `2025-02-07`	a year	crt.sh
*.netmng.com Sectigo RSA Domain Validation Secure Server CA	`2024-01-09` - `2025-02-04`	a year	crt.sh
*.api.boomtrain.com Amazon RSA 2048 M03	`2023-09-16` - `2024-10-14`	a year	crt.sh
challenges.cloudflare.com Cloudflare Inc ECC CA-3	`2023-08-18` - `2024-08-17`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
Frame ID: 94465D340F8959DC8BC9813F25709DFA
Requests: 52 HTTP requests in this frame

Frame: https://memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js
Frame ID: 2CB05B1C4EF055AF7D8EFEAF3BCF9F05
Requests: 2 HTTP requests in this frame

Frame: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fsilent-refresh.html
Frame ID: B74B67BBD84AFE91BAC16DA811361619
Requests: 11 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hkuqe/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: D1AE0063FDE8050030E7ECEF2820304E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Just a moment...

Page URL History Show full URLs

https://e.email.workingadvantage.com/click?EbGVpbGEubGVnYWxAbWVtb3JpYWxoZXJtYW5uLm9yZw/CeyJtaWQiOiIxNzA3MjQzNjk3O... HTTP 302
https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.benepl... Page URL
https://auth.savings.beneplace.com/auth/authorize?subdomain=memorialhermann&response_type=code&client_id=9ezali... HTTP 302
https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

65
Requests

80 %
HTTPS

52 %
IPv6

16
Domains

23
Subdomains

20
IPs

5
Countries

2123 kB
Transfer

8856 kB
Size

25
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m
Title: Cloudflare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://e.email.workingadvantage.com/click?EbGVpbGEubGVnYWxAbWVtb3JpYWxoZXJtYW5uLm9yZw/CeyJtaWQiOiIxNzA3MjQzNjk3OTQ0NGZjZWVhZDlkMmJmIiwiY3QiOiJlYmctd2FnMy1kNzg2NzdlZWQzZjIwOTFiMWU2NTYzOGQzYzJmOWJhNi0xIiwicmQiOiJtZW1vcmlhbGhlcm1hbm4ub3JnIn0/HWkhfZWJnd2FfTkRCQU0wMjA2MjAyNGMxMTYwMDI5YjEsZWIyLGh0dHBzOi8vbWVtb3JpYWxoZXJtYW5uLnNhdmluZ3MuYmVuZXBsYWNlLmNvbS9yZWxheQ/qP2Rsaz0yZzFjMWV6ajk3aTBqYXptMGdqd2xyJmNvcnBSZWRpcmVjdFVyaT1odHRwcyUzQSUyRiUyRm9mZmVycy5iZW5lcGxhY2UuY29tJTJGYWNjb3VudC5waHAlM0ZzdWIlM0RmdW5saWZlX2hvdy1pdC13b3JrcyUyNnV0bV9zb3VyY2UlM0RlbWFpbCUyNnV0bV9tZWRpdW0lM0RGZWJydWFyeS0wNi0yMDI0LUZ1bkxpZmUtUmV3YXJkcy1FbWFpbDItRzMtUmVzZW5kJTI2dXRtX2NhbXBhaWduJTNERnVubGlmZS1SZXdhcmRzLWhlcm8tY3RhJnN1YmRvbWFpbj1tZW1vcmlhbGhlcm1hbm4/scs7299341d HTTP 302
https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Page URL
https://auth.savings.beneplace.com/auth/authorize?subdomain=memorialhermann&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp HTTP 302
https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://e.email.workingadvantage.com/click?EbGVpbGEubGVnYWxAbWVtb3JpYWxoZXJtYW5uLm9yZw/CeyJtaWQiOiIxNzA3MjQzNjk3OTQ0NGZjZWVhZDlkMmJmIiwiY3QiOiJlYmctd2FnMy1kNzg2NzdlZWQzZjIwOTFiMWU2NTYzOGQzYzJmOWJhNi0xIiwicmQiOiJtZW1vcmlhbGhlcm1hbm4ub3JnIn0/HWkhfZWJnd2FfTkRCQU0wMjA2MjAyNGMxMTYwMDI5YjEsZWIyLGh0dHBzOi8vbWVtb3JpYWxoZXJtYW5uLnNhdmluZ3MuYmVuZXBsYWNlLmNvbS9yZWxheQ/qP2Rsaz0yZzFjMWV6ajk3aTBqYXptMGdqd2xyJmNvcnBSZWRpcmVjdFVyaT1odHRwcyUzQSUyRiUyRm9mZmVycy5iZW5lcGxhY2UuY29tJTJGYWNjb3VudC5waHAlM0ZzdWIlM0RmdW5saWZlX2hvdy1pdC13b3JrcyUyNnV0bV9zb3VyY2UlM0RlbWFpbCUyNnV0bV9tZWRpdW0lM0RGZWJydWFyeS0wNi0yMDI0LUZ1bkxpZmUtUmV3YXJkcy1FbWFpbDItRzMtUmVzZW5kJTI2dXRtX2NhbXBhaWduJTNERnVubGlmZS1SZXdhcmRzLWhlcm8tY3RhJnN1YmRvbWFpbj1tZW1vcmlhbGhlcm1hbm4/scs7299341d HTTP 302
https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann

Request Chain 30

https://memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js

Request Chain 37

https://ad.doubleclick.net/ddm/activity/src=12084042;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://memorialhermann.savings.beneplace.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1707247807.3813527 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=12084042;dc_pre=COzj-ti5l4QDFZhBwgodhtIDIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://memorialhermann.savings.beneplace.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1707247807.3813527 HTTP 302
https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=COzj-ti5l4QDFZhBwgodhtIDIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://memorialhermann.savings.beneplace.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1707247807.3813527

Request Chain 38

https://secure.adnxs.com/seg?add=32509374&t=2 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2

Request Chain 41

https://auth.savings.beneplace.com/auth/authorize?subdomain=memorialhermann&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fsilent-refresh.html HTTP 302
https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fsilent-refresh.html

65 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

relay Show response
memorialhermann.savings.beneplace.com/
Redirect Chain

https://e.email.workingadvantage.com/click?EbGVpbGEubGVnYWxAbWVtb3JpYWxoZXJtYW5uLm9yZw/CeyJtaWQiOiIxNzA3MjQzNjk3OTQ0NGZjZWVhZDlkMmJmIiwiY3QiOiJlYmctd2FnMy1kNzg2NzdlZWQzZjIwOTFiMWU2NTYzOGQzYzJmOWJhN...
https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26u...

9 KB
4 KB

267ms
177ms

Document
text/html

104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95d5abcb91cc12fc9d24284013e163a86826740c870c4b1d5375c015c6726a22

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8515ce420eba4534-TXL
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 19:30:05 GMT
last-modified: Thu, 01 Feb 2024 11:43:04 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Feb 2024 19:30:05 GMT
Keep-Alive: timeout=1, max=100
Location: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
Server: Apache
Strict-Transport-Security: max-age=60
X-Powered-By: PHP/8.2.8

GET
H2 200 launch-a0e5cece2585.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ 654 KB
155 KB 121ms
41ms Script
application/x-javascript 2a02:26f0:3500:58e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:58e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1a376f2411821d18b04194b19b9c45226eac8030f0bde1d2ca8ddc34a090791b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: gzip
last-modified: Mon, 05 Feb 2024 15:33:27 GMT
server: AkamaiNetStorage
etag: "4f34e4f3803a576c24964af1998b2cf5:1707147207.900002"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 158680
expires: Tue, 06 Feb 2024 20:30:06 GMT

GET
H2 200 new-relic-integration.js Show response
memorialhermann.savings.beneplace.com/assets/new-relic/ 51 KB
18 KB 171ms
170ms Script
application/javascript 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 01 Feb 2024 11:43:03 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65bb83c7-ccde"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 8515ce4328ed4534-TXL
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ 157 KB
25 KB 148ms
60ms Stylesheet
text/css 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://memorialhermann.savings.beneplace.com/
Origin: https://memorialhermann.savings.beneplace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7740949
x-jsd-version: 4.5.3
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230056-FRA
x-jsd-version-type: version
server: cloudflare
etag: W/"27288-jtLWNQ0j+FfZKAVzfQ+XxnXeZms"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WDCkazS%2Bv3pnXC8Fs5Z4WWtFHlkdqXWeDY6Rl%2B6oUcNjw7eAZtpaq80E2SIf7NcBEb57XALkdGzZYmAn9kyhvc6bzd3rHWaWHLgT5et%2F4dRnCQcEhoo3Kpgh6LfxlUgR%2BKHrLEaPAyysbRCRK8Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 8515ce43be785d51-FRA

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 192 KB
65 KB 156ms
70ms Script
text/javascript 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

cc714807f31bbe12fa9294fa54b78b66664c125d2bed1a042df5c40d7d8e8441

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66173
x-xss-protection: 0

GET
H2 200 web-animations.min.js Show response
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ 47 KB
14 KB 131ms
49ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5835175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S3tNjhpEmbJzjJxdtsDf0TaY39KeZ1oECCpYkORX5i29wSweyw6S3ccs8ImFrOkku%2B5dvlC95%2FzW82KuLNAXVrMvXxJzdtDansoEot%2BZZ5Z3E4fgIAZNSbT1%2FCR64ev%2FfL5zi1lh%2Fn7kJksPFqa9e9WD"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8515ce43ae555c1a-FRA
expires: Sun, 26 Jan 2025 19:30:06 GMT

GET
H2 200 runtime.3007947e6ee2b434.js Show response
memorialhermann.savings.beneplace.com/ 4 KB
2 KB 160ms
158ms Script
application/javascript 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/runtime.3007947e6ee2b434.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1fedfbb6961ad650024c2e8e87e7899b34e7bfb9ac7148d3b59c97110a34e8ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
Origin: https://memorialhermann.savings.beneplace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Feb 2024 11:42:53 GMT
server: cloudflare
content-encoding: br
etag: W/"65bb83bd-e79"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://memorialhermann.savings.beneplace.com, https://memorialhermann.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8515ce4328ee4534-TXL
alt-svc: h3=":443"; ma=86400

GET
H2 200 polyfills.0f88da5fdbf95761.js Show response
memorialhermann.savings.beneplace.com/ 141 KB
49 KB 165ms
164ms Script
application/javascript 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/polyfills.0f88da5fdbf95761.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46f16c323557a318dd6604bab3ebe8dbd9d23bc318b55eec33b0b0a4502c0bd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
Origin: https://memorialhermann.savings.beneplace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Feb 2024 11:42:53 GMT
server: cloudflare
content-encoding: br
etag: W/"65bb83bd-234ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://memorialhermann.savings.beneplace.com, https://memorialhermann.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8515ce4328f04534-TXL
alt-svc: h3=":443"; ma=86400

GET
H3 200 scripts.1baad6c013597821.js Show response
memorialhermann.savings.beneplace.com/ 166 KB
54 KB 746ms
746ms Script
application/javascript 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/scripts.1baad6c013597821.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aef73d8723fb7d91d516282c5a33140f448212e7d49898baab65f6c8b74ddc6

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 01 Feb 2024 11:42:53 GMT
server: cloudflare
cf-cache-status: DYNAMIC
content-encoding: br
etag: W/"65bb83bd-29758"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cf-ray: 8515ce450e2d44f8-TXL
alt-svc: h3=":443"; ma=86400

GET
H2 200 main.e6cee9663d1e3a18.js Show response
memorialhermann.savings.beneplace.com/ 5 MB
1 MB 200ms
199ms Script
application/javascript 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/main.e6cee9663d1e3a18.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ccde71f86599f54f18dada02e526b2eb4c3cd0b3d99822a171dba56457f6083

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
Origin: https://memorialhermann.savings.beneplace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Feb 2024 11:42:53 GMT
server: cloudflare
content-encoding: br
etag: W/"65bb83bd-503370"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://memorialhermann.savings.beneplace.com, https://memorialhermann.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8515ce4328f34534-TXL
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 237 KB
79 KB 149ms
61ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eae9405da94e80d954dbeeb7e60ae5898121aa4da136a71e388c110964e05273

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80822
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 18:16:06 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 06 Feb 2024 19:30:06 GMT

GET
H2 200 id Show response
dpm.demdex.net/ 185 B
685 B 181ms
59ms XHR
application/json 54.247.78.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&d_nsid=0&d_coppa=true&ts=1707247806199

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.247.78.255 , Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-247-78-255.eu-west-1.compute.amazonaws.com

Software

Resource Hash

4cd3ef0e322636723919ee8bd942cd075d6fe0532fbb545f9a749c66d6af6356

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://memorialhermann.savings.beneplace.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

dcs: dcs-prod-irl1-1-v054-0a605edad.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: zZaVauAXSVU=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 188
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 78ms
78ms Script
application/x-javascript 2a02:26f0:3500:58e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:58e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Tue, 06 Feb 2024 20:30:06 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 68ms
68ms Script
application/x-javascript 2a02:26f0:3500:58e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:58e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Tue, 06 Feb 2024 20:30:06 GMT

GET
H3 200 styles.f02f3e4d86a48b3e.css
memorialhermann.savings.beneplace.com/ 95 KB
16 KB 191ms
191ms Stylesheet
text/css 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/styles.f02f3e4d86a48b3e.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3d356230da20a9876271fbb4c85ffa912fe03868fe3021069d1a1c3415a072

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 01 Feb 2024 11:42:53 GMT
server: cloudflare
cf-cache-status: HIT
content-encoding: br
etag: W/"65bb83bd-17af1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
cf-ray: 8515ce450e3644f8-TXL
alt-svc: h3=":443"; ma=86400

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v24/ 14 KB
14 KB 124ms
39ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://memorialhermann.savings.beneplace.com/
Origin: https://memorialhermann.savings.beneplace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 11:27:47 GMT
x-content-type-options: nosniff
age: 28939
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13980
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 11:27:47 GMT

GET
H2 200 id Show response
smetrics.beneplace.com/ 48 B
476 B 185ms
53ms XHR
application/x-javascript 63.140.62.27
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.beneplace.com/id?d_visid_ver=5.4.0&d_fieldgroup=A&mcorgid=B5F9FF2554F608410A4C98C6%40AdobeOrg&mid=06067287160669273590335384308973731335&cl=157680000&d_coppa=true&ts=1707247806383

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.27 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-27.data.adobedc.net

Software

jag /

Resource Hash

0964994f1e4c962fa1052aad2f19aa2e1a96d4f86573e034cb459cdb9b897fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://memorialhermann.savings.beneplace.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 141ms
62ms XHR
application/json 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H3 200 styles.f02f3e4d86a48b3e.css
memorialhermann.savings.beneplace.com/ 95 KB
16 KB 58ms
57ms Stylesheet
text/css 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/styles.f02f3e4d86a48b3e.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3d356230da20a9876271fbb4c85ffa912fe03868fe3021069d1a1c3415a072

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 01 Feb 2024 11:42:53 GMT
server: cloudflare
cf-cache-status: HIT
age: 0
etag: W/"65bb83bd-17af1"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css
content-encoding: br
cf-ray: 8515ce46695744f8-TXL
alt-svc: h3=":443"; ma=86400

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 277 KB
92 KB 60ms
60ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

41bfa45d2b0cef4f8773c456508b230bf280a742f06b1084f1124f64d39e1507

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 94013
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 06 Feb 2024 19:30:06 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 125ms
38ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 06 Feb 2024 17:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6117
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 06 Feb 2024 19:48:09 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
269 B 377ms
281ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-FD2X5ZMELR&gtm=45je41v0h1v9112553684z878847533za200&_p=1707247805942&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1961284718.1707247807&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1707247806&sct=1&seg=0&dl=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dmemorialhermann&dt=Beneplace%20Team%20Discounts&en=page_view&_fv=1&_nsi=1&_ss=1&ep.userId=&up.data_stream_name=G-FD2X5ZMELR&up.site_name=Non%20Cruises&up.url_name=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dmemorialhermann&up.pb_site_name=memorialhermann&up.page_path=%2Frelay&up.user_id_value=&up.zip_code=NaN&tfd=2426
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FD2X5ZMELR&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 19:30:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
237 B 58ms
58ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=134178673&t=pageview&_s=1&dl=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dmemorialhermann&ul=en-us&de=UTF-8&dt=Beneplace%20Team%20Discounts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=894370547&gjid=806225413&cid=1961284718.1707247807&tid=UA-2876877-9&_gid=1131404336.1707247807&_r=1&_slc=1&gtm=45He41v0n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=2928953

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1da6ad9dfce9466037ec92e1f7699158c9a9347c669333c724f5cf6f3a7c0634

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://memorialhermann.savings.beneplace.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 19:30:06 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
361 B 396ms
49ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-2876877-9&cid=1961284718.1707247807&jid=894370547&gjid=806225413&_gid=1131404336.1707247807&_u=YADAAEAAAAAAACAAI~&z=846383214

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://memorialhermann.savings.beneplace.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 06 Feb 2024 19:30:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 258 KB
86 KB 289ms
289ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4770d10167ff11b08b55d12cfb8696ad1373d11fa70dc6afcad09fa1a08882a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88362
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 06 Feb 2024 19:30:06 GMT

GET
DATA 200
OK truncated
/ 38 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3 200 info Show response
memorialhermann.savings.beneplace.com/api/ 9 KB
3 KB 311ms
311ms XHR
text/html 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/api/info

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

335d3f13f55dd97df4c656d79878b695825c5ef93597d0693a44f408e21ce0f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
tracestate: 88831@nr=0-1-2647367-1120218725-2bbc6376eff9ad32----1707247807137
traceparent: 00-1887bc0070ddfd2624a8b527033eb400-2bbc6376eff9ad32-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjJiYmM2Mzc2ZWZmOWFkMzIiLCJ0ciI6IjE4ODdiYzAwNzBkZGZkMjYyNGE4YjUyNzAzM2ViNDAwIiwidGkiOjE3MDcyNDc4MDcxMzcsInRrIjoiODg4MzEifX0=

Response headers

date: Tue, 06 Feb 2024 19:30:07 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8515ce4aaaed44f8-TXL
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Tue, 06 Feb 2024 19:30:06 GMT

GET
H3 200 marketplace-styles.css Show response
memorialhermann.savings.beneplace.com/api/memorialhermann/ 33 KB
5 KB 896ms
895ms XHR
text/css 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/api/memorialhermann/marketplace-styles.css

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

484a811f5d10f04a8ad4abc8f9e13247743ceb6b0fb9e9453622f62b66751b21

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
tracestate: 88831@nr=0-1-2647367-1120218725-3c5fbb9e52a5f507----1707247807138
traceparent: 00-af4e685efaa35b66a8e9abe733d42300-3c5fbb9e52a5f507-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjNjNWZiYjllNTJhNWY1MDciLCJ0ciI6ImFmNGU2ODVlZmFhMzViNjZhOGU5YWJlNzMzZDQyMzAwIiwidGkiOjE3MDcyNDc4MDcxMzgsInRrIjoiODg4MzEifX0=

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"8261-qneJdQ6IbQiPlP6zElzcfivfVV0"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8515ce4aaaf344f8-TXL
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Tue, 06 Feb 2024 19:30:06 GMT

GET
H3 200 colors.css Show response
memorialhermann.savings.beneplace.com/api/memorialhermann/ 3 KB
857 B 196ms
196ms XHR
text/css 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/api/memorialhermann/colors.css?scope=:root,app-logged-in,ngb-modal-window

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f677880f0d7ec0a5faa8ad02c6f613d39a4535430d745aa9aadd5340a870849

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
tracestate: 88831@nr=0-1-2647367-1120218725-bc3141d2f0343776----1707247807138
traceparent: 00-b453a2de12c8d455bae88543d6342200-bc3141d2f0343776-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6ImJjMzE0MWQyZjAzNDM3NzYiLCJ0ciI6ImI0NTNhMmRlMTJjOGQ0NTViYWU4ODU0M2Q2MzQyMjAwIiwidGkiOjE3MDcyNDc4MDcxMzgsInRrIjoiODg4MzEifX0=

Response headers

date: Tue, 06 Feb 2024 19:30:07 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"acd-bRN27bs1d9zWrJTJb5gEgInJ2A4"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: http://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8515ce4aaaff44f8-TXL
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Tue, 06 Feb 2024 19:30:06 GMT

GET
H2 200 RCea9d317d3a374e44b3f0f8711e38765e-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/2a83dd37052e/ 2 KB
1022 B 39ms
39ms Script
application/x-javascript 2a02:26f0:3500:58e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/2a83dd37052e/RCea9d317d3a374e44b3f0f8711e38765e-source.min.js
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:58e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bbc90a700e8b6e0bde36997b17555946a793f583ad1ab16d546cd0c781a3ddcf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:07 GMT
content-encoding: gzip
last-modified: Mon, 05 Feb 2024 15:33:32 GMT
server: AkamaiNetStorage
etag: "b53cf5dbfee43d2ac7dfc40c456d0dfe:1707147212.078992"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 751
expires: Tue, 06 Feb 2024 20:30:07 GMT

GET
H3

200

main.js Show response
memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/ Frame 2CB0
Redirect Chain

https://memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js

7 KB
3 KB

43ms
43ms

Script
application/javascript

104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js

Requested by

Protocol

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

693e593fad4e1d333aa76087393c270334461e960d20e276c633991431c1c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:07 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 8515ce4afbad44f8-TXL
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 06 Feb 2024 19:30:07 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js
cache-control: max-age=300, public
cf-ray: 8515ce4abb1144f8-TXL
alt-svc: h3=":443"; ma=86400

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 47ms
46ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-2K753Z6D0L&gtm=45je41v0v9126564266za200&_p=1707247805942&gcd=13l3l3l3l2&npa=0&dma_cps=sypham&dma=1&ul=en-us&sr=1600x1200&cid=1961284718.1707247807&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dmemorialhermann&dt=Beneplace%20Team%20Discounts&sid=1707247807&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2980
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2K753Z6D0L&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 19:30:07 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync Show response
live.rezync.com/ 6 KB
7 KB 295ms
190ms Script
text/javascript 13.32.27.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=5ef4f9c1e806678f2ab0275df01d5ff4&zmpID=ebg-wag3&cache_buster=1707247807183&k=ebg-wag3-pixel-0988
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-83.fra56.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: 90e7be434dd269f59bb0496832baada53db05e1d31951ce577b0fc9505b0f50a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:07 GMT
via: 1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 6157
x-amz-cf-id: kvcaU7NzN2T6VxdQSR7vqcVnusYa8IZ-BHoLqdVzJwnGbnIHF1ua0w==

POST
H3 200 8515ce420eba4534 Show response
memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 2CB0 0
340 B 77ms
74ms XHR
text/plain 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/jsd/r/8515ce420eba4534

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 06 Feb 2024 19:30:07 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 8515ce4bad8644f8-TXL
alt-svc: h3=":443"; ma=86400

GET
H3 200 memorialhermann Show response
memorialhermann.savings.beneplace.com/api/controls/ 2 KB
1 KB 238ms
238ms XHR
application/json 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/api/controls/memorialhermann

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

341083bce636014fe77945e54a94e8cce5c1a34cfe400bffe146af1e78e73cae

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
tracestate: 88831@nr=0-1-2647367-1120218725-476931853917b0cd----1707247807451
traceparent: 00-f59c932728010b9f0995bf83eb488200-476931853917b0cd-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjQ3NjkzMTg1MzkxN2IwY2QiLCJ0ciI6ImY1OWM5MzI3MjgwMTBiOWYwOTk1YmY4M2ViNDg4MjAwIiwidGkiOjE3MDcyNDc4MDc0NTEsInRrIjoiODg4MzEifX0=

Response headers

date: Tue, 06 Feb 2024 19:30:07 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
etag: W/"802-l2JAubNJ9M1/PrRHP+sqZphELc4"
vary: Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: http://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8515ce4cafd644f8-TXL
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Tue, 06 Feb 2024 19:30:06 GMT

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/ebg-wag3/ 93 KB
30 KB 171ms
46ms Script
application/javascript 18.66.122.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/ebg-wag3/p13n.min.js
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-29.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 62ec57b7f971a77af7380ce75ee21e1b881fd1fa628efdb36607125004cca092

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: F0D.ZjABBxdHdywXTGltZ1WNkvMBIMIE
Content-Encoding: gzip
Via: 1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
Date: Tue, 06 Feb 2024 18:33:52 GMT
X-Amz-Cf-Pop: FRA60-P2
Age: 3391
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Tue, 06 Feb 2024 04:41:57 GMT
Server: AmazonS3
ETag: W/"a036c704209d386b667790a5a0757a3f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: lkHBll-VA9tCVOuvIndsrw7PTKPAtC8wxmwqQYH6pAo7ZNXVpq9H8g==

GET
H/1.1 200
OK / Show response
com-wag3.netmng.com/ 7 KB
4 KB 571ms
140ms Script
text/javascript 199.38.167.54
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://com-wag3.netmng.com/?aid=6366&siclientid=105368&url=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dmemorialhermann&p5=&p6=&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.38.167.54 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: openresty /
Resource Hash: 2c8b1fcae5798c86bedf0c01911eda98ecb4c8016bbb8aaf031d0135ec050eea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 19:30:08 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Feb 2024 19:30:08 GMT
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa PSAa OUR BUS COM NAV"
Content-Type: text/javascript; charset=UTF-8
X-Cnection: close
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Sun, 04 Feb 2024 19:30:08 GMT

GET
H2

200

;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1707247807.3813527
adservice.google.com/ddm/fls/z/src=12084042;dc_pre=COzj-ti5l4QDFZhBwgodhtIDIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=h...
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=12084042;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://memorialhermann.sa...
https://ad.doubleclick.net/ddm/activity/src=12084042;dc_pre=COzj-ti5l4QDFZhBwgodhtIDIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u...
https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=COzj-ti5l4QDFZhBwgodhtIDIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u2...

42 B
401 B

176ms
76ms

Image
image/gif

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=COzj-ti5l4QDFZhBwgodhtIDIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://memorialhermann.savings.beneplace.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1707247807.3813527

Requested by

Protocol

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 19:30:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 06 Feb 2024 19:30:07 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"14179970710128860987"}],"aggregatable_trigger_data":[{"filters":{"14":["12836263"]},"key_piece":"0xe24d503430f3370c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0x5fc5ce90c1f7fa8e","not_filters":{"14":["12836263"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["12836263"]},"key_piece":"0x132e8c35f7ec589d","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0xf13c9aabefefe07c","not_filters":{"14":["12836263"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"8745025090937472524","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"14179970710128860987","filters":{"14":["12836263"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"14179970710128860987","filters":{"14":["12836263"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"14179970710128860987","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"14179970710128860987","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["12084042"]}}
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: image/png
location: https://adservice.google.com/ddm/fls/z/src=12084042;dc_pre=COzj-ti5l4QDFZhBwgodhtIDIg;type=unive0;cat=unive0;u1=;u2=;u3=;u4=;u5=;u6=;u7=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u18=;u19=;u20=;u22=;u23=;u28=;u29=https://memorialhermann.savings.beneplace.com/;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1707247807.3813527
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?add=32509374&t=2
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2

43 B
1 KB

51ms
51ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2

Requested by

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 19:30:07 GMT
an-x-request-uuid: 39fed48e-35ad-44e6-8f5a-8de8b346d6bc
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.108; 80.255.7.108; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Feb 2024 19:30:07 GMT
an-x-request-uuid: 4e6635b4-dbd4-49cd-98f2-cc4c6c59b2fd
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D32509374%26t%3D2
x-proxy-origin: 80.255.7.108; 80.255.7.108; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK resolve Show response
people.api.boomtrain.com/identify/ 142 B
457 B 527ms
136ms XHR
application/json 54.157.9.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/identify/resolve?data=eyJjb29raWUiOnsiYnNpbiI6IiJ9LCJxdWVyeXN0cmluZyI6e30sImV4dGVybmFsX2lkcyI6eyJ6eW5jIjoiMTE1N2NmZDAtMjZjNy00MTlmLWFjY2UtN2Y4OWNjNWFmMzkwOjE3MDcyNDc4MDcuMzc3NTgyIn19&site_id=ebg-wag3
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.157.9.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-9-158.compute-1.amazonaws.com
Software: nginx /
Resource Hash: dd65d3afcbd78ae16191bb1c49024cb5039be508b59dec6615709049f4e5c0dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Tue, 06 Feb 2024 19:30:08 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 142

GET
H3 200 872.194065e01ea991c5.js Show response
memorialhermann.savings.beneplace.com/ 4 KB
2 KB 168ms
168ms Script
application/javascript 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/872.194065e01ea991c5.js

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aba7991bfc62a413ff4a27b8882721bd3c3f0e858a75501979e34306e1b64fa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
Origin: https://memorialhermann.savings.beneplace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
last-modified: Thu, 01 Feb 2024 11:42:53 GMT
server: cloudflare
content-encoding: br
etag: W/"65bb83bd-11ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, GET, POST, PUT, PATCH, DELETE, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://memorialhermann.savings.beneplace.com, https://memorialhermann.savings.beneplace.com
access-control-allow-credentials: true, true
cf-ray: 8515ce50680e44f8-TXL
alt-svc: h3=":443"; ma=86400

GET
H3

200

sign-in
auth.savings.beneplace.com/memorialhermann/ Frame B74B
Redirect Chain

https://auth.savings.beneplace.com/auth/authorize?subdomain=memorialhermann&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fsi...
https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fsilent-refresh.html

10 KB
3 KB

173ms
172ms

Document
text/html

104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fsilent-refresh.html

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://memorialhermann.savings.beneplace.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8515ce51fb7744f8-TXL
content-encoding: br
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 19:30:08 GMT
last-modified: Thu, 01 Feb 2024 11:49:20 GMT
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.beneplace.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8515ce509c584534-TXL
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 19:30:08 GMT
expires: Tue, 06 Feb 2024 19:30:07 GMT
location: /memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fsilent-refresh.html
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H/1.1 200
OK / Show response
com-wag3.netmng.com/WAG3/com/ 3 KB
2 KB 136ms
135ms Script
text/javascript 199.38.167.54
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://com-wag3.netmng.com/WAG3/com/?vid=ozju6oauwsang&referer=&browserPixelRatio=1&browserWidth=1600&browserHeight=1200&aid=6366&siclientid=105368&url=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3Dmemorialhermann&p5=&p6=&p7=&p8=&p9=&p10=&p11=&p12=&p13=&p14=&p15=&p16=&p17=&p18=&p19=&p20=&p26=&p27=&p28=&function=browser_check&r=2870ab
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.38.167.54 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: openresty /
Resource Hash: 51c28a44c986a235c6d74f2abfbafd9c9a01452515258628e10cbe3024c45a4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Feb 2024 19:30:08 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Feb 2024 19:30:08 GMT
Server: openresty
Transfer-Encoding: chunked
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa PSAa OUR BUS COM NAV"
Content-Type: text/javascript; charset=UTF-8
X-Cnection: close
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-cache, private
Expires: Sun, 04 Feb 2024 19:30:08 GMT

GET
H2 200 RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/2a83dd37052e/ 451 B
557 B 40ms
40ms Script
application/x-javascript 2a02:26f0:3500:58e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/2a83dd37052e/RC6b40217ba8b34b5c95f7ac097beadf09-source.min.js
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:58e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: dbbb0f07e193366f98beb4ff0372c2e4f5f5f40fb358e1407aa7095166f9b09d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
content-encoding: gzip
last-modified: Mon, 05 Feb 2024 15:33:32 GMT
server: AkamaiNetStorage
etag: "b53cf5dbfee43d2ac7dfc40c456d0dfe:1707147212.078992"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 286
expires: Tue, 06 Feb 2024 20:30:08 GMT

GET ebg-query-params
memorialhermann.savings.beneplace.com/api/ 0
0

GET
H3 200 info
memorialhermann.savings.beneplace.com/api/ 10 KB
4 KB 195ms
194ms XHR
text/html 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://memorialhermann.savings.beneplace.com/api/info?authInfo=true

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann
tracestate: 88831@nr=0-1-2647367-1120218725-93ca3bd872e88f4d----1707247808225
traceparent: 00-62b7a3ed312a24dd2239e62ac6248800-93ca3bd872e88f4d-01
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI2NDczNjciLCJhcCI6IjExMjAyMTg3MjUiLCJpZCI6IjkzY2EzYmQ4NzJlODhmNGQiLCJ0ciI6IjYyYjdhM2VkMzEyYTI0ZGQyMjM5ZTYyYWM2MjQ4ODAwIiwidGkiOjE3MDcyNDc4MDgyMjUsInRrIjoiODg4MzEifX0=

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-powered-by
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
content-type: text/html; charset=utf-8
access-control-allow-origin: http://memorialhermann.savings.beneplace.com
cache-control: no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-ray: 8515ce517a7844f8-TXL
access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
expires: Tue, 06 Feb 2024 19:30:07 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=134178673&t=pageview&_s=1&dl=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2F&ul=en-us&de=UTF-8&dt=Memorial%20Hermann%20Employee%20Discount%20Spot&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=1961284718.1707247807&tid=UA-2876877-9&_gid=1131404336.1707247807&gtm=45He41v0n815QN8HWMv78847533za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=325947836

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 07:11:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 44290
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST track
events.api.boomtrain.com/event/ 0
0

GET
H2 200 RC668a267ca36c45b5acca38f3e4360a76-source.min.js Show response
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/2a83dd37052e/ 340 B
485 B 40ms
40ms Script
application/x-javascript 2a02:26f0:3500:58e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/2a83dd37052e/RC668a267ca36c45b5acca38f3e4360a76-source.min.js
Requested by: Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/assets/new-relic/new-relic-integration.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:58e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 085bc7a1ce126e629a6de81fee39984ba728e114792f0417057afe939bee67b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://memorialhermann.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
content-encoding: gzip
last-modified: Mon, 05 Feb 2024 15:33:32 GMT
server: AkamaiNetStorage
etag: "b53cf5dbfee43d2ac7dfc40c456d0dfe:1707147212.078992"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://memorialhermann.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 215
expires: Tue, 06 Feb 2024 20:30:08 GMT

GET
H3

429

Primary Request sign-in Show response
auth.savings.beneplace.com/memorialhermann/
Redirect Chain

https://auth.savings.beneplace.com/auth/authorize?subdomain=memorialhermann&response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fre...
https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1...

20 KB
21 KB

43ms
43ms

Document
text/html

104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp

Requested by

Host: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/main.e6cee9663d1e3a18.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c37b10521aee291762b0cec2cbcef09c897c08650058ba40e92fced7901f2c1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://memorialhermann.savings.beneplace.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated: challenge
cf-ray: 8515ce53efbb44f8-TXL
content-length: 20916
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Tue, 06 Feb 2024 19:30:08 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

Redirect headers

access-control-allow-headers: Origin, Referer, X-Requested-With, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: http://auth.savings.beneplace.com
alt-svc: h3=":443"; ma=86400
cache-control: no-cache no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8515ce52bd0b44f8-TXL
content-type: text/html; charset=utf-8
date: Tue, 06 Feb 2024 19:30:08 GMT
expires: Tue, 06 Feb 2024 19:30:07 GMT
location: /memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
server: cloudflare
strict-transport-security: max-age=2592000; includeSubDomains
vary: Origin, Accept
x-content-type-options: nosniff
x-powered-by

GET
H3 200 gtm.js
www.googletagmanager.com/ Frame B74B 119 KB
0 51ms
49ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5QN8HWM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80822
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 18:16:06 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 06 Feb 2024 19:30:08 GMT

GET
H2 200 launch-a0e5cece2585.min.js
assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/ Frame B74B 654 KB
155 KB 43ms
40ms Script
application/x-javascript 2a02:26f0:3500:58e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/a281455e4dfe/86f9b29df5eb/launch-a0e5cece2585.min.js
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Fsilent-refresh.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:58e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
content-encoding: gzip
last-modified: Mon, 05 Feb 2024 15:33:27 GMT
server: AkamaiNetStorage
etag: "4f34e4f3803a576c24964af1998b2cf5:1707147207.900002"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://auth.savings.beneplace.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 158680
expires: Tue, 06 Feb 2024 20:30:08 GMT

GET new-relic-integration.js
auth.savings.beneplace.com/assets/new-relic/ Frame B74B 0
0

GET bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ Frame B74B 0
0

GET js
maps.googleapis.com/maps/api/ Frame B74B 0
0

GET
H2 200 web-animations.min.js
cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/ Frame B74B 47 KB
14 KB 50ms
48ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/web-animations/2.3.1/web-animations.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.beneplace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5835177
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 13763
last-modified: Mon, 04 May 2020 16:17:51 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0402f-bad6"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MGgSdnCYLyo8ScAHdbJUeJy5%2FVs43mRHZGwF86DCq2f1BIPE%2Fw%2Bm%2B7m%2FZsirqcvPnbIRPZ43kVE5%2B%2B8cw%2F58msvVjaFGHU6BA4nYOIMeIVmFFfrgftBze1UMnxcXFBWV7%2BGwMs8fBngMO07kNk5cb2SU"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8515ce5318585c1a-FRA
expires: Sun, 26 Jan 2025 19:30:08 GMT

GET runtime.13338c5d9c83d0b6.js
auth.savings.beneplace.com/ Frame B74B 0
0

GET polyfills.d382160f8481ef1c.js
auth.savings.beneplace.com/ Frame B74B 0
0

GET scripts.1baad6c013597821.js
auth.savings.beneplace.com/ Frame B74B 0
0

GET main.1251aa6e46063537.js
auth.savings.beneplace.com/ Frame B74B 0
0

GET
H3 200 v1 Show response
auth.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 157 KB
53 KB 43ms
43ms Script
application/javascript 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8515ce53efbb44f8

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41f4bf7adcb5af0385ff82ca347bdea3aa8c8f3293faf1db21e33bc1a8cf7e9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp&__cf_chl_rt_tk=oNKjY.EPnq7KpayGz.OIM7.M1Ivc6CKcjGTTfbK5Fuc-1707247808-0-zRaQ
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8515ce54589244f8-TXL
alt-svc: h3=":443"; ma=86400

GET
H2 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/g/ea25f566/ 37 KB
13 KB 156ms
75ms Script
application/javascript 2606:4700::6811:3b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/g/ea25f566/api.js?onload=xZNcr9&render=explicit
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8515ce53efbb44f8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18cbe0edc0b01c71a6c3ffe704550a8bb1cfe7e02839b7dbdc9c44288bf8b59c

Request headers

Referer
Origin: https://auth.savings.beneplace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 8515ce553ce5366b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 favicon.ico
auth.savings.beneplace.com/ 1 KB
1 KB 173ms
173ms Image
text/html 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth.savings.beneplace.com/favicon.ico

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-src *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.beneplace.com:* *.workingadvantage.com:* *.ebgsolutions.com:* *.demdex.net:* *.everesttech.net:* *.adobedtm.com *.sc.omtrdc.net *.omtrdc.net *.qualtrics.com *.adobe.com *.keen.io *.youtube.com *.kaltura.com *.libertymutual.com
last-modified: Thu, 01 Feb 2024 11:49:20 GMT
server: cloudflare
cf-cache-status: HIT
content-encoding: br
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cf-ray: 8515ce54a97d44f8-TXL
alt-svc: h3=":443"; ma=86400

GET
BLOB 200
OK 9efdf682-1517-4363-b259-82f1bd94abbf
https://auth.savings.beneplace.com/ 13 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://auth.savings.beneplace.com/9efdf682-1517-4363-b259-82f1bd94abbf
Requested by: Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Length: 13
Content-Type: text/javascript

POST
H3 200 f54766de1ecb4e3 Show response
auth.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/flow/ov1/2076591931:1707244078:Q6amnnqwRM6UN_L4F2EVob-wSMSvlLPaUyxRmM6Ab9o/8515ce53efbb44f8/ 13 KB
10 KB 65ms
64ms XHR
text/plain 104.18.37.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/flow/ov1/2076591931:1707244078:Q6amnnqwRM6UN_L4F2EVob-wSMSvlLPaUyxRmM6Ab9o/8515ce53efbb44f8/f54766de1ecb4e3

Requested by

Host: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8515ce53efbb44f8

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.37.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6af4eee716d9eb98adf098520c5a4043a14aff8affe6341542272871c2fc035

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
CF-Challenge: f54766de1ecb4e3
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 06 Feb 2024 19:30:08 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 8515ce556b3e44f8-TXL
alt-svc: h3=":443"; ma=86400
cf-chl-gen: qFvFBN25GP97OG55sAE3VadhB5xcvuwFHK66n3IDaOmpHjXlr0+5JGxAyainOXnP$xipExW5l9+LJuOm7bsIqXQ==

GET
H3 200 normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hkuqe/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame D1AE 0
0 96ms
50ms Document
text/html 2606:4700::6811:3b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hkuqe/0x4AAAAAAADnPIDROrmt1Wwj/light/normal

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/ea25f566/api.js?onload=xZNcr9&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8515ce5638c49046-FRA
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Tue, 06 Feb 2024 19:30:09 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: memorialhermann.savings.beneplace.com
URL: https://memorialhermann.savings.beneplace.com/api/ebg-query-params

Domain: events.api.boomtrain.com
URL: https://events.api.boomtrain.com/event/track

Domain: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/assets/new-relic/new-relic-integration.js

Domain: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/bootstrap.min.css

Domain: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?client=gme-entertainmentbenefits&libraries=places

Domain: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/runtime.13338c5d9c83d0b6.js

Domain: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/polyfills.d382160f8481ef1c.js

Domain: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/scripts.1baad6c013597821.js

Domain: auth.savings.beneplace.com
URL: https://auth.savings.beneplace.com/main.1251aa6e46063537.js

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.beneplace.com/	1970-01-20 18:14:09	Name: __cf_bm Value: o9e1DEJ5qO0JoHZiIvPQeGNS_Xz8qfh9.QprBFEZV7k-1707247805-1-AYovEPfiN39p243/NT7RfD6F/biKBegtZOpWDS1x0NmcxT1Pssb3yNM5GFw+l3kzG/HVYmx2csv5U0ZTHN1NR+A=
.beneplace.com/	1969-12-31 23:59:59	Name: _cfuvid Value: wVfOvpe6QHdxx3y7RQpNGHIeTLXULkVEW99IslXHE6o-1707247805909-0-604800000
.beneplace.com/	1969-12-31 23:59:59	Name: AMCVS_B5F9FF2554F608410A4C98C6%40AdobeOrg Value: 1
.beneplace.com/	1970-01-21 03:50:07	Name: s_ecid Value: MCMID%7C06067287160669273590335384308973731335
.beneplace.com/	1970-01-21 03:50:07	Name: AMCV_B5F9FF2554F608410A4C98C6%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19760%7CMCMID%7C06067287160669273590335384308973731335%7CMCAAMLH-1707852606%7C6%7CMCAAMB-1707852606%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1707255006s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.4.0
.beneplace.com/	1970-01-21 03:50:07	Name: _ga Value: GA1.2.1961284718.1707247807
.beneplace.com/	1970-01-20 18:15:34	Name: _gid Value: GA1.2.1131404336.1707247807
.beneplace.com/	1970-01-20 18:14:07	Name: _gat_UA-2876877-9 Value: 1
.beneplace.com/	1970-01-21 02:59:43	Name: cf_clearance Value: VPsmbw.cy5O11SMf9GHq2XjhqV_zJ73xkteCJMEJrf4-1707247807-1-AYOuUSYyQr263ex4FPj4eqXk5eXQqRx5rd7dEhrIaMhH3L/L7MyL6nd15i3sRqcWfAl6m/xhf/kQq3Vj+PQT/fE=
.rezync.com/	1970-01-20 22:33:19	Name: zync-uuid Value: 1157cfd0-26c7-419f-acce-7f89cc5af390:1707247807.377582
live.rezync.com/	1970-01-20 22:33:19	Name: sd-session-id Value: eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiMTE1N2NmZDAtMjZjNy00MTlmLWFjY2UtN2Y4OWNjNWFmMzkwOjE3MDcyNDc4MDcuMzc3NTgyIn0.ZcKIvw.65D_Cefi-DaS1t7A9Pe7OsbS9Uk
.adnxs.com/	1970-01-20 20:23:43	Name: XANDR_PANID Value: A1lFC7YysGDwgkvy3TGq-zN2zXLGra0uvQAIDEfKCKWDiloc7OPfATymsihtSLG1RttepDM313HzNT8ofmSsZ_Q-LSKNryqQCuxXk7eisXQ.
.adnxs.com/	1970-01-21 03:50:07	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 20:23:43	Name: uuid2 Value: 8386643475384328793
.beneplace.com/	1970-01-21 02:59:43	Name: btIdentify Value: dbd9c119-7378-448c-b1e4-f5d6ba28475b
.beneplace.com/	1970-01-20 18:14:11	Name: _bts Value: 27ff7219-0950-4b88-de1e-709988bdf63e
.adnxs.com/	1970-01-20 20:23:43	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2IlliCLcX!]tbP6j2F-XstGt!@Dgl$o?9l
.doubleclick.net/	1970-01-20 18:14:08	Name: test_cookie Value: CheckForPermission
.doubleclick.net/	1970-01-20 18:57:19	Name: ar_debug Value: 1
.doubleclick.net/	1970-01-20 22:33:19	Name: receive-cookie-deprecation Value: 1
com-wag3.netmng.com/	1970-01-20 22:37:39	Name: evo5_WAG3 Value: ozju6oauwsang%7CO%7CWnpSaVNFcEVaV2xKU0hkdWFpOXZjM0JTZFdwYVNsTlpia0V6V1ZGaFMyZGxjMnBSUm5keVpYQjViM0ozTlVORGN6WTBTemRZT1hOWlRIQjVNWGhRVkVoRVNrSXhORXMxTlZwS1YxRnhSRE5GUTJ4RGVsQjRWMGxpZFVZM1VuUkZkRVkxWVRsV2NtMU9VWEpKWjNkUU1XbDRSbmRMWTBsaVZUYzRia3R5YnpKUVRIbHlPRE5tWkZNdlVHeFBOVzFuYVZBcmRGWTRXVWRWSzFWekwxaFBibE5TTld4R2VucGFla2w1VlV0ME5rVkJhWGxzVVhocFNYQTRZMFJPYzNOeTpJY2FCK0dZNFc3V0NhWFJSR05jQ1hBPT0%3D
.beneplace.com/	1970-01-21 03:50:07	Name: _ga_2K753Z6D0L Value: GS1.2.1707247807.1.1.1707247808.0.0.0
.beneplace.com/	1970-01-21 02:59:43	Name: _bti Value: %7B%22app_id%22%3A%22ebg-wag3%22%2C%22bsin%22%3A%22wFj8cX9AWCgMzyJw5YgxZHa1rWVnfLiac%2FSdHovGI4dVdEBzP1%2BQxg%2BLPOsc2pnChZmo3Bz3Vk7F6Jr4RCF%2F%2Fw%3D%3D%22%2C%22is_identified%22%3Afalse%7D
.beneplace.com/	1970-01-21 03:50:07	Name: _ga_FD2X5ZMELR Value: GS1.1.1707247806.1.0.1707247808.0.0.0
auth.savings.beneplace.com/	1970-01-20 18:14:11	Name: cf_chl_3 Value: f54766de1ecb4e3

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/relay?dlk=2g1c1ezj97i0jazm0gjwlr&corpRedirectUri=https%3A%2F%2Foffers.beneplace.com%2Faccount.php%3Fsub%3Dfunlife_how-it-works%26utm_source%3Demail%26utm_medium%3DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%26utm_campaign%3DFunlife-Rewards-hero-cta&subdomain=memorialhermann Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://memorialhermann.savings.beneplace.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'browsing-topics'.
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://auth.savings.beneplace.com/memorialhermann/sign-in?response_type=code&client_id=9ezalirn45mF43imJTdf53&redirect_uri=https%3A%2F%2Fmemorialhermann.savings.beneplace.com%2Frelay%3Fdlk%3D2g1c1ezj97i0jazm0gjwlr%26corpRedirectUri%3Dhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%26subdomain%3DmemorialhermanncorpRedirectUri%3D%5Bhttps%253A%252F%252Foffers.beneplace.com%252Faccount.php%253Fsub%253Dfunlife_how-it-works%2526utm_source%253Demail%2526utm_medium%253DFebruary-06-2024-FunLife-Rewards-Email2-G3-Resend%2526utm_campaign%253DFunlife-Rewards-hero-cta%5Dcorp Message: Failed to load resource: the server responded with a status of 429 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-src .beneplace.com: .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com .libertymutual.com 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' .beneplace.com:* .workingadvantage.com: .ebgsolutions.com: .demdex.net: .everesttech.net: .adobedtm.com .sc.omtrdc.net .omtrdc.net .qualtrics.com .adobe.com .keen.io .youtube.com .kaltura.com *.libertymutual.com
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
adservice.google.com
assets.adobedtm.com
auth.savings.beneplace.com
cdn.boomtrain.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
challenges.cloudflare.com
com-wag3.netmng.com
dpm.demdex.net
e.email.workingadvantage.com
events.api.boomtrain.com
fonts.gstatic.com
live.rezync.com
maps.googleapis.com
memorialhermann.savings.beneplace.com
people.api.boomtrain.com
region1.google-analytics.com
secure.adnxs.com
smetrics.beneplace.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
auth.savings.beneplace.com
cdn.jsdelivr.net
events.api.boomtrain.com
maps.googleapis.com
memorialhermann.savings.beneplace.com
104.18.37.20
13.32.27.83
172.217.16.134
18.66.122.29
185.89.210.82
199.38.167.54
2001:4860:4802:34::36
2606:4700::6810:5814
2606:4700::6811:180e
2606:4700::6811:3b8
2a00:1450:4001:806::2003
2a00:1450:4001:809::200a
2a00:1450:4001:811::2002
2a00:1450:4001:811::2008
2a00:1450:4001:829::200e
2a00:1450:400c:c00::9b
2a02:26f0:3500:58e::1e80
54.157.9.158
54.247.78.255
63.140.62.27
96.47.24.171
05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9
085bc7a1ce126e629a6de81fee39984ba728e114792f0417057afe939bee67b2
0964994f1e4c962fa1052aad2f19aa2e1a96d4f86573e034cb459cdb9b897fde
0ccde71f86599f54f18dada02e526b2eb4c3cd0b3d99822a171dba56457f6083
18cbe0edc0b01c71a6c3ffe704550a8bb1cfe7e02839b7dbdc9c44288bf8b59c
1a376f2411821d18b04194b19b9c45226eac8030f0bde1d2ca8ddc34a090791b
1da6ad9dfce9466037ec92e1f7699158c9a9347c669333c724f5cf6f3a7c0634
1fedfbb6961ad650024c2e8e87e7899b34e7bfb9ac7148d3b59c97110a34e8ba
2aef73d8723fb7d91d516282c5a33140f448212e7d49898baab65f6c8b74ddc6
2c8b1fcae5798c86bedf0c01911eda98ecb4c8016bbb8aaf031d0135ec050eea
335d3f13f55dd97df4c656d79878b695825c5ef93597d0693a44f408e21ce0f7
341083bce636014fe77945e54a94e8cce5c1a34cfe400bffe146af1e78e73cae
41bfa45d2b0cef4f8773c456508b230bf280a742f06b1084f1124f64d39e1507
41f4bf7adcb5af0385ff82ca347bdea3aa8c8f3293faf1db21e33bc1a8cf7e9f
462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575
46f16c323557a318dd6604bab3ebe8dbd9d23bc318b55eec33b0b0a4502c0bd1
4770d10167ff11b08b55d12cfb8696ad1373d11fa70dc6afcad09fa1a08882a5
484a811f5d10f04a8ad4abc8f9e13247743ceb6b0fb9e9453622f62b66751b21
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4cd3ef0e322636723919ee8bd942cd075d6fe0532fbb545f9a749c66d6af6356
51c28a44c986a235c6d74f2abfbafd9c9a01452515258628e10cbe3024c45a4e
62ec57b7f971a77af7380ce75ee21e1b881fd1fa628efdb36607125004cca092
693e593fad4e1d333aa76087393c270334461e960d20e276c633991431c1c230
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
90e7be434dd269f59bb0496832baada53db05e1d31951ce577b0fc9505b0f50a
9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
95d5abcb91cc12fc9d24284013e163a86826740c870c4b1d5375c015c6726a22
9f677880f0d7ec0a5faa8ad02c6f613d39a4535430d745aa9aadd5340a870849
aba7991bfc62a413ff4a27b8882721bd3c3f0e858a75501979e34306e1b64fa2
bbc90a700e8b6e0bde36997b17555946a793f583ad1ab16d546cd0c781a3ddcf
bc49c009b33e66a59f057cf4ada682b80d4401d919ddf0f8d3ef2bb0415f0b23
c37b10521aee291762b0cec2cbcef09c897c08650058ba40e92fced7901f2c1f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cbb3c795fd44c83a1200149b18e0df050fe228df4b5b03891373029117d8bd6b
cc714807f31bbe12fa9294fa54b78b66664c125d2bed1a042df5c40d7d8e8441
d4ae5188a65370ecfe28f42293bbee8297cfd5712c6aadfdb270d48f2bcd88b0
dbbb0f07e193366f98beb4ff0372c2e4f5f5f40fb358e1407aa7095166f9b09d
dd65d3afcbd78ae16191bb1c49024cb5039be508b59dec6615709049f4e5c0dc
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea3d356230da20a9876271fbb4c85ffa912fe03868fe3021069d1a1c3415a072
eae9405da94e80d954dbeeb7e60ae5898121aa4da136a71e388c110964e05273
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f6af4eee716d9eb98adf098520c5a4043a14aff8affe6341542272871c2fc035
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

auth.savings.beneplace.com Open in urlscan Pro 104.18.37.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

65 Requests

80 %HTTPS

52 %IPv6

16 Domains

23 Subdomains

20 IPs

5 Countries

2123 kBTransfer

8856 kBSize

25 Cookies

1 Outgoing links

Page URL History

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

auth.savings.beneplace.com Open in urlscan Pro
104.18.37.20 Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

80 %
HTTPS

52 %
IPv6

16
Domains

23
Subdomains

20
IPs

5
Countries

2123 kB
Transfer

8856 kB
Size

25
Cookies

65 HTTP transactions
1 data transactions