apply.coveredca.com Open in urlscan Pro
2a02:26f0:1700:1b2::2a46 Public Scan

Software

cafe /

Resource Hash

c6c7089442c54fdc6e7cc2dcd6e276f0c4fda32c642be1a904081c98806e7e72

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4922306.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://apply.coveredca.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:20 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 408
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 07-Jul-2021 00:08:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:19 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://4922306.fls.doubleclick.net/activityi;dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

activityi;dc_pre=CKGX_oLSz_ECFVeO3gode9YJWA;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2... Show response
4922306.fls.doubleclick.net/ Frame 9AE1
Redirect Chain

https://4922306.fls.doubleclick.net/activityi;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker...
https://4922306.fls.doubleclick.net/activityi;dc_pre=CKGX_oLSz_ECFVeO3gode9YJWA;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2F...

421 B
377 B

125ms
73ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4922306.fls.doubleclick.net/activityi;dc_pre=CKGX_oLSz_ECFVeO3gode9YJWA;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac95a06f9b875bccbf55b83ce26ffabd6dd4e9d3ca1ed68d90a9edade762b5ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4922306.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CKGX_oLSz_ECFVeO3gode9YJWA;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://apply.coveredca.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:20 GMT
expires: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 352
x-xss-protection: 0
set-cookie: IDE=AHWqTUnlfPtrcv12ArW4ZbyxW7hPzdzxS7dkLfyBuQXXrdd-i-e3sajBAkGThoWI7Hc; expires=Sun, 31-Jul-2022 23:53:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:19 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://4922306.fls.doubleclick.net/activityi;dc_pre=CKGX_oLSz_ECFVeO3gode9YJWA;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

activityi;dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2... Show response
4922306.fls.doubleclick.net/ Frame C4C2
Redirect Chain

https://4922306.fls.doubleclick.net/activityi;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker...
https://4922306.fls.doubleclick.net/activityi;dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2F...

509 B
427 B

117ms
59ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4922306.fls.doubleclick.net/activityi;dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

697da2dc59c5766acda2ffbf64527388465a3397f83a2bfae2b9fcc68aa6ed50

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4922306.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://apply.coveredca.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:20 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 402
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 07-Jul-2021 00:08:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:19 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://4922306.fls.doubleclick.net/activityi;dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bat.js Show response
bat.bing.com/ 30 KB
9 KB 73ms
56ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 73e2e5173ed0d5a77b02914fa0ef1f67bb53143da75f0348f558f95565220ca1

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:19 GMT
content-encoding: gzip
last-modified: Fri, 28 May 2021 20:25:24 GMT
x-msedge-ref: Ref A: AAC581B726AA4FA3BA6391F113A5B895 Ref B: FRAEDGE1219 Ref C: 2021-07-06T23:53:19Z
etag: "0d2a696ff53d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 9008

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 22ms
6ms Script
application/x-javascript 2a02:26f0:6c00:2b0::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b0::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6e6e6a03e72a528c28884b50bf296425667f38dd0aaf1dd17ce89199ffc85271

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 23:53:19 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Jun 2021 01:25:13 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=20082
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2079

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 154ms
50ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ce8edccdc98a1f67c6d81ce452ac32192a9fc0c7a2828ea2dc6747c291cb5919

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:19 GMT
via: 1.1 varnish
last-modified: Fri, 02 Jul 2021 22:49:15 GMT
age: 86013
etag: "cf581d46c3059bf617cb7f732c21a59e+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1625615600.899684,VS0,VE0
x-served-by: cache-fra19139-FRA

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 95 KB
25 KB 19ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0d17b8a38d3dce6f7357bbc8da105d92c21b6cf1c4b92351ce2b1861b065f2c5

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 24676
x-xss-protection: 0
pragma: public
x-fb-debug: tBcyVzI/hmcB4zn8bVOz/BwTocNKga1ewrM6KSPMcexYfPgzc7onTVl9UZfmY//r5iIhX7PjbQfSbK/k1RoVuQ==
x-fb-trip-id: 2050670934
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
date: Tue, 06 Jul 2021 23:53:19 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/container/15887;115892;12203;iframe/ Frame E438 2 KB
3 KB 254ms
72ms Document
text/html 209.197.3.19
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://servedby.flashtalking.com/container/15887;115892;12203;iframe/?ft_referrer=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&ns=&cb=1243416792
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.19 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: vip0x013.map2.ssl.hwcdn.net
Software: prod-xre-app20.lhr11 /
Resource Hash: 438f14bf65d13fcba74fcdc746158bde7230842b099d9cc3bec4cbeecae13790

Request headers

Host: servedby.flashtalking.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://apply.coveredca.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://apply.coveredca.com/

Response headers

Date: Tue, 06 Jul 2021 23:53:19 GMT
Connection: close
Cache-Control: no-cache, no-store
Content-Type: text/html
Server: prod-xre-app20.lhr11
Pragma: no-cache
X-HW: 1625615599.dop026.lo4.t,1625615599.cds202.lo4.shn,1625615599.dop026.lo4.t,1625615599.cds001.lo4.sc,1625615599.cds001.lo4.p

GET
H2 200 activityi;register_conversion=1;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
4922306.fls.doubleclick.net/ 0
0 149ms
60ms Image
text/html 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4922306.fls.doubleclick.net/activityi;register_conversion=1;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s49-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 activityi;register_conversion=1;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
4922306.fls.doubleclick.net/ 0
0 152ms
63ms Image
text/html 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4922306.fls.doubleclick.net/activityi;register_conversion=1;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s49-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 activityi;register_conversion=1;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
4922306.fls.doubleclick.net/ 0
0 149ms
60ms Image
text/html 142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://4922306.fls.doubleclick.net/activityi;register_conversion=1;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s49-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2088348&time=1625615599791&url=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2088348%26time%3D1625615599791%26url%3Dhttps%253A%252F%252Fapply.coveredca.com%25...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2088348&time=1625615599791&url=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2088348&time=1625615599791&url=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&liSync=true&e_ipv6=AQJRoJkj15cPxwAAAXp-PYvxHYcPC7AU5tMif...

0
155 B

504ms
230ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2088348&time=1625615599791&url=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&liSync=true&e_ipv6=AQJRoJkj15cPxwAAAXp-PYvxHYcPC7AU5tMifZlvajmOPnERsFDydvs6anqlEKJQN8crgI4N
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:21 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-edc2
content-type: application/javascript
content-length: 0
x-li-uuid: G30VusZYjxaAd02PEysAAA==

Redirect headers

date: Tue, 06 Jul 2021 23:53:20 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2088348&time=1625615599791&url=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&liSync=true&e_ipv6=AQJRoJkj15cPxwAAAXp-PYvxHYcPC7AU5tMifZlvajmOPnERsFDydvs6anqlEKJQN8crgI4N
x-li-proto: http/2
x-li-pop: prod-esv5
content-length: 0
x-li-uuid: DZhZn8ZYjxbA8eIrdSsAAA==

GET
H2 200 1085919381420494 Show response
connect.facebook.net/signals/config/ 47 KB
13 KB 55ms
55ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1085919381420494?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b323d58aa1c415d051f4c045273f19d1b676cccf32b2cc438a20caa83ff4652d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: 6MbJW/ZnavtKYu9Q4FjoWc6RebfqcVQdJTLE6x6Wh13iXrdj5ldk+Tbr92FLjI5Mtc9f3lkwC6Zh8jE8CanVWQ==
x-fb-trip-id: 2050670934
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
date: Tue, 06 Jul 2021 23:53:19 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK Cookie set open-sans-v16-latin-regular.woff2
apply.coveredca.com/hix/resources/fonts/open-sans/ 14 KB
15 KB 188ms
188ms Font
font/woff2 2a02:26f0:1700:1b2::2a46
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.coveredca.com/hix/resources/fonts/open-sans/open-sans-v16-latin-regular.woff2

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/resources/fonts/open-sans/stylesheet.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1b2::2a46 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://apply.coveredca.com
Accept-Encoding: gzip, deflate, br
Host: apply.coveredca.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://apply.coveredca.com/hix/resources/fonts/open-sans/stylesheet.css
Cookie: AWSALBTG=fv9sM41lhxLxUB0/ebNPGxnu9+FsB1sP6m3OWfYHmBLiU119xUnQ/5uWqSLCxHrogKXTNHR2jrR6xswPyVCPfsxVhWUVRyix1Vopgfuml+HvD5TRSwYJ9JnqxPgOBD3P8hwG/L9rIEHVuYTVlJ4TCU7K1tjniDfnDCmYnd8shGMxwaea0ow=; AWSALBTGCORS=fv9sM41lhxLxUB0/ebNPGxnu9+FsB1sP6m3OWfYHmBLiU119xUnQ/5uWqSLCxHrogKXTNHR2jrR6xswPyVCPfsxVhWUVRyix1Vopgfuml+HvD5TRSwYJ9JnqxPgOBD3P8hwG/L9rIEHVuYTVlJ4TCU7K1tjniDfnDCmYnd8shGMxwaea0ow=; OAMAuthnHintCookie=0@1625615598; OAMAuthnCookie_apply.coveredca.com:443=ac534ebd1395b37dbaa784a581896c9a227984f7%7Ee0SdDGnhv6jGicw32qUW7giAyjcPMwEAkQPXvPK7LY7wa874M3JWvs9yCKx1EsRrYkIV5vhqkDLzecEsZKIyDFfjGLWX2OjEEy6QHUufU3BHrJYD%2FucIGir401qDYkgDccTN8xGAeiuz2bupRIqyi5ftLLiv2RwlwHydsIujr%2BMUrjZMePk9MfSAUhfGng8JO2w7YwaiTBK8%2FNCbvIrHatJUmaq1QrajcchRZGoRjGNhDxSVPIX%2B60xNTS%2BaZEG8U1EYFHN%2BGBwLEfmk9ccCprhSexFEJ8RAMyNhf0JGdp7TUkcCuvfx8UPRfnGv%2FfkqXZK9s6IpnprnGkMDdpCuDkO%2F5i6%2BzhIoGxkh6S4UmYcs%2BhrCSI8aq3P1Qwb%2Fnw04cT4g6%2F2lQYZVp9iwGCDVbA%3D%3D; SESSIONGHIX=qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351; dtCookie=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_rcs-3Acss_0; rxVisitor=1625615598841RVS5SQDEVT0HLKKA6JIHLQGKAIVUMU8B; dtSa=-; dtLatC=64; rxvt=1625617398849|1625615598843; dtPC=3$215598836_930h1vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1; akavpau_default=1625616199~id=4c2aa3c10ba27d334e709c48ef09b722; dtsrE=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0=enabled; RT="z=1&dm=apply.coveredca.com&si=8f3e40b9-9eac-4ea9-a83f-eedb83ded164&ss=kqspjywm&sl=0&tt=0&bcn=%2F%2F6852bd08.akstat.io%2F"; _gcl_au=1.1.854706835.1625615600
Connection: keep-alive
Origin: https://apply.coveredca.com
Referer: https://apply.coveredca.com/hix/resources/fonts/open-sans/stylesheet.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
ETag: "1592535274:dtagent10215210506134511qfb0"
Content-Type: font/woff2
Server-Timing: cdn-cache; desc=MISS edge; dur=105 origin; dur=72 dtRpid;desc="-1909362566"
Content-Length: 14380
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Fri, 19 Jun 2020 02:54:33 GMT
Server
Cache-Control: no-cache
Date: Tue, 06 Jul 2021 23:53:20 GMT
X-FRAME-OPTIONS: SAMEORIGIN
X-ORACLE-DMS-ECID: JVMD-qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351!1625615598572-6139336938955935
Content-Language: en
Access-Control-Allow-Origin: *
Connection: keep-alive
Set-Cookie: AWSALBTG=pewL39oA3FvPqwZ56k0dqLtJBS8RH6/PZlguXcchQaNFkvBPttbPPSzjQNriJuhg2FW1sUGBFdI8x2N4qyA+wj0LgruISYi6y/L/kSRyWQRXziEm5wuUuR8QYaPufwYdxqMLervG4gh0iqae6vOqlT7g8qcl6De1C1TtmuU/Kf0kSQJWQKs=; Expires=Tue, 13 Jul 2021 23:53:19 GMT; Path=/ AWSALBTGCORS=pewL39oA3FvPqwZ56k0dqLtJBS8RH6/PZlguXcchQaNFkvBPttbPPSzjQNriJuhg2FW1sUGBFdI8x2N4qyA+wj0LgruISYi6y/L/kSRyWQRXziEm5wuUuR8QYaPufwYdxqMLervG4gh0iqae6vOqlT7g8qcl6De1C1TtmuU/Kf0kSQJWQKs=; Expires=Tue, 13 Jul 2021 23:53:19 GMT; Path=/; SameSite=None; Secure akavpau_default=1625616200~id=c4726a4ff50fb2c9368e9b608606c077; Domain=apply.coveredca.com; Path=/; HttpOnly; Secure; SameSite=None
Timing-Allow-Origin: *

GET
H/1.1 200
OK Cookie set environment Show response
apply.coveredca.com/hix/ui/ 3 KB
4 KB 194ms
194ms XHR
application/json 2a02:26f0:1700:1b2::2a46
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.coveredca.com/hix/ui/environment

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/ruxitagentjs_ICA2QSVfjqrux_10215210506134511.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1b2::2a46 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

50e1ef54b6b67642456cd0187f97488e35f2adf05b2ac896ceed1e31703061c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: apply.coveredca.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
x-dtpc: 3$215598836_930h4vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1
Accept: application/json, text/javascript, */*; q=0.01
Cache-Control: no-cache
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
Cookie: AWSALBTG=fv9sM41lhxLxUB0/ebNPGxnu9+FsB1sP6m3OWfYHmBLiU119xUnQ/5uWqSLCxHrogKXTNHR2jrR6xswPyVCPfsxVhWUVRyix1Vopgfuml+HvD5TRSwYJ9JnqxPgOBD3P8hwG/L9rIEHVuYTVlJ4TCU7K1tjniDfnDCmYnd8shGMxwaea0ow=; AWSALBTGCORS=fv9sM41lhxLxUB0/ebNPGxnu9+FsB1sP6m3OWfYHmBLiU119xUnQ/5uWqSLCxHrogKXTNHR2jrR6xswPyVCPfsxVhWUVRyix1Vopgfuml+HvD5TRSwYJ9JnqxPgOBD3P8hwG/L9rIEHVuYTVlJ4TCU7K1tjniDfnDCmYnd8shGMxwaea0ow=; OAMAuthnHintCookie=0@1625615598; OAMAuthnCookie_apply.coveredca.com:443=ac534ebd1395b37dbaa784a581896c9a227984f7%7Ee0SdDGnhv6jGicw32qUW7giAyjcPMwEAkQPXvPK7LY7wa874M3JWvs9yCKx1EsRrYkIV5vhqkDLzecEsZKIyDFfjGLWX2OjEEy6QHUufU3BHrJYD%2FucIGir401qDYkgDccTN8xGAeiuz2bupRIqyi5ftLLiv2RwlwHydsIujr%2BMUrjZMePk9MfSAUhfGng8JO2w7YwaiTBK8%2FNCbvIrHatJUmaq1QrajcchRZGoRjGNhDxSVPIX%2B60xNTS%2BaZEG8U1EYFHN%2BGBwLEfmk9ccCprhSexFEJ8RAMyNhf0JGdp7TUkcCuvfx8UPRfnGv%2FfkqXZK9s6IpnprnGkMDdpCuDkO%2F5i6%2BzhIoGxkh6S4UmYcs%2BhrCSI8aq3P1Qwb%2Fnw04cT4g6%2F2lQYZVp9iwGCDVbA%3D%3D; SESSIONGHIX=qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351; dtCookie=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_rcs-3Acss_0; rxVisitor=1625615598841RVS5SQDEVT0HLKKA6JIHLQGKAIVUMU8B; dtSa=-; dtLatC=64; akavpau_default=1625616199~id=4c2aa3c10ba27d334e709c48ef09b722; dtsrE=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0=enabled; RT="z=1&dm=apply.coveredca.com&si=8f3e40b9-9eac-4ea9-a83f-eedb83ded164&ss=kqspjywm&sl=0&tt=0&bcn=%2F%2F6852bd08.akstat.io%2F"; _gcl_au=1.1.854706835.1625615600; rxvt=1625617399847|1625615598843; dtPC=3$215598836_930h4vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1
Connection: keep-alive
Referer: https://apply.coveredca.com/hix/broker/search
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://apply.coveredca.com/hix/broker/search
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
x-dtpc: 3$215598836_930h4vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server-Timing: cdn-cache; desc=MISS edge; dur=102 origin; dur=82 dtRpid;desc="-2008126189"
Connection: keep-alive
Content-Length: 2870
X-XSS-Protection: 1; mode=block
Pragma: no-cache no-cache
Server
Date: Tue, 06 Jul 2021 23:53:20 GMT
X-FRAME-OPTIONS: SAMEORIGIN
X-ORACLE-DMS-ECID: JVMD-qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351!1625615598572-6139336965190090
Content-Language: en
Access-Control-Allow-Origin: *
Cache-Control: no-cache no-cache, no-store, must-revalidate
Set-Cookie: AWSALBTG=BnmJ55UvBH1KgXQ420RHM6xVa2GXb4AmdWpk9RIFBYO+eTq8y8hfJIfbo8dqMs5egCJt4sdaKUBIRO8kXI43QWSCeyu76IKH99WnrXI7Uy2HWYE4NU7vOxuAS2BsuuilSo+BVQpB0zGCCVC6Sib7RFnzLNzq4DjNerJpVSrqyaEyqvUoGIw=; Expires=Tue, 13 Jul 2021 23:53:19 GMT; Path=/ AWSALBTGCORS=BnmJ55UvBH1KgXQ420RHM6xVa2GXb4AmdWpk9RIFBYO+eTq8y8hfJIfbo8dqMs5egCJt4sdaKUBIRO8kXI43QWSCeyu76IKH99WnrXI7Uy2HWYE4NU7vOxuAS2BsuuilSo+BVQpB0zGCCVC6Sib7RFnzLNzq4DjNerJpVSrqyaEyqvUoGIw=; Expires=Tue, 13 Jul 2021 23:53:19 GMT; Path=/; SameSite=None; Secure akavpau_default=1625616200~id=c4726a4ff50fb2c9368e9b608606c077; Domain=apply.coveredca.com; Path=/; HttpOnly; Secure; SameSite=None
Content-Type: application/json;charset=UTF-8
Expires: -1

GET
H/1.1 200
OK x326r155540753 Show response
rs.gwallet.com/r1/pixeltag/ Frame 99CC 43 B
385 B 527ms
131ms Document
image/gif 199.127.207.182
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.gwallet.com/r1/pixeltag/x326r155540753
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 199.127.207.182 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: nginx/1.10.3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Host: rs.gwallet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://apply.coveredca.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://apply.coveredca.com/

Response headers

Server: nginx/1.10.3
Date: Tue, 06 Jul 2021 23:53:20 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3p: CP="PSAo PSDo OUR BUS DSP NON COR"
Vary: Origin
Pragma: no-cache
Cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Origin: *
useSecure: true

GET
H2 200 pixel.js Show response
a.tribalfusion.com/pixel/tags/Covered%20CA_Open%20Enrollment/778373/ 8 KB
2 KB 186ms
170ms Script
application/x-javascript 2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.tribalfusion.com/pixel/tags/Covered%20CA_Open%20Enrollment/778373/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c3c944fbccfba187fafda2404d8b9f3861089305cd83eaafd5c42aa8206909a

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:20 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
p3p: CP="NOI DEVo TAIa OUR BUS"
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 2005
x-function: 151
last-modified: Tue, 01 Jun 2021 04:13:17 GMT
server: cloudflare
x-reuse-index: 9
etag: 7739749654413288787
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=3600, private
cf-ray: 66acc07b4b494e4f-FRA
expires: Wed, 07 Jul 2021 00:53:19 GMT

GET
H2 200 convertions_tracker.php
atr.adsmovil.com/ 43 B
631 B 151ms
126ms Image
image/gif 2606:4700:3033::ac43:8174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://atr.adsmovil.com/convertions_tracker.php?event_id=114&event_value=0&macro_1=
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:8174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:20 GMT
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=1qFaldIHMsxxBYyruSYvYKiAM2MrpnE5WaQTdgSpZ%2Fx75Sqd7zCHRz5UTKK%2Fen9X4gwEVooCSqpl446gBwc5sSICLTRkg%2FHdc0IkVzVGOua4EntOzfaLmQm2fg%2B1fhvo2xbynPPXaqvT9A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
x-cloud-trace-context: b749afb42a8eeced6ed38d18d6f22e9b
cf-ray: 66acc07b5eb12bc6-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43

GET
H/1.1

200
OK

ppt=4162;g=lp_landing_page_pixel;gid=18389;ord=[uniqueid];ip=37.120.211.100;cuidchk=1
bm.adentifi.com/pixel/conv/
Redirect Chain

https://bm.adentifi.com/pixel/conv/ppt=4162;g=lp_landing_page_pixel;gid=18389;ord=[uniqueid]
https://bm.adentifi.com/pixel/conv/ppt=4162;g=lp_landing_page_pixel;gid=18389;ord=[uniqueid];ip=37.120.211.100;cuidchk=1

42 B
790 B

248ms
142ms

Image
image/gif

34.224.238.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bm.adentifi.com/pixel/conv/ppt=4162;g=lp_landing_page_pixel;gid=18389;ord=[uniqueid];ip=37.120.211.100;cuidchk=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.238.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 23:53:20 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 9 Nov 1980 12:59:00 GMT
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Sun, 9 Nov 1980 12:58:00 GMT

Redirect headers

Date: Tue, 06 Jul 2021 23:53:20 GMT
X-Content-Type-Options: nosniff
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: /pixel/conv/ppt=4162;g=lp_landing_page_pixel;gid=18389;ord=[uniqueid];ip=37.120.211.100;cuidchk=1
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 0

GET
H2 200 beacon
r.turn.com/r/ 43 B
407 B 58ms
29ms Image
image/gif 2001:678:cb4:bbbb::11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/beacon?b2=YicW90_fj2kGu-zTGhaHKiirm2ncyHpeZhptBblEVJahM8BMMyPXzW7DoyMFVmeDmZnjNGyUJpJvI-S5u0veTw&cid=
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:19 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3-29

200

src=10025605;dc_pre=CLGowYPSz_ECFdvMsgodpL4O1A;type=invmedia;cat=cca_h0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain

https://gwmtracking.com/p/v/1/5d02caf9f87081645be2f52a/format/img?
https://ad.doubleclick.net/ddm/activity/src=10025605;type=invmedia;cat=cca_h0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://ad.doubleclick.net/ddm/activity/src=10025605;dc_pre=CLGowYPSz_ECFdvMsgodpL4O1A;type=invmedia;cat=cca_h0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://adservice.google.com/ddm/fls/z/src=10025605;dc_pre=CLGowYPSz_ECFdvMsgodpL4O1A;type=invmedia;cat=cca_h0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

42 B
63 B

42ms
42ms

Image
image/gif

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=10025605;dc_pre=CLGowYPSz_ECFdvMsgodpL4O1A;type=invmedia;cat=cca_h0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:21 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=10025605;dc_pre=CLGowYPSz_ECFdvMsgodpL4O1A;type=invmedia;cat=cca_h0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 27009950.js Show response
bat.bing.com/p/action/ 0
150 B 131ms
131ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/27009950.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: C47F4EC803AF4515A49F52FE7886430E Ref B: FRAEDGE1219 Ref C: 2021-07-06T23:53:19Z
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
149 B 27ms
27ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=27009950&tm=gtm001&Ver=2&mid=43c31fd8-3cb1-4d7e-bfcc-fa480c5986cc&sid=57411c80deb511eba4f0c76699134f6c&vid=574167b0deb511ebbbe01fd1a0e595ca&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Covered%20California&p=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&r=&lt=2166&evt=pageLoad&msclkid=N&sv=1&rn=613077
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Tue, 06 Jul 2021 23:53:19 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 85C9C4918A2943CB80DB59769DE47766 Ref B: FRAEDGE1219 Ref C: 2021-07-06T23:53:19Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 552091788777106 Show response
connect.facebook.net/signals/config/ 51 KB
14 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/552091788777106?v=2.9.43&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

95d4a86e96607f2a85e63422e719c4050e8f62c83e94477d4baad47b9787422d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 14213
x-xss-protection: 0
pragma: public
x-fb-debug: iTaNFkakh4QG9XdykARK8Kp3G+SGHqyBt1+0X+d9QyWxApEGs56YZc51RhiNlgwaJ+c7r1Dp3TVRGD9uWxbziw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coop_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Tue, 06 Jul 2021 23:53:19 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coop_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 20ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1085919381420494&ev=PageView&dl=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&rl=&if=false&ts=1625615599938&sw=1600&sh=1200&v=2.9.43&r=stable&a=tmgoogletagmanager&ec=0&o=28&fbp=fb.1.1625615599937.1596995617&it=1625615599810&coo=false&rqm=GET

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:19 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 06 Jul 2021 23:53:19 GMT

GET
H2 200 adsct
t.co/i/ 43 B
454 B 247ms
152ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.0&p_id=Twitter&p_user_id=0&txn_id=o3mp0&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 06 Jul 2021 23:53:20 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 12099381d12c080427d94ace8d15b0154b32079dfd0434767da10104db75c118
x-transaction: 6cdf4cdd4f82bf3b
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 8ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=552091788777106&ev=PageView&dl=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&rl=&if=false&ts=1625615599950&sw=1600&sh=1200&v=2.9.43&r=stable&ec=0&o=28&fbp=fb.1.1625615599937.1596995617&it=1625615599810&coo=false&rqm=GET

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:19 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 06 Jul 2021 23:53:19 GMT

GET
H/1.1 200
OK /
servedby.flashtalking.com/segment/2/read/a;;pixel/ Frame E438 42 B
495 B 186ms
66ms Image
image/gif 209.197.3.19
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://servedby.flashtalking.com/segment/2/read/a;;pixel/?s=12203&d=apply.coveredca.com&r=hix/broker/search
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/container/15887;115892;12203;iframe/?ft_referrer=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&ns=&cb=1243416792
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.19 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: vip0x013.map2.ssl.hwcdn.net
Software: prod-xre-app2.lhr11 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: https://servedby.flashtalking.com/container/15887;115892;12203;iframe/?ft_referrer=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&ns=&cb=1243416792
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 23:53:20 GMT
Server: prod-xre-app2.lhr11
X-HW: 1625615600.dop029.lo4.shc,1625615600.dop029.lo4.t,1625615600.cds002.lo4.sc,1625615600.cds002.lo4.p
Content-Type: image/gif
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Length: 42

GET
H2 200 dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch Show response
adservice.google.com/ddm/fls/i/ Frame A837 508 B
470 B 62ms
41ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Requested by

Host: 4922306.fls.doubleclick.net
URL: https://4922306.fls.doubleclick.net/activityi;dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b7792181503c8393cf01adf6dd053f8374234a1d25e37943edfe4a1f134a846

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.com
:scheme: https
:path: /ddm/fls/i/dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4922306.fls.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4922306.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:20 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 401
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 26ms
5ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 1655
date: Tue, 06 Jul 2021 23:25:45 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Wed, 07 Jul 2021 01:25:45 GMT

GET
H2 200 dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch Show response
adservice.google.com/ddm/fls/i/ Frame 77AC 514 B
898 B 47ms
40ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Requested by

Host: 4922306.fls.doubleclick.net
URL: https://4922306.fls.doubleclick.net/activityi;dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

22330ab28e07dd9d2723a52181c49a8832642883a208b29cd5290bf02bce4afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.com
:scheme: https
:path: /ddm/fls/i/dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4922306.fls.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4922306.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:20 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 408
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 displayAd.js Show response
s.tribalfusion.com/ 677 B
706 B 165ms
164ms Script
application/x-javascript 2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/displayAd.js?dver=0.8&th=8645007496
Requested by: Host: a.tribalfusion.com
URL: https://a.tribalfusion.com/pixel/tags/Covered%20CA_Open%20Enrollment/778373/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f656899998100f3aa20e4a03bb5c9921fda83221b97fab697ca870606c44c1b7

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:20 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
p3p: CP="NOI DEVo TAIa OUR BUS"
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 327
x-function: 153
last-modified: Tue, 01 Jun 2021 04:13:16 GMT
server: cloudflare
x-reuse-index: 14
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: private
cf-ray: 66acc07c6cd74e4f-FRA
expires: Mon, 04 Oct 2021 23:53:20 GMT

GET
H/1.1 200
OK t.js Show response
u.tentaculos.net/580a8458-ca74-11e9-9bcc-0685dc1fc043/ 197 B
669 B 186ms
50ms Script
binary/octet-stream 143.204.98.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://u.tentaculos.net/580a8458-ca74-11e9-9bcc-0685dc1fc043/t.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-2.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 24f180b3796f97814756625b10f61db3d5fe0354136db5f15af6e9b20e4f32e7

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 14:54:08 GMT
Via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
Last-Modified: Thu, 29 Aug 2019 15:49:16 GMT
Server: AmazonS3
Age: 32353
ETag: "a425ee78e4951c050415d52eaa5b2f2e"
X-Cache: Hit from cloudfront
Content-Type: binary/octet-stream
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 197
X-Amz-Cf-Id: 89Dp0dYNiNFXhBBOcCyVD0PhG2IqjM6xG-p_5pW0illPceqg0pbg9Q==

GET
H2 200 activity;xsp=4525792;ord=1;num=6915298351214.461
pubads.g.doubleclick.net/ 42 B
554 B 211ms
114ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;xsp=4525792;ord=1;num=6915298351214.461?

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CKGX_oLSz_ECFVeO3gode9YJWA;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=*;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
adservice.google.com/ddm/fls/z/ Frame 9AE1 42 B
118 B 45ms
42ms Image
image/gif 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKGX_oLSz_ECFVeO3gode9YJWA;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=*;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Requested by

Host: 4922306.fls.doubleclick.net
URL: https://4922306.fls.doubleclick.net/activityi;dc_pre=CKGX_oLSz_ECFVeO3gode9YJWA;src=4922306;type=opene0;cat=oeeng00;ord=842107844008;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4922306.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 26ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&aip=1&a=1134514214&t=pageview&_s=1&dl=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&ul=en-us&de=UTF-8&dt=Covered%20California&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=893062489&gjid=1116139880&cid=113336988.1625615600&tid=UA-39926152-1&_gid=1444873918.1625615600&_r=1&gtm=2wg6u0P757DVL&cd1=&cd2=&cd4=Not%20Signed%20In&cd5=Covered%20California&cd6=Find%20Local%20Help&cd7=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&cd8=&cd10=&cd11=Shop%20and%20Compare&cd15=2021-07-07T01%3A53%3A20.53%2B02%3A00&cd16=93d911dd-7003-4789-b0e1-341cfdb30199&cd19=2021-07-07%2001%3A53%3A20&cd17=113336988.1625615600&z=1653774093

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/ruxitagentjs_ICA2QSVfjqrux_10215210506134511.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://apply.coveredca.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch Show response
adservice.google.de/ddm/fls/i/ Frame 3709 194 B
931 B 61ms
41ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.de
:scheme: https
:path: /ddm/fls/i/dc_pre=CJvZ_YLSz_ECFcfTEQgdmVECCg;src=4922306;type=opene0;cat=oeeng0;ord=1;num=7398374418627;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://adservice.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:20 GMT
expires: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch Show response
adservice.google.de/ddm/fls/i/ Frame CC49 194 B
242 B 61ms
41ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.de
:scheme: https
:path: /ddm/fls/i/dc_pre=CLfd_YLSz_ECFTIp4AodQgYAvg;src=4922306;type=opene0;cat=oespa0;ord=6923036024680;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://adservice.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 06 Jul 2021 23:53:20 GMT
expires: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
466 B 40ms
13ms XHR
text/plain 2a00:1450:400c:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-39926152-1&cid=113336988.1625615600&jid=893062489&gjid=1116139880&_gid=1444873918.1625615600&_u=YEBAAEAAAAAAAC~&z=192689145

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/ruxitagentjs_ICA2QSVfjqrux_10215210506134511.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 06 Jul 2021 23:53:20 GMT
content-type: text/plain
access-control-allow-origin: https://apply.coveredca.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
522 B 37ms
16ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-39926152-1&cid=113336988.1625615600&jid=893062489&_u=YEBAAEAAAAAAAC~&z=722942150

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
522 B 38ms
17ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-39926152-1&cid=113336988.1625615600&jid=893062489&_u=YEBAAEAAAAAAAC~&z=722942150

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/
Redirect Chain

https://s.tribalfusion.com/visitor?%7B%22tagKey%22%3A%223706711333%22%2C%22th%22%3A8645007496%2C%22version%22%3A%221.0%22%2C%22tKey%22%3A%22atmneMVcUV5FysmHynXEuuPTvqPHgwRm%22%2C%22url%22%3A%22http...
https://ib.adnxs.com/getuidu?https://a.tribalfusion.com/i.match?p=b26&u=$UID&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24
https://ib.adnxs.com/bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db26%26u%3D%24UID%26redirect%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D305%2526code%253D%...
https://a.tribalfusion.com/i.match?p=b26&u=4548970636822686615&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24
https://ib.adnxs.com/setuid?entity=305&code=18072662197400721947

43 B
996 B

75ms
75ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=305&code=18072662197400721947

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 23:53:20 GMT
X-Proxy-Origin: 37.120.211.100; 37.120.211.100; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: cecdf25e-1be5-4662-8cb5-e49cb418b457
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 68
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 66acc07fdc914a7a-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://ib.adnxs.com/setuid?entity=305&code=18072662197400721947
cache-control: no-cache, private
content-type: text/html
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
insight.adsrvr.org/track/evnt/ 70 B
260 B 203ms
67ms Image
image/gif 99.80.189.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/evnt/?adv=u32r2mh&ct=0:36rabgg&fmt=3
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.189.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-189-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1224804/ 70 KB
23 KB 252ms
151ms Script
application/javascript 199.232.137.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1224804/tfa.js
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6fdba81aba90bc6dd96f6a983d89ebaf9cd4103911e7c58f2f722577a28daa9b

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: LaNgOmUev4U5Gh.kwtW_eorOr6giHSFz
content-encoding: gzip
etag: "bd5f7c8aeeeaafb413e88c3653d3982a"
age: 0
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 23467
x-amz-id-2: 4k7BVqwJMgzHmnxeOlElIacVOtotAwhWDcl5LDzEMGsQCMlIZU7/OT1iQN0l8dA85qR1s/j+dcw=
x-served-by: cache-hhn11546-HHN
last-modified: Wed, 16 Jun 2021 10:49:37 GMT
server: AmazonS3
x-timer: S1625615600.377725,VS0,VE102
date: Tue, 06 Jul 2021 23:53:20 GMT
vary: Accept-Encoding
x-amz-request-id: DG094BZF0ETX1RRC
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 4
x-cache-hits: 1

GET
H/1.1 200
OK x326r234795016 Show response
rs.gwallet.com/r1/pixeltag/ Frame F4BA 43 B
385 B 269ms
132ms Document
image/gif 199.127.207.182
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.gwallet.com/r1/pixeltag/x326r234795016
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 199.127.207.182 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: nginx/1.10.3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Host: rs.gwallet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://apply.coveredca.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://apply.coveredca.com/

Response headers

Server: nginx/1.10.3
Date: Tue, 06 Jul 2021 23:53:20 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3p: CP="PSAo PSDo OUR BUS DSP NON COR"
Vary: Origin
Pragma: no-cache
Cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Origin: *
useSecure: true

GET
H2 200 activity;xsp=4536620;ord=[session%20id]
pubads.g.doubleclick.net/ 42 B
107 B 146ms
145ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;xsp=4536620;ord=[session%20id]?

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
insight.adsrvr.org/track/conv/ 70 B
260 B 199ms
67ms Image
image/gif 99.80.189.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/conv/?adv=ttqj5kk&ct=0:lx754or&fmt=3
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.189.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-189-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3-29 200 convertions_tracker.php
atr.adsmovil.com/ 43 B
627 B 142ms
130ms Image
image/gif 2606:4700:3033::ac43:8174
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://atr.adsmovil.com/convertions_tracker.php?event_id=115&event_value=0&macro_1=
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:8174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:20 GMT
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9rnsi5RDW6WxO39uivhFkMzZrRxenAHnpgl0puuVSwAco6%2Fk%2BHWjK2988TCEdNNUH6x%2FGtn6PNF%2Fm%2BW4SttftvPkAIeFTrhN%2F98ahM6a%2BgHXWNgcXH8poTdcVd9OWhfyjK64ZAQXk7845A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
x-cloud-trace-context: d24b277918ca5d145babe9d96acc330a
cf-ray: 66acc07dab774dc4-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43

GET
H/1.1

200
OK

ppt=4162;g=engagement_pixel_kpi;gid=18390;ord=[uniqueid];ip=37.120.211.100;cuidchk=1
bm.adentifi.com/pixel/conv/
Redirect Chain

https://bm.adentifi.com/pixel/conv/ppt=4162;g=engagement_pixel_kpi;gid=18390;ord=[uniqueid]
https://bm.adentifi.com/pixel/conv/ppt=4162;g=engagement_pixel_kpi;gid=18390;ord=[uniqueid];ip=37.120.211.100;cuidchk=1

42 B
790 B

280ms
143ms

Image
image/gif

34.224.238.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bm.adentifi.com/pixel/conv/ppt=4162;g=engagement_pixel_kpi;gid=18390;ord=[uniqueid];ip=37.120.211.100;cuidchk=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.238.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

Apache /

Resource Hash

b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 23:53:20 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 9 Nov 1980 12:59:00 GMT
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Sun, 9 Nov 1980 12:58:00 GMT

Redirect headers

Date: Tue, 06 Jul 2021 23:53:20 GMT
X-Content-Type-Options: nosniff
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: /pixel/conv/ppt=4162;g=engagement_pixel_kpi;gid=18390;ord=[uniqueid];ip=37.120.211.100;cuidchk=1
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 0

GET
H2 200 beacon
r.turn.com/r/ 43 B
407 B 28ms
26ms Image
image/gif 2001:678:cb4:bbbb::11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/beacon?b2=pGWZ_tRzgTHCXcXgXMNZYx_7YQ3PIO9SdY5viApmvzihM8BMMyPXzW7DoyMFVmeDomdyIuJJ47xlLMxWvB86Mw&cid=
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:19 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3-29

200

src=10025605;dc_pre=CKL9zIPSz_ECFWtGkQUddCEEiw;type=invmedia;cat=cca_h00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain

https://gwmtracking.com/p/v/1/5d02cafff87081645be2f52b/format/img?
https://ad.doubleclick.net/ddm/activity/src=10025605;type=invmedia;cat=cca_h00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://ad.doubleclick.net/ddm/activity/src=10025605;dc_pre=CKL9zIPSz_ECFWtGkQUddCEEiw;type=invmedia;cat=cca_h00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://adservice.google.com/ddm/fls/z/src=10025605;dc_pre=CKL9zIPSz_ECFWtGkQUddCEEiw;type=invmedia;cat=cca_h00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

42 B
63 B

43ms
42ms

Image
image/gif

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=10025605;dc_pre=CKL9zIPSz_ECFWtGkQUddCEEiw;type=invmedia;cat=cca_h00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:21 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=10025605;dc_pre=CKL9zIPSz_ECFWtGkQUddCEEiw;type=invmedia;cat=cca_h00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/
Redirect Chain

https://s.tribalfusion.com/conversion?%7B%22tagKey%22%3A%223706711333%22%2C%22th%22%3A8645007496%2C%22version%22%3A%221.0%22%2C%22tKey%22%3A%22atmneMVcUV5FysmHynXEuuPTvqPHgwRm%22%2C%22url%22%3A%22h...
https://ib.adnxs.com/getuidu?https://a.tribalfusion.com/i.match?p=b26&u=$UID&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24
https://ib.adnxs.com/bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db26%26u%3D%24UID%26redirect%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D305%2526code%253D%...
https://a.tribalfusion.com/i.match?p=b26&u=1346983628864027567&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24
https://ib.adnxs.com/setuid?entity=305&code=18072662197400721947

43 B
996 B

51ms
51ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=305&code=18072662197400721947

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 23:53:20 GMT
X-Proxy-Origin: 37.120.211.100; 37.120.211.100; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 6bf82d9c-2bc8-4f9b-81b5-8ab013716539
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 1124
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 66acc07fecab4a7a-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://ib.adnxs.com/setuid?entity=305&code=18072662197400721947
cache-control: no-cache, private
content-type: text/html
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK t.js Show response
u.tentaculos.net/6565e14f-ca75-11e9-9bcc-0685dc1fc043/ 197 B
668 B 50ms
50ms Script
binary/octet-stream 143.204.98.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://u.tentaculos.net/6565e14f-ca75-11e9-9bcc-0685dc1fc043/t.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-2.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 214e9d8b59fb231b230098b8de060ee0d504595981b2e71636dcb24d50881dbb

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 22:10:08 GMT
Via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
Last-Modified: Thu, 29 Aug 2019 15:57:14 GMT
Server: AmazonS3
Age: 6193
ETag: "1058dacbff87ac30d6cc2c924b63ff4a"
X-Cache: Hit from cloudfront
Content-Type: binary/octet-stream
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 197
X-Amz-Cf-Id: oK7Qq-doRPK6Cl9jR0TkdxEaybX2RaMrLxJZ1W3e31fDdX4jBfdImw==

GET
H2 200 activity;xsp=4535315;ord=9814666461580.312
pubads.g.doubleclick.net/ 42 B
107 B 237ms
236ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;xsp=4535315;ord=9814666461580.312?

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
insight.adsrvr.org/track/conv/ 70 B
260 B 144ms
67ms Image
image/gif 99.80.189.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/conv/?adv=u32r2mh&ct=0:6j8hq1g&fmt=3
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.189.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-189-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 23ms
7ms Script
application/javascript 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:20 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Tue, 13 Jul 2021 23:53:20 GMT

GET
H3-29 200 activity;xsp=4536623;ord=[session%20id]
pubads.g.doubleclick.net/ 42 B
63 B 302ms
245ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;xsp=4536623;ord=[session%20id]?

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
insight.adsrvr.org/track/conv/ 70 B
261 B 118ms
66ms Image
image/gif 99.80.189.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/conv/?adv=ttqj5kk&ct=0:hee9b9t&fmt=3
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.189.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-189-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

pixel
ad.ipredictive.com/d/rt/
Redirect Chain

https://mpp.vindicosuite.com/conv/v=5;m=1;t=27689;ts=%3Ctimestamp_here%3E
https://ad.ipredictive.com/d/rt/pixel?rtsite_id=36582&uuid=6c4c8b0b-131c-4885-b33d-cb6b15cb0f05&rr=1625615600

631 B
1 KB

551ms
137ms

Image
image/jpeg

52.206.48.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.ipredictive.com/d/rt/pixel?rtsite_id=36582&uuid=6c4c8b0b-131c-4885-b33d-cb6b15cb0f05&rr=1625615600
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.48.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-48-92.compute-1.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 25cf0f0ce42f8acd9ea6facc223f54105c7fd0cce63fb7bb5d83e6600100acbd

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 23:53:21 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 631
X-CI-RTID: 58028958-deb5-11eb-8fcb-19831395d664
Content-Type: image/jpeg

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:19 GMT
via: 1.1 google
server: 1659e8fc7ef0895bc6132befb093ff754ead1804e04afbe1e876535a9d0216d6
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD, POST, TRACE, OPTIONS
p3p: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV"
location: https://ad.ipredictive.com/d/rt/pixel?rtsite_id=36582&uuid=6c4c8b0b-131c-4885-b33d-cb6b15cb0f05&rr=1625615600
cache-control: no-store,no-cache,must-revalidate,post-check=0,pre-check=0
access-control-allow-headers: Content-Type
content-type: text/html;charset=ISO-8859-1
alt-svc: clear
content-length: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK ppt=4413;g=lp_landing_page;gid=18697;ord=[uniqueid]
bm.adentifi.com/pixel/conv/ 42 B
790 B 245ms
142ms Image
image/gif 34.224.238.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bm.adentifi.com/pixel/conv/ppt=4413;g=lp_landing_page;gid=18697;ord=[uniqueid]

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.238.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 23:53:20 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 9 Nov 1980 12:59:00 GMT
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Sun, 9 Nov 1980 12:58:00 GMT

GET
H3-29 200 DFPAudiencePixel;ord=5619604779247.251;dc_seg=851775939
pubads.g.doubleclick.net/activity;dc_iu=/479/ 42 B
63 B 302ms
246ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;dc_iu=/479/DFPAudiencePixel;ord=5619604779247.251;dc_seg=851775939?

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
insight.adsrvr.org/track/conv/ 70 B
260 B 67ms
66ms Image
image/gif 99.80.189.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/conv/?adv=3w34l6d&ct=0:e0dfh99&fmt=3
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.189.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-189-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3-29

200

src=8422381;dc_pre=CLHTooPSz_ECFSZKkQUdO4IIcQ;type=invmedia;cat=cacov0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=198483025707.84738
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=8422381;type=invmedia;cat=cacov0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=198483025707.84738?
https://ad.doubleclick.net/ddm/activity/src=8422381;dc_pre=CLHTooPSz_ECFSZKkQUdO4IIcQ;type=invmedia;cat=cacov0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=198483025707.84738?
https://adservice.google.com/ddm/fls/z/src=8422381;dc_pre=CLHTooPSz_ECFSZKkQUdO4IIcQ;type=invmedia;cat=cacov0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=198483025707.84738

42 B
63 B

56ms
42ms

Image
image/gif

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=8422381;dc_pre=CLHTooPSz_ECFSZKkQUdO4IIcQ;type=invmedia;cat=cacov0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=198483025707.84738

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=8422381;dc_pre=CLHTooPSz_ECFSZKkQUdO4IIcQ;type=invmedia;cat=cacov0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=198483025707.84738
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

blank.gif
cache.vindicosuite.com/creative/
Redirect Chain

https://mpp.vindicosuite.com/conv/v=5;m=1;t=27690;ts=%3Ctimestamp_here%3E
https://cache.vindicosuite.com/creative/blank.gif

49 B
220 B

229ms
57ms

Image
image/gif

93.184.220.12
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.vindicosuite.com/creative/blank.gif
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.12 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D65) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:20 GMT
last-modified: Mon, 15 May 2017 18:51:23 GMT
server: ECS (lcy/1D65)
age: 20418
etag: "2426206463"
x-cache: HIT
content-type: image/gif
cache-control: max-age=604800
accept-ranges: bytes
content-length: 49
expires: Tue, 13 Jul 2021 23:53:20 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:19 GMT
via: 1.1 google
server: 7c5e8a410f9751e5f6b0dbb8546eaa6a4daad487dfe1a0d22e3756a55d64160b
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD, POST, TRACE, OPTIONS
p3p: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV"
location: https://cache.vindicosuite.com/creative/blank.gif
cache-control: no-store,no-cache,must-revalidate,post-check=0,pre-check=0
access-control-allow-headers: Content-Type
content-type: text/html;charset=ISO-8859-1
alt-svc: clear
content-length: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1 200
OK ppt=4413;g=engagement_kpi;gid=18698;ord=[uniqueid]
bm.adentifi.com/pixel/conv/ 42 B
790 B 278ms
143ms Image
image/gif 34.224.238.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bm.adentifi.com/pixel/conv/ppt=4413;g=engagement_kpi;gid=18698;ord=[uniqueid]

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.224.238.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Apache /

Resource Hash

b2c78c910f5ea29e3a9d223dabc203c055c8708b1fe7d83788b490638126db4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 23:53:20 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sun, 9 Nov 1980 12:59:00 GMT
Server: Apache
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Sun, 9 Nov 1980 12:58:00 GMT

GET
H3-29 200 activity;xsp=4546097;ord=8051394544704.136
pubads.g.doubleclick.net/ 42 B
63 B 140ms
84ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;xsp=4546097;ord=8051394544704.136?

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
insight.adsrvr.org/track/conv/ 70 B
260 B 66ms
66ms Image
image/gif 99.80.189.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/conv/?adv=3w34l6d&ct=0:6owr3u3&fmt=3
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.189.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-189-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3-29

200

src=8422381;dc_pre=CJa2q4PSz_ECFcvxsgod2-oFGw;type=invmedia;cat=cacov00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5791426148708.5205
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=8422381;type=invmedia;cat=cacov00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5791426148708.5205?
https://ad.doubleclick.net/ddm/activity/src=8422381;dc_pre=CJa2q4PSz_ECFcvxsgod2-oFGw;type=invmedia;cat=cacov00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5791426148708.5205?
https://adservice.google.com/ddm/fls/z/src=8422381;dc_pre=CJa2q4PSz_ECFcvxsgod2-oFGw;type=invmedia;cat=cacov00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5791426148708.5205

42 B
63 B

41ms
41ms

Image
image/gif

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=8422381;dc_pre=CJa2q4PSz_ECFcvxsgod2-oFGw;type=invmedia;cat=cacov00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5791426148708.5205

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=8422381;dc_pre=CJa2q4PSz_ECFcvxsgod2-oFGw;type=invmedia;cat=cacov00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5791426148708.5205
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-Lmh1cxtBy5QME.js Show response
rules.quantcount.com/ 15 KB
3 KB 24ms
7ms Script
application/javascript 2600:9000:20eb:aa00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-Lmh1cxtBy5QME.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:aa00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c751ba49ad377e49e8b00a949103e269d69d61bad56d1a39048c2c3a4b6ee899

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 22:58:53 GMT
content-encoding: gzip
age: 3268
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
last-modified: Thu, 01 Jul 2021 21:10:03 GMT
server: AmazonS3
etag: W/"0834bfd8946816ced9fd5010457b8181"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 c28c128e9402fb070daca09bab68490a.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: 5prjZgwOAuTCfawuKwSIGWKwM6Il-LPYHkTX2VajCtxpx9_0oqovIQ==

GET
H2 200 pixel;r=851900223;labels=_fp.event.Default;rf=0;a=p-Lmh1cxtBy5QME;url=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch;uht=2;fpan=1;fpa=P0-416291520-1625615600698;pbcn=u;pbc=;ns=0;ce=1;qjs...
pixel.quantserve.com/ 35 B
475 B 12ms
10ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=851900223;labels=_fp.event.Default;rf=0;a=p-Lmh1cxtBy5QME;url=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch;uht=2;fpan=1;fpa=P0-416291520-1625615600698;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;ref=;d=coveredca.com;je=0;sr=1600x1200x24;dst=1;et=1625615600698;tzo=-120;ogl=

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:20 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H/1.1 200
OK Cookie set rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1 Show response
apply.coveredca.com/ 124 B
1 KB 169ms
169ms XHR
text/plain 2a02:26f0:1700:1b2::2a46
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.coveredca.com/rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1?type=js3&sn=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_rcs-3Acss_0&svrid=3&flavor=post&vi=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0&modifiedSince=1625065950991&rf=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&bp=3&app=7e06c172c1a0b4f5&crc=2050785775&end=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/ruxitagentjs_ICA2QSVfjqrux_10215210506134511.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1b2::2a46 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

dee6c85d2985aca2fcc41bbc11f4f9daf416791d6f5c3f1de82f52801a5c5ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://apply.coveredca.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Sec-Fetch-Dest: empty
Cookie: OAMAuthnHintCookie=0@1625615598; OAMAuthnCookie_apply.coveredca.com:443=ac534ebd1395b37dbaa784a581896c9a227984f7%7Ee0SdDGnhv6jGicw32qUW7giAyjcPMwEAkQPXvPK7LY7wa874M3JWvs9yCKx1EsRrYkIV5vhqkDLzecEsZKIyDFfjGLWX2OjEEy6QHUufU3BHrJYD%2FucIGir401qDYkgDccTN8xGAeiuz2bupRIqyi5ftLLiv2RwlwHydsIujr%2BMUrjZMePk9MfSAUhfGng8JO2w7YwaiTBK8%2FNCbvIrHatJUmaq1QrajcchRZGoRjGNhDxSVPIX%2B60xNTS%2BaZEG8U1EYFHN%2BGBwLEfmk9ccCprhSexFEJ8RAMyNhf0JGdp7TUkcCuvfx8UPRfnGv%2FfkqXZK9s6IpnprnGkMDdpCuDkO%2F5i6%2BzhIoGxkh6S4UmYcs%2BhrCSI8aq3P1Qwb%2Fnw04cT4g6%2F2lQYZVp9iwGCDVbA%3D%3D; SESSIONGHIX=qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351; dtCookie=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_rcs-3Acss_0; rxVisitor=1625615598841RVS5SQDEVT0HLKKA6JIHLQGKAIVUMU8B; dtSa=-; dtLatC=64; dtsrE=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0=enabled; RT="z=1&dm=apply.coveredca.com&si=8f3e40b9-9eac-4ea9-a83f-eedb83ded164&ss=kqspjywm&sl=0&tt=0&bcn=%2F%2F6852bd08.akstat.io%2F"; _gcl_au=1.1.854706835.1625615600; _uetsid=57411c80deb511eba4f0c76699134f6c; _uetvid=574167b0deb511ebbbe01fd1a0e595ca; _fbp=fb.1.1625615599937.1596995617; akavpau_default=1625616200~id=c4726a4ff50fb2c9368e9b608606c077; AWSALBTG=BnmJ55UvBH1KgXQ420RHM6xVa2GXb4AmdWpk9RIFBYO+eTq8y8hfJIfbo8dqMs5egCJt4sdaKUBIRO8kXI43QWSCeyu76IKH99WnrXI7Uy2HWYE4NU7vOxuAS2BsuuilSo+BVQpB0zGCCVC6Sib7RFnzLNzq4DjNerJpVSrqyaEyqvUoGIw=; AWSALBTGCORS=BnmJ55UvBH1KgXQ420RHM6xVa2GXb4AmdWpk9RIFBYO+eTq8y8hfJIfbo8dqMs5egCJt4sdaKUBIRO8kXI43QWSCeyu76IKH99WnrXI7Uy2HWYE4NU7vOxuAS2BsuuilSo+BVQpB0zGCCVC6Sib7RFnzLNzq4DjNerJpVSrqyaEyqvUoGIw=; _ga=GA1.2.113336988.1625615600; _gid=GA1.2.1444873918.1625615600; _gat_UA-39926152-1=1; rxvt=1625617400131|1625615598843; dtPC=3$215598836_930h1vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1; __qca=P0-416291520-1625615600698
Connection: keep-alive
Content-Length: 539
Pragma: no-cache
Host: apply.coveredca.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Cache-Control: no-cache
Referer: https://apply.coveredca.com/hix/broker/search
Sec-Fetch-Site: same-origin
Referer: https://apply.coveredca.com/hix/broker/search
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server
Date: Tue, 06 Jul 2021 23:53:21 GMT
Content-Language: en
Connection: keep-alive
Server-Timing: cdn-cache; desc=MISS edge; dur=100 origin; dur=60
Set-Cookie: AWSALBTG=Ls4GLlFZ9T8IiRMriNgkI5xRhWbK+e1JBkX9dp7QfT7JBCWlbOYAcHuHd1KP5OKq04NXWm2mcMWf1a7CpLRuC0+bAFdNB32IwNFTjgwhifhGQ1YiCmPxZKTDgRgmNuigqZHlw7oGBY0fMm0cng4MENbI112z3CcQ9NLa9pVFZMXFXDP5eqc=; Expires=Tue, 13 Jul 2021 23:53:20 GMT; Path=/ AWSALBTGCORS=Ls4GLlFZ9T8IiRMriNgkI5xRhWbK+e1JBkX9dp7QfT7JBCWlbOYAcHuHd1KP5OKq04NXWm2mcMWf1a7CpLRuC0+bAFdNB32IwNFTjgwhifhGQ1YiCmPxZKTDgRgmNuigqZHlw7oGBY0fMm0cng4MENbI112z3CcQ9NLa9pVFZMXFXDP5eqc=; Expires=Tue, 13 Jul 2021 23:53:20 GMT; Path=/; SameSite=None; Secure dtCookie=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0; Path=/; Domain=.coveredca.com akavpau_default=1625616201~id=0b994e58fca7073ef0225e202ed93066; Domain=apply.coveredca.com; Path=/; HttpOnly; Secure; SameSite=None
Content-Type: text/plain; charset=utf-8
Content-Length: 124
X-XSS-Protection: 1; mode=block

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
658 B 249ms
155ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.0&p_id=Twitter&p_user_id=0&txn_id=o3mp0&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Tue, 06 Jul 2021 23:53:21 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 3078ce8e33105ad37c04cfba01762b8f6425d920073e11cb3d43fc9d7e203743
x-transaction: aa0d44067877df0f
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H/1.1 200
OK Cookie set rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1 Show response
apply.coveredca.com/ 124 B
1 KB 323ms
322ms XHR
text/plain 2a02:26f0:1700:1b2::2a46
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.coveredca.com/rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1?type=js3&sn=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0&svrid=3&flavor=post&vi=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0&contentType=srBm&modifiedSince=1625065950991&rf=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&bp=3&app=7e06c172c1a0b4f5&v=10215210506134512&vs=2&crc=420563809&end=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/ruxitagentjs_ICA2QSVfjqrux_10215210506134511.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1b2::2a46 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

dee6c85d2985aca2fcc41bbc11f4f9daf416791d6f5c3f1de82f52801a5c5ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://apply.coveredca.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Sec-Fetch-Dest: empty
Cookie: OAMAuthnHintCookie=0@1625615598; OAMAuthnCookie_apply.coveredca.com:443=ac534ebd1395b37dbaa784a581896c9a227984f7%7Ee0SdDGnhv6jGicw32qUW7giAyjcPMwEAkQPXvPK7LY7wa874M3JWvs9yCKx1EsRrYkIV5vhqkDLzecEsZKIyDFfjGLWX2OjEEy6QHUufU3BHrJYD%2FucIGir401qDYkgDccTN8xGAeiuz2bupRIqyi5ftLLiv2RwlwHydsIujr%2BMUrjZMePk9MfSAUhfGng8JO2w7YwaiTBK8%2FNCbvIrHatJUmaq1QrajcchRZGoRjGNhDxSVPIX%2B60xNTS%2BaZEG8U1EYFHN%2BGBwLEfmk9ccCprhSexFEJ8RAMyNhf0JGdp7TUkcCuvfx8UPRfnGv%2FfkqXZK9s6IpnprnGkMDdpCuDkO%2F5i6%2BzhIoGxkh6S4UmYcs%2BhrCSI8aq3P1Qwb%2Fnw04cT4g6%2F2lQYZVp9iwGCDVbA%3D%3D; SESSIONGHIX=qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351; rxVisitor=1625615598841RVS5SQDEVT0HLKKA6JIHLQGKAIVUMU8B; dtSa=-; dtLatC=64; dtsrE=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0=enabled; RT="z=1&dm=apply.coveredca.com&si=8f3e40b9-9eac-4ea9-a83f-eedb83ded164&ss=kqspjywm&sl=0&tt=0&bcn=%2F%2F6852bd08.akstat.io%2F"; _gcl_au=1.1.854706835.1625615600; _uetsid=57411c80deb511eba4f0c76699134f6c; _uetvid=574167b0deb511ebbbe01fd1a0e595ca; _fbp=fb.1.1625615599937.1596995617; _ga=GA1.2.113336988.1625615600; _gid=GA1.2.1444873918.1625615600; _gat_UA-39926152-1=1; __qca=P0-416291520-1625615600698; AWSALBTG=Ls4GLlFZ9T8IiRMriNgkI5xRhWbK+e1JBkX9dp7QfT7JBCWlbOYAcHuHd1KP5OKq04NXWm2mcMWf1a7CpLRuC0+bAFdNB32IwNFTjgwhifhGQ1YiCmPxZKTDgRgmNuigqZHlw7oGBY0fMm0cng4MENbI112z3CcQ9NLa9pVFZMXFXDP5eqc=; AWSALBTGCORS=Ls4GLlFZ9T8IiRMriNgkI5xRhWbK+e1JBkX9dp7QfT7JBCWlbOYAcHuHd1KP5OKq04NXWm2mcMWf1a7CpLRuC0+bAFdNB32IwNFTjgwhifhGQ1YiCmPxZKTDgRgmNuigqZHlw7oGBY0fMm0cng4MENbI112z3CcQ9NLa9pVFZMXFXDP5eqc=; dtCookie=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0; akavpau_default=1625616201~id=0b994e58fca7073ef0225e202ed93066; dtsrVID=1625615601032; dtPC=3$215598836_930h-vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1; rxvt=1625617402114|1625615598843
Connection: keep-alive
Content-Length: 5508
Pragma: no-cache
Host: apply.coveredca.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/octet-stream
Accept: */*
Cache-Control: no-cache
Referer: https://apply.coveredca.com/hix/broker/search
Sec-Fetch-Site: same-origin
Referer: https://apply.coveredca.com/hix/broker/search
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/octet-stream

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server
Date: Tue, 06 Jul 2021 23:53:22 GMT
Content-Language: en
Connection: keep-alive
Server-Timing: cdn-cache; desc=MISS edge; dur=101 origin; dur=212
Set-Cookie: AWSALBTG=avvBzrkVFkzrm4KO0J1ZL6Enk0YO8jNkVdkXcMNFqaMvNGgjJF8+xaMYKte77K35up8CcOtS4fEgZC+q8iV+///HGaQQmfdkhMv9hGo8R1nmyRcJ8AppWgp0iyveBbAKryZ5SlcOk9Ht4ZvIBjwNa8ihNvsykhbU04PIwP8OwLtFPbAG2H8=; Expires=Tue, 13 Jul 2021 23:53:22 GMT; Path=/ AWSALBTGCORS=avvBzrkVFkzrm4KO0J1ZL6Enk0YO8jNkVdkXcMNFqaMvNGgjJF8+xaMYKte77K35up8CcOtS4fEgZC+q8iV+///HGaQQmfdkhMv9hGo8R1nmyRcJ8AppWgp0iyveBbAKryZ5SlcOk9Ht4ZvIBjwNa8ihNvsykhbU04PIwP8OwLtFPbAG2H8=; Expires=Tue, 13 Jul 2021 23:53:22 GMT; Path=/; SameSite=None; Secure akavpau_default=1625616202~id=810c0cfb5ae002954f48fe9152af324c; Domain=apply.coveredca.com; Path=/; HttpOnly; Secure; SameSite=None
Content-Type: text/plain; charset=utf-8
Content-Length: 124
X-XSS-Protection: 1; mode=block

POST
H2 204 /
6852bd08.akstat.io/ 0
205 B 17ms
15ms Ping
image/gif 2a02:26f0:6c00:287::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://6852bd08.akstat.io/

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/Y6ACE-9FDGF-KQUDN-CKBVW-HPBSL

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:287::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 23:53:22 GMT
content-type: image/gif
access-control-allow-origin: https://apply.coveredca.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 0
expires: Tue, 06 Jul 2021 23:53:22 GMT

POST
H/1.1 200
OK Cookie set rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1 Show response
apply.coveredca.com/ 124 B
1 KB 169ms
168ms XHR
text/plain 2a02:26f0:1700:1b2::2a46
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.coveredca.com/rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1?type=js3&sn=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0&svrid=3&flavor=post&vi=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0&contentType=srTe&modifiedSince=1625065950991&rf=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&bp=3&app=7e06c172c1a0b4f5&v=10215210506134512&vs=2&crc=2743602756&end=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/ruxitagentjs_ICA2QSVfjqrux_10215210506134511.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1b2::2a46 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

dee6c85d2985aca2fcc41bbc11f4f9daf416791d6f5c3f1de82f52801a5c5ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://apply.coveredca.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Sec-Fetch-Dest: empty
Cookie: OAMAuthnHintCookie=0@1625615598; OAMAuthnCookie_apply.coveredca.com:443=ac534ebd1395b37dbaa784a581896c9a227984f7%7Ee0SdDGnhv6jGicw32qUW7giAyjcPMwEAkQPXvPK7LY7wa874M3JWvs9yCKx1EsRrYkIV5vhqkDLzecEsZKIyDFfjGLWX2OjEEy6QHUufU3BHrJYD%2FucIGir401qDYkgDccTN8xGAeiuz2bupRIqyi5ftLLiv2RwlwHydsIujr%2BMUrjZMePk9MfSAUhfGng8JO2w7YwaiTBK8%2FNCbvIrHatJUmaq1QrajcchRZGoRjGNhDxSVPIX%2B60xNTS%2BaZEG8U1EYFHN%2BGBwLEfmk9ccCprhSexFEJ8RAMyNhf0JGdp7TUkcCuvfx8UPRfnGv%2FfkqXZK9s6IpnprnGkMDdpCuDkO%2F5i6%2BzhIoGxkh6S4UmYcs%2BhrCSI8aq3P1Qwb%2Fnw04cT4g6%2F2lQYZVp9iwGCDVbA%3D%3D; SESSIONGHIX=qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351; rxVisitor=1625615598841RVS5SQDEVT0HLKKA6JIHLQGKAIVUMU8B; dtSa=-; dtLatC=64; dtsrE=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0=enabled; _gcl_au=1.1.854706835.1625615600; _uetsid=57411c80deb511eba4f0c76699134f6c; _uetvid=574167b0deb511ebbbe01fd1a0e595ca; _fbp=fb.1.1625615599937.1596995617; _ga=GA1.2.113336988.1625615600; _gid=GA1.2.1444873918.1625615600; _gat_UA-39926152-1=1; __qca=P0-416291520-1625615600698; dtCookie=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0; dtsrVID=1625615601032; dtPC=3$215598836_930h-vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1; rxvt=1625617402114|1625615598843; RT="z=1&dm=apply.coveredca.com&si=8f3e40b9-9eac-4ea9-a83f-eedb83ded164&ss=kqspjywm&sl=1&tt=2ub&bcn=%2F%2F6852bd08.akstat.io%2F&ld=3jz"; AWSALBTG=avvBzrkVFkzrm4KO0J1ZL6Enk0YO8jNkVdkXcMNFqaMvNGgjJF8+xaMYKte77K35up8CcOtS4fEgZC+q8iV+///HGaQQmfdkhMv9hGo8R1nmyRcJ8AppWgp0iyveBbAKryZ5SlcOk9Ht4ZvIBjwNa8ihNvsykhbU04PIwP8OwLtFPbAG2H8=; AWSALBTGCORS=avvBzrkVFkzrm4KO0J1ZL6Enk0YO8jNkVdkXcMNFqaMvNGgjJF8+xaMYKte77K35up8CcOtS4fEgZC+q8iV+///HGaQQmfdkhMv9hGo8R1nmyRcJ8AppWgp0iyveBbAKryZ5SlcOk9Ht4ZvIBjwNa8ihNvsykhbU04PIwP8OwLtFPbAG2H8=; akavpau_default=1625616202~id=810c0cfb5ae002954f48fe9152af324c
Connection: keep-alive
Content-Length: 124
Pragma: no-cache
Host: apply.coveredca.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Cache-Control: no-cache
Referer: https://apply.coveredca.com/hix/broker/search
Sec-Fetch-Site: same-origin
Referer: https://apply.coveredca.com/hix/broker/search
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server
Date: Tue, 06 Jul 2021 23:53:22 GMT
Content-Language: en
Connection: keep-alive
Server-Timing: cdn-cache; desc=MISS edge; dur=102 origin; dur=58
Set-Cookie: AWSALBTG=YF9Xy+Xkyl8fggnOnHHLvZ1q39wWAPZgtB6o/tXZVsyUNp9cyUO5rcrZN7pl7mBsiVseGqO243S6OhsOQ1DEJeS40AV6XStEJaRQ+UTLpbJhs7OfK5tdnIVo/Sxyq0sC7W4upQxAQXBkd5HDHGiajCm9j/PKJgobRK9oViWeeINY/FsX8fc=; Expires=Tue, 13 Jul 2021 23:53:22 GMT; Path=/ AWSALBTGCORS=YF9Xy+Xkyl8fggnOnHHLvZ1q39wWAPZgtB6o/tXZVsyUNp9cyUO5rcrZN7pl7mBsiVseGqO243S6OhsOQ1DEJeS40AV6XStEJaRQ+UTLpbJhs7OfK5tdnIVo/Sxyq0sC7W4upQxAQXBkd5HDHGiajCm9j/PKJgobRK9oViWeeINY/FsX8fc=; Expires=Tue, 13 Jul 2021 23:53:22 GMT; Path=/; SameSite=None; Secure akavpau_default=1625616202~id=810c0cfb5ae002954f48fe9152af324c; Domain=apply.coveredca.com; Path=/; HttpOnly; Secure; SameSite=None
Content-Type: text/plain; charset=utf-8
Content-Length: 124
X-XSS-Protection: 1; mode=block

POST
H/1.1 200
OK Cookie set rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1 Show response
apply.coveredca.com/ 124 B
1 KB 170ms
169ms XHR
text/plain 2a02:26f0:1700:1b2::2a46
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.coveredca.com/rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1?type=js3&sn=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0&svrid=3&flavor=post&vi=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0&modifiedSince=1625065950991&rf=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&bp=3&app=7e06c172c1a0b4f5&crc=1717497978&end=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/ruxitagentjs_ICA2QSVfjqrux_10215210506134511.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1b2::2a46 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

dee6c85d2985aca2fcc41bbc11f4f9daf416791d6f5c3f1de82f52801a5c5ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://apply.coveredca.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Sec-Fetch-Dest: empty
Cookie: OAMAuthnHintCookie=0@1625615598; OAMAuthnCookie_apply.coveredca.com:443=ac534ebd1395b37dbaa784a581896c9a227984f7%7Ee0SdDGnhv6jGicw32qUW7giAyjcPMwEAkQPXvPK7LY7wa874M3JWvs9yCKx1EsRrYkIV5vhqkDLzecEsZKIyDFfjGLWX2OjEEy6QHUufU3BHrJYD%2FucIGir401qDYkgDccTN8xGAeiuz2bupRIqyi5ftLLiv2RwlwHydsIujr%2BMUrjZMePk9MfSAUhfGng8JO2w7YwaiTBK8%2FNCbvIrHatJUmaq1QrajcchRZGoRjGNhDxSVPIX%2B60xNTS%2BaZEG8U1EYFHN%2BGBwLEfmk9ccCprhSexFEJ8RAMyNhf0JGdp7TUkcCuvfx8UPRfnGv%2FfkqXZK9s6IpnprnGkMDdpCuDkO%2F5i6%2BzhIoGxkh6S4UmYcs%2BhrCSI8aq3P1Qwb%2Fnw04cT4g6%2F2lQYZVp9iwGCDVbA%3D%3D; SESSIONGHIX=qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351; rxVisitor=1625615598841RVS5SQDEVT0HLKKA6JIHLQGKAIVUMU8B; dtSa=-; dtLatC=64; dtsrE=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0=enabled; _gcl_au=1.1.854706835.1625615600; _uetsid=57411c80deb511eba4f0c76699134f6c; _uetvid=574167b0deb511ebbbe01fd1a0e595ca; _fbp=fb.1.1625615599937.1596995617; _ga=GA1.2.113336988.1625615600; _gid=GA1.2.1444873918.1625615600; _gat_UA-39926152-1=1; __qca=P0-416291520-1625615600698; dtCookie=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0; dtsrVID=1625615601032; dtPC=3$215598836_930h-vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1; rxvt=1625617402114|1625615598843; RT="z=1&dm=apply.coveredca.com&si=8f3e40b9-9eac-4ea9-a83f-eedb83ded164&ss=kqspjywm&sl=1&tt=2ub&bcn=%2F%2F6852bd08.akstat.io%2F&ld=3jz"; AWSALBTG=avvBzrkVFkzrm4KO0J1ZL6Enk0YO8jNkVdkXcMNFqaMvNGgjJF8+xaMYKte77K35up8CcOtS4fEgZC+q8iV+///HGaQQmfdkhMv9hGo8R1nmyRcJ8AppWgp0iyveBbAKryZ5SlcOk9Ht4ZvIBjwNa8ihNvsykhbU04PIwP8OwLtFPbAG2H8=; AWSALBTGCORS=avvBzrkVFkzrm4KO0J1ZL6Enk0YO8jNkVdkXcMNFqaMvNGgjJF8+xaMYKte77K35up8CcOtS4fEgZC+q8iV+///HGaQQmfdkhMv9hGo8R1nmyRcJ8AppWgp0iyveBbAKryZ5SlcOk9Ht4ZvIBjwNa8ihNvsykhbU04PIwP8OwLtFPbAG2H8=; akavpau_default=1625616202~id=810c0cfb5ae002954f48fe9152af324c
Connection: keep-alive
Content-Length: 2705
Pragma: no-cache
Host: apply.coveredca.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Cache-Control: no-cache
Referer: https://apply.coveredca.com/hix/broker/search
Sec-Fetch-Site: same-origin
Referer: https://apply.coveredca.com/hix/broker/search
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server
Date: Tue, 06 Jul 2021 23:53:22 GMT
Content-Language: en
Connection: keep-alive
Server-Timing: cdn-cache; desc=MISS edge; dur=103 origin; dur=58
Set-Cookie: AWSALBTG=AzojHja0SvPACM1qC4Nk2HtC2zf3v0TXOnzgijLtZ+Ky4q24HvNIcg4Xgno03wdXW2VskmyOeoxdcYIhgkbyP56aVEyHtN9E6d/WQTFY0/AxC6IxR7WYlmDrAMopIdO00B7Jy+fRtr6yegplQC6GHXVF0WS8CNwPLScawCCjfz7HxG7fwRQ=; Expires=Tue, 13 Jul 2021 23:53:22 GMT; Path=/ AWSALBTGCORS=AzojHja0SvPACM1qC4Nk2HtC2zf3v0TXOnzgijLtZ+Ky4q24HvNIcg4Xgno03wdXW2VskmyOeoxdcYIhgkbyP56aVEyHtN9E6d/WQTFY0/AxC6IxR7WYlmDrAMopIdO00B7Jy+fRtr6yegplQC6GHXVF0WS8CNwPLScawCCjfz7HxG7fwRQ=; Expires=Tue, 13 Jul 2021 23:53:22 GMT; Path=/; SameSite=None; Secure akavpau_default=1625616202~id=810c0cfb5ae002954f48fe9152af324c; Domain=apply.coveredca.com; Path=/; HttpOnly; Secure; SameSite=None
Content-Type: text/plain; charset=utf-8
Content-Length: 124
X-XSS-Protection: 1; mode=block

GET
H/1.1

200
OK

results.txt Show response
ev4ngzaccc5cqyhe5tza-pzx50t-9b151eb04-clientnsv4-s.akamaihd.net/eum/ Frame 05EA
Redirect Chain

https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pzx50tjm3
https://ev4ngzaccc5cqyhe5tza-pzx50t-9b151eb04-clientnsv4-s.akamaihd.net/eum/results.txt

8 B
312 B

312ms
58ms

XHR
text/plain

2.16.186.24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ev4ngzaccc5cqyhe5tza-pzx50t-9b151eb04-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.24 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-24.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 23:53:22 GMT
Last-Modified: Wed, 08 May 2013 07:51:12 GMT
Server: AkamaiNetStorage
ETag: "402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type: text/plain
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8

Redirect headers

Location: https://ev4ngzaccc5cqyhe5tza-pzx50t-9b151eb04-clientnsv4-s.akamaihd.net/eum/results.txt
Date: Tue, 06 Jul 2021 23:53:22 GMT
Server: AkamaiGHost
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Length: 0

GET
H/1.1

200
OK

results.txt Show response
fiaqj6absjkbikqce3ygyaaaabqoj3hs-pzx50t-cf0dceaba-clienttons-s.akamaihd.net/eum/ Frame 05EA
Redirect Chain

https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pzx50tjm3
https://fiaqj6absjkbikqce3ygyaaaabqoj3hs-pzx50t-cf0dceaba-clienttons-s.akamaihd.net/eum/results.txt

8 B
312 B

51ms
6ms

XHR
text/plain

2a02:26f0:6c00::210:ba19
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://fiaqj6absjkbikqce3ygyaaaabqoj3hs-pzx50t-cf0dceaba-clienttons-s.akamaihd.net/eum/results.txt
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a02:26f0:6c00::210:ba19 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 23:53:22 GMT
Last-Modified: Wed, 08 May 2013 07:51:12 GMT
Server: AkamaiNetStorage
ETag: "402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type: text/plain
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8

Redirect headers

Location: https://fiaqj6absjkbikqce3ygyaaaabqoj3hs-pzx50t-cf0dceaba-clienttons-s.akamaihd.net/eum/results.txt
Date: Tue, 06 Jul 2021 23:53:22 GMT
Server: AkamaiGHost
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Length: 0

POST
H/1.1 200
OK Cookie set rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1 Show response
apply.coveredca.com/ 124 B
1 KB 267ms
267ms XHR
text/plain 2a02:26f0:1700:1b2::2a46
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://apply.coveredca.com/rb_9e1b93f7-7c66-4b71-8dfd-645b8d6ba7c1?type=js3&sn=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0&svrid=3&flavor=post&vi=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0&modifiedSince=1625065950991&rf=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&bp=3&app=7e06c172c1a0b4f5&crc=3042184534&end=1

Requested by

Host: apply.coveredca.com
URL: https://apply.coveredca.com/ruxitagentjs_ICA2QSVfjqrux_10215210506134511.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1b2::2a46 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

dee6c85d2985aca2fcc41bbc11f4f9daf416791d6f5c3f1de82f52801a5c5ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://apply.coveredca.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Sec-Fetch-Dest: empty
Cookie: OAMAuthnHintCookie=0@1625615598; OAMAuthnCookie_apply.coveredca.com:443=ac534ebd1395b37dbaa784a581896c9a227984f7%7Ee0SdDGnhv6jGicw32qUW7giAyjcPMwEAkQPXvPK7LY7wa874M3JWvs9yCKx1EsRrYkIV5vhqkDLzecEsZKIyDFfjGLWX2OjEEy6QHUufU3BHrJYD%2FucIGir401qDYkgDccTN8xGAeiuz2bupRIqyi5ftLLiv2RwlwHydsIujr%2BMUrjZMePk9MfSAUhfGng8JO2w7YwaiTBK8%2FNCbvIrHatJUmaq1QrajcchRZGoRjGNhDxSVPIX%2B60xNTS%2BaZEG8U1EYFHN%2BGBwLEfmk9ccCprhSexFEJ8RAMyNhf0JGdp7TUkcCuvfx8UPRfnGv%2FfkqXZK9s6IpnprnGkMDdpCuDkO%2F5i6%2BzhIoGxkh6S4UmYcs%2BhrCSI8aq3P1Qwb%2Fnw04cT4g6%2F2lQYZVp9iwGCDVbA%3D%3D; SESSIONGHIX=qeB-PYPsGp9Bxmz9HnGq38JflPdN0J_ajru9QjzeW5q5oyuv43ss!-102116351; rxVisitor=1625615598841RVS5SQDEVT0HLKKA6JIHLQGKAIVUMU8B; dtSa=-; dtLatC=64; dtsrE=WARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0=enabled; _gcl_au=1.1.854706835.1625615600; _uetsid=57411c80deb511eba4f0c76699134f6c; _uetvid=574167b0deb511ebbbe01fd1a0e595ca; _fbp=fb.1.1625615599937.1596995617; _ga=GA1.2.113336988.1625615600; _gid=GA1.2.1444873918.1625615600; _gat_UA-39926152-1=1; __qca=P0-416291520-1625615600698; dtCookie=v_4_srv_3_sn_831DB7EF782AA7C592E47AA41E0A1143_perc_98029_ol_0_mul_1_app-3A7e06c172c1a0b4f5_1_rcs-3Acss_0; dtsrVID=1625615601032; dtPC=3$215598836_930h-vWARRFTFWFAMSFAMMUTPFHMMUCOHSCUAF-0e1; rxvt=1625617402114|1625615598843; RT="z=1&dm=apply.coveredca.com&si=8f3e40b9-9eac-4ea9-a83f-eedb83ded164&ss=kqspjywm&sl=1&tt=2ub&bcn=%2F%2F6852bd08.akstat.io%2F&ld=3jz"; akavpau_default=1625616202~id=810c0cfb5ae002954f48fe9152af324c; AWSALBTG=AzojHja0SvPACM1qC4Nk2HtC2zf3v0TXOnzgijLtZ+Ky4q24HvNIcg4Xgno03wdXW2VskmyOeoxdcYIhgkbyP56aVEyHtN9E6d/WQTFY0/AxC6IxR7WYlmDrAMopIdO00B7Jy+fRtr6yegplQC6GHXVF0WS8CNwPLScawCCjfz7HxG7fwRQ=; AWSALBTGCORS=AzojHja0SvPACM1qC4Nk2HtC2zf3v0TXOnzgijLtZ+Ky4q24HvNIcg4Xgno03wdXW2VskmyOeoxdcYIhgkbyP56aVEyHtN9E6d/WQTFY0/AxC6IxR7WYlmDrAMopIdO00B7Jy+fRtr6yegplQC6GHXVF0WS8CNwPLScawCCjfz7HxG7fwRQ=
Connection: keep-alive
Content-Length: 19122
Pragma: no-cache
Host: apply.coveredca.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Cache-Control: no-cache
Referer: https://apply.coveredca.com/hix/broker/search
Sec-Fetch-Site: same-origin
Referer: https://apply.coveredca.com/hix/broker/search
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server
Date: Tue, 06 Jul 2021 23:53:24 GMT
Content-Language: en
Connection: keep-alive
Server-Timing: cdn-cache; desc=MISS edge; dur=104 origin; dur=154
Set-Cookie: AWSALBTG=/XYzgNhsbhT+3fPDPAPJw/jaJX3l4EzZLpmxjbP4yFzFy0VSYvA2DEtTk6IO9pu9UMZIAPQH4QRhKtdAaLGessrlvFJ3T+YhafMb72ieYC0tUcbxNzb6OO2h3U3PSPw6fiwEG/IfaHl8/6VkuGb+yIXYFgzOoWiIiwtz9zVmr5d6xs+Of0A=; Expires=Tue, 13 Jul 2021 23:53:24 GMT; Path=/ AWSALBTGCORS=/XYzgNhsbhT+3fPDPAPJw/jaJX3l4EzZLpmxjbP4yFzFy0VSYvA2DEtTk6IO9pu9UMZIAPQH4QRhKtdAaLGessrlvFJ3T+YhafMb72ieYC0tUcbxNzb6OO2h3U3PSPw6fiwEG/IfaHl8/6VkuGb+yIXYFgzOoWiIiwtz9zVmr5d6xs+Of0A=; Expires=Tue, 13 Jul 2021 23:53:24 GMT; Path=/; SameSite=None; Secure akavpau_default=1625616204~id=ddbbd0fd2fa4d7359fd3daa744d1fe83; Domain=apply.coveredca.com; Path=/; HttpOnly; Secure; SameSite=None
Content-Type: text/plain; charset=utf-8
Content-Length: 124
X-XSS-Protection: 1; mode=block

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 166ms
60ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

92bd24374fb205c765a133d522acb2772693d2ccd486b7855e2447918de296a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14011
x-xss-protection: 0
server: cafe
etag: 1690124483490796579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Jul 2021 23:53:29 GMT

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

5 KB
2 KB

54ms
53ms

Script
application/javascript

151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ce8edccdc98a1f67c6d81ce452ac32192a9fc0c7a2828ea2dc6747c291cb5919

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:29 GMT
via: 1.1 varnish
last-modified: Fri, 02 Jul 2021 22:49:15 GMT
age: 85313
etag: "cf581d46c3059bf617cb7f732c21a59e+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1958
x-timer: S1625615610.829101,VS0,VE0
x-served-by: cache-fra19139-FRA

Redirect headers

x-tw-cdn: VZ
Date: Tue, 06 Jul 2021 23:53:29 GMT
Server: ECS (frb/6763)
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Location: https://static.ads-twitter.com/oct.js
Content-Length: 0

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/container/15887;121527;12546;iframe/ Frame 35B2 1 KB
2 KB 108ms
107ms Document
text/html 209.197.3.19
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://servedby.flashtalking.com/container/15887;121527;12546;iframe/?spotName=QLPA_All&cachebuster=796004.3623634962
Requested by: Host: apply.coveredca.com
URL: https://apply.coveredca.com/hix/broker/search
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.19 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS: vip0x013.map2.ssl.hwcdn.net
Software: prod-xre-app19.lhr11 /
Resource Hash: 14180ad938cd0c759a989a589c07977e89060de798726b6fd689511ef2d36107

Request headers

Host: servedby.flashtalking.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://apply.coveredca.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://apply.coveredca.com/

Response headers

Date: Tue, 06 Jul 2021 23:53:29 GMT
Connection: close
Cache-Control: no-cache, no-store
Content-Type: text/html
Server: prod-xre-app19.lhr11
Pragma: no-cache
X-HW: 1625615600.dop029.lo4.shc,1625615600.dop029.lo4.t,1625615609.cds002.lo4.sc,1625615609.cds002.lo4.p

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1085919381420494&ev=ccQLPA&dl=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&rl=&if=false&ts=1625615609775&sw=1600&sh=1200&v=2.9.43&r=stable&a=tmgoogletagmanager&ec=1&o=28&fbp=fb.1.1625615609774.1630378360&it=1625615599810&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:29 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 06 Jul 2021 23:53:29 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=552091788777106&ev=ccQLPA&dl=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch&rl=&if=false&ts=1625615609775&sw=1600&sh=1200&v=2.9.43&r=stable&ec=1&o=28&fbp=fb.1.1625615609774.1630378360&it=1625615599810&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:29 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 06 Jul 2021 23:53:29 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect/?pid=2088348&conversionId=3452548&fmt=gif
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D2088348%26conversionId%3D3452548%26fmt%3Dgif%26liSync%3Dtrue
https://px.ads.linkedin.com/collect?pid=2088348&conversionId=3452548&fmt=gif&liSync=true
https://px4.ads.linkedin.com/collect?pid=2088348&conversionId=3452548&fmt=gif&liSync=true&e_ipv6=AQJMrT2FEw9QFwAAAXp-PbGqVE2l8wR154UNcQQpR-9qT2HK6BoEbC_9CES0dJqtUMOKdVNW

43 B
166 B

240ms
239ms

Image
image/gif

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?pid=2088348&conversionId=3452548&fmt=gif&liSync=true&e_ipv6=AQJMrT2FEw9QFwAAAXp-PbGqVE2l8wR154UNcQQpR-9qT2HK6BoEbC_9CES0dJqtUMOKdVNW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://apply.coveredca.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 23:53:30 GMT
content-encoding: gzip
server: Play
linkedin-action: 1
vary: Accept-Encoding
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-edc2
content-type: image/gif
content-length: 65
x-li-uuid: Bidt6shYjxbAZ9QPFSsAAA==

Redirect headers

date: Tue, 06 Jul 2021 23:53:30 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?pid=2088348&conversionId=3452548&fmt=gif&liSync=true&e_ipv6=AQJMrT2FEw9QFwAAAXp-PbGqVE2l8wR154UNcQQpR-9qT2HK6BoEbC_9CES0dJqtUMOKdVNW
x-li-proto: http/2
x-li-pop: prod-esv5
content-length: 0
x-li-uuid: 1cff3shYjxaQPF15disAAA==

GET
H3-29

200

activityi;dc_pre=CI3H24fSz_ECFZly4Aod-p0BfA;src=10053689;type=qlpa1;cat=quali0;ord=3056323826213;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2... Show response
10053689.fls.doubleclick.net/ Frame 070C
Redirect Chain

https://10053689.fls.doubleclick.net/activityi;src=10053689;type=qlpa1;cat=quali0;ord=3056323826213;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroke...
https://10053689.fls.doubleclick.net/activityi;dc_pre=CI3H24fSz_ECFZly4Aod-p0BfA;src=10053689;type=qlpa1;cat=quali0;ord=3056323826213;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2...

507 B
431 B

65ms
65ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10053689.fls.doubleclick.net/activityi;dc_pre=CI3H24fSz_ECFZly4Aod-p0BfA;src=10053689;type=qlpa1;cat=quali0;ord=3056323826213;gtm=2wg6u0;auiddc=854706835.1625615600;ps=1;~oref=https%3A%2F%2Fapply.coveredca.com%2Fhix%2Fbroker%2Fsearch?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P757DVL

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS