www.benefitsguide.com Open in urlscan Pro
199.60.103.225 Public Scan

xx-fbcdn-shv-01-lga3.fbcdn.net

Software

Google Tag Manager /

Resource Hash

924f111276049dfc83a1b09373b8904c5c74cd92abcfb99558d1e4d14556a4c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96387
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 15 Sep 2024 09:01:22 GMT

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 69ms
33ms Script
application/x-javascript 31.13.71.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 15 Sep 2024 09:01:22 GMT
document-policy: force-load-at-top
x-fb-server-load: 55
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58953
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=31, rtx=0, c=23, mss=1232, tbw=4446, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: xC1HktwDUA5zQRphSOJUO5SVReP78kvP/MemaB2wk/U/ZNfNT8tyzg9czP3sHn9l0CkabCRDiVhLe1lE5/g22w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/3.0.3/ 2 KB
1 KB 64ms
30ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/normalize/3.0.3/normalize.min.css

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/hs-fs/hub/167518/hub_generated/template_assets/4043390337/1569630846009/Coded_files/Custom/system/css/Inbound-performance.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fcef96bd3d8479bd51214ea2308b44862e719474c22c78361e02e6546156c96f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/hs-fs/hub/167518/hub_generated/template_assets/4043390337/1569630846009/Coded_files/Custom/system/css/Inbound-performance.min.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 325710
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 697
last-modified: Mon, 04 May 2020 16:13:31 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03f2b-78e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Q%2BL12mIB%2Bn22VacZnoeN%2FNV8gzJMJc8gd%2FovGWNwVP6EITuy3eronkIy7cGow4Bjsd1iEfBoiunh9jn%2B%2F8f4%2Fyw3jQw6usitNJTWFP%2FPvOmWiZMoMLy%2FPwoZGkc2CoPycEIsOMl"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8c376e846c2a36a0-YYZ
expires: Fri, 05 Sep 2025 09:01:21 GMT

GET
H3 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ 23 KB
6 KB 63ms
30ms Stylesheet
text/css 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/hs-fs/hub/167518/hub_generated/template_assets/4043390337/1569630846009/Coded_files/Custom/system/css/Inbound-performance.min.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617, 617
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 17234842
cdn-cachedat: 2021-06-08 21:08:57
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: e6a55b08fe5091f45c9e99ce9e9f98c2
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 8c376e846e28aaa0-YYZ
cdn-requestpullsuccess: True

GET
H2 200 css
fonts.googleapis.com/ 4 KB
921 B 142ms
51ms Stylesheet
text/css 142.251.35.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.170 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f10.1e100.net

Software

ESF /

Resource Hash

15ceb6175afc5592068433973649a63a44eb57875201b3f1b7b3746ee1ab547e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/hs-fs/hub/167518/hub_generated/template_assets/4043390337/1569630846009/Coded_files/Custom/system/css/Inbound-performance.min.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 15 Sep 2024 09:01:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 15 Sep 2024 07:04:56 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 15 Sep 2024 09:01:22 GMT

GET
H3 200 370267720426217 Show response
connect.facebook.net/signals/config/ 66 KB
13 KB 85ms
84ms Script
application/x-javascript 31.13.71.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/370267720426217?v=2.9.167&r=stable&domain=www.benefitsguide.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-lga3.fbcdn.net

Software

Resource Hash

6e3701631fa10080e3741a840370db2c5c8f80a789a646a638d40c4db893cec2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 15 Sep 2024 09:01:22 GMT
document-policy: force-load-at-top
x-fb-server-load: 32
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=32, rtx=0, c=74, mss=1232, tbw=67116, tp=63, tpl=0, uplat=42, ullat=0
pragma: public
x-fb-debug: S9ESHSKqgRSc2F/5hcj2ajIWA58vyYjE4qdRBA8dhhtr2QbVCcbJJNspk19OLS/xxb652OmqmP3HuaFJN5HmHw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 icon_default.png
static.hsappstatic.net/social_shared/static-2.4560/img/followme/ 966 B
1 KB 32ms
30ms Image
image/webp 104.17.175.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.hsappstatic.net/social_shared/static-2.4560/img/followme/icon_default.png

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.175.91 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0edcde6fea7bd954562968f9d63b7233a386825d82df5469c41ce4e0e1a4c807

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.benefitsguide.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
via: 1.1 16df6ade68382d048f8aad1f7e39da28.cloudfront.net (CloudFront)
x-amz-version-id: UHcjSAyXI8M0nwm0eoocMlYMi.wcycpq
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
age: 861293
cf-polished: origFmt=png, origSize=1092
x-cache: Miss from cloudfront
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="icon_default.webp"
content-length: 966
cf-bgj: imgq:85,h2pri
last-modified: Wed, 17 Jan 2018 19:09:46 GMT
server: cloudflare
etag: "0fb6cd3213f4fba004a340a61a05de77"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gt%2BqAZ22BjqWuAPzkt3VQoSFHphp580Wh6CQbNS81TVuEvkB9275Qm9GbR65bAdD5XaDM133EXXmBFc0C2PNUgxqTSmzML%2B%2BOoRDkcYmXVWxv%2FmDlogGwvWpUFC8IMSghy2vzbw%2Ff0Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8c376e852ddaaac8-YYZ
x-amz-cf-id: ixakw1EIKkE0jhx4YJUBdaX558KYqnZuazODXbaofwy3Pu9GWdz93A==
expires: Mon, 15 Sep 2025 09:01:22 GMT

GET
H2 200 icon_twitter.png
static.hsappstatic.net/social_shared/static-2.4560/img/followme/ 886 B
1 KB 32ms
31ms Image
image/webp 104.17.175.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.hsappstatic.net/social_shared/static-2.4560/img/followme/icon_twitter.png

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.175.91 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc4ad11ab16b6ff54bca6814a14e3b2305914aef929dc6577b0693539c88ad7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.benefitsguide.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
via: 1.1 2a3aa853116c0a37d6c7762eca54d208.cloudfront.net (CloudFront)
x-amz-version-id: CNCMsp8DMHjga0dMRj3BokYuRrN4cJOw
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
age: 833266
cf-polished: origFmt=png, origSize=2180
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-disposition: inline; filename="icon_twitter.webp"
content-length: 886
cf-bgj: imgq:85,h2pri
last-modified: Wed, 17 Jan 2018 19:09:46 GMT
server: cloudflare
etag: "9934163327fcfc48fb1408026fe03913"
vary: Origin,Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4FoPc5TSPLb9dGzduuCKMkTSMVrMh4FWz1EVSvNCPBRbWCLZ7G50PzVuigEPV%2F7U4YdY7mkMhQCpT1qIpRk0UuU4RmVG%2BIz8Mzmc36c%2FX2V%2FSOZ5bEDQqlPyyourUiVunAvWWEQlvPw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 8c376e853ddbaac8-YYZ
x-amz-cf-id: uLXmyPbE8AFTNibTqmjjFnifVXOmEB19gYUu4i_WsnduItBWPDxN1A==
expires: Mon, 15 Sep 2025 09:01:22 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 140ms
57ms Font
font/woff2 142.250.64.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.67 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f3.1e100.net

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitsguide.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Thu, 12 Sep 2024 14:39:32 GMT
x-content-type-options: nosniff
age: 238910
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Sep 2025 14:39:32 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 115ms
32ms Font
font/woff2 142.250.64.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.67 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f3.1e100.net

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitsguide.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 13:52:08 GMT
x-content-type-options: nosniff
age: 155354
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 13 Sep 2025 13:52:08 GMT

GET
H2 200 S6u9w4BMUTPHh7USSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 157ms
75ms Font
font/woff2 142.250.64.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh7USSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,400,700,300italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.67 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f3.1e100.net

Software

sffe /

Resource Hash

115f6a626ca115d4ad5581b59275327e0e860b30330a52b0f785561332dd2429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitsguide.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 11 Sep 2024 15:58:11 GMT
x-content-type-options: nosniff
age: 320591
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23236
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:26 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Sep 2025 15:58:11 GMT

GET
H2 200 sbm-3ozj5q79luusl8z.gif
273388.fs1.hubspotusercontent-na1.net/hubfs/273388/IPT-Files/img/ 67 B
53 B 37ms
36ms Other
image/gif 172.64.146.132
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://273388.fs1.hubspotusercontent-na1.net/hubfs/273388/IPT-Files/img/sbm-3ozj5q79luusl8z.gif
Requested by: Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.132 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7917c253e5fe0c06571a076503edae953b958426ecbbcf6fe56e9abd009a002b

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
via: 1.1 50d743941b822ae5fa30db69233863a6.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-3076996039,FD-3076995999,P-273388,FLS-ALL
x-amz-version-id: Cj49WpPzX2sXKQiuH0DoMLqY5y_s4Cv0
age: 1545257
x-amz-cf-pop: YTO50-P2
cf-polished: status=not_needed
x-amz-request-id: FXJ2PT0NYH1TYVC8
edge-cache-tag: F-3076996039,FD-3076995999,P-273388,FLS-ALL
cache-tag: F-3076996039,FD-3076995999,P-273388,FLS-ALL
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
content-length: 67
x-amz-id-2: xSE75+5eL2nm1i+AK7fngwpq9csfD1ha0CXe5hgda8BWatBKPNv1PNEqovYAcG4JA6mXFvxZDuE=
last-modified: Tue, 10 Oct 2017 02:12:57 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "78acd2b29b3668a9f0f4165d6af21095"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 8c376e85b9e736d6-YYZ
timing-allow-origin: 273388.fs1.hubspotusercontent-na1.net
x-amz-cf-id: x7agtNLjq17orUU1B7GPBDCRfvpAI8bWKUxIUreWe_LIetRAiCSfpA==
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3

GET
H3 200 json Show response
www.benefitsguide.com/_hcms/forms/embed/v3/form/167518/7c908f20-5346-45f2-bf32-e707acc6aed7/ 14 KB
4 KB 78ms
77ms XHR
application/json 199.60.103.225
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitsguide.com/_hcms/forms/embed/v3/form/167518/7c908f20-5346-45f2-bf32-e707acc6aed7/json?hs_static_app=forms-embed&hs_static_app_version=1.5999&X-HubSpot-Static-App-Info=forms-embed-1.5999

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/_hcms/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.225 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6985b4d1b61c68ef9777b672f4d4e847d0ca7c76d11d23b0a029a8105fb1b70

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-origin-hublet: na1
date: Sun, 15 Sep 2024 09:01:22 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy: upgrade-insecure-requests
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 026bddec-43f0-4b28-bf15-60f6dcf915f2
content-encoding: br
x-envoy-upstream-service-time: 18
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 026bddec-43f0-4b28-bf15-60f6dcf915f2
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-max-age: 180
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-sx6kg
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mEIyipmdapGHQzPoonopWpcBrr0Oc7FRiL3%2FhjGnanlGYbQLUgU%2BokbjMvr9sTs6rkMW1N%2FnZUQwL8X0DIBq9w6apQXz7UUFt%2B0r0xywgMg6mAkIx4yBYkHV79ou3Ciqk31DD3Z0dA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c376e85bf93abca-YYZ
access-control-allow-headers: *
x-robots-tag: none

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/167518/ 71 KB
26 KB 86ms
28ms Script
text/javascript 104.18.40.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/167518/banner.js
Requested by: Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/hs/scriptloader/167518.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 092f318b84f4203a410c01e61c46c8b8eed25e4e9bddccf7b25f1a2d44c1262c

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
x-amz-version-id: P.HqErZzxGpfuiwKKG0Le4.Cq4BOGIBh
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: PZVFMZWN0CXFC15N
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: a471cf44-cc0d-461b-b34b-d7b13a8b0542
age: 0
x-envoy-upstream-service-time: 115
x-amz-id-2: h0FQZ95jUEl5CJFfo/J99dYhkKPtkPctWiapiYn5SR+N9NgBcVQ6v9apwYTzyKCRWkygF9lfLfM=
x-evy-trace-listener: listener_https
x-request-id: a471cf44-cc0d-461b-b34b-d7b13a8b0542
x-evy-trace-route-configuration: listener_https/all
last-modified: Thu, 18 Apr 2024 12:06:45 GMT
server: cloudflare
etag: W/"2235f08cdae7cf6c5d90fd0c22595643"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.benefitsguide.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6685c9958f-jg42k
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8c376e861d40ac30-YYZ
expires: Sun, 15 Sep 2024 09:06:22 GMT

GET
H2 200 web-interactives-embed.js Show response
js.hubspot.com/ 83 KB
24 KB 88ms
31ms Script
application/javascript 104.16.118.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hubspot.com/web-interactives-embed.js

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/hs/scriptloader/167518.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.118.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

059b77025c02623999e7524b737287072bd2dbb42c1652f70a4020338b1e5f21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
Origin: https://www.benefitsguide.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
x-evy-trace-route-service-name: envoyset-translator
age: 0
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1426/bundles/project.js&cfRay=8c376e855dc4abf4-IAD
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"edf91c1320ba2916398ed791b63187bc"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-hs-target-asset: web-interactives-embed/static-2.1426/bundles/project.js
date: Sun, 15 Sep 2024 09:01:22 GMT
via: 1.1 872e43fac89d80c9557000efb9c31650.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-version-id: 7DwgQA9YoOwDB6Raj9_RIwKNzf1Sd5R0
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: 87db95de-c879-4405-b30a-657bfefccdf2
x-cache: Hit from cloudfront
cache-tag: staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-request-id: 87db95de-c879-4405-b30a-657bfefccdf2
last-modified: Wed, 28 Aug 2024 20:01:26 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PJTOy1yBeTysq7Pjo49%2Bh1x99Xjf7jgKE70FMk4WT9Xi3YPkPWyvJLCK0GJppsOcvg%2F6SaU2x41vvM7LoSPxjiudJMM2Ws1rIXKJqNd4h9BabvbdSGrqlI0pbdYoVUkL"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-ncl8g
cf-ray: 8c376e861e53ac82-YYZ
x-amz-cf-id: KzZT0XGzjFVkosYHdB56XMqakfNTaPQCkLDPg3l_UlaIPuItsBjIIQ==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 86ms
28ms Script
application/javascript 104.17.223.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/hs/scriptloader/167518.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.223.152 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eeecc1c14b175e0226295f130c6121ddf605878b3489fd61181911c17c9b2a74

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
content-encoding: gzip
via: 1.1 b9e3ae23b2e5d7b2e1c159467ba23f34.cloudfront.net (CloudFront)
x-amz-version-id: CKdUucj42qReK_MB.X3dwG61CXEt1Id2
cf-cache-status: HIT
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: eea458d2-7f6c-4332-8a13-3be20ca81896
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.595/bundles/pixels-release.js&cfRay=8be6fc9f0cb2c95c-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
age: 330
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: eea458d2-7f6c-4332-8a13-3be20ca81896
last-modified: Thu, 05 Sep 2024 14:32:20 UTC
server: cloudflare
etag: W/"ba2542491f85a69ea1e0553167ab5227"
vary: accept-encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-vdr9x
cf-ray: 8c376e861cc3aafd-YYZ
x-amz-cf-id: TdiwGvbXYTC5BS4ZHLMqdPpQXphBP3vsGqy0CI-waqLnUtYSPLHHDg==
x-hs-target-asset: adsscriptloaderstatic/static-1.595/bundles/pixels-release.js

GET
H2 200 167518.js Show response
js.hs-analytics.net/analytics/1726390800000/ 69 KB
25 KB 83ms
30ms Script
text/javascript 104.16.160.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1726390800000/167518.js
Requested by: Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/hs/scriptloader/167518.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.160.168 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a34e22a1307418fe90e70f20539174011d56499a50a9bfea56d16f6522e4edd

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: 9RNXYTXCGVMW1MGQ
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: f3f24767-a7ad-49f8-883e-24a35b7f88d1
age: 0
x-envoy-upstream-service-time: 24
x-amz-id-2: 8ochEoDZG/ldOrEc78DoKO1eEfv+l6AsiBoUkPs8U8ZkzPCbWfJPfbGpD+PTMP5Z+H1DHvqOa0E=
x-evy-trace-listener: listener_https
x-request-id: f3f24767-a7ad-49f8-883e-24a35b7f88d1
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 09 Sep 2024 20:16:39 GMT
server: cloudflare
etag: W/"fc979d5ac28fb2c6a433e763760d761d"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-6895b58fd6-27f6l
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8c376e8618caab12-YYZ
expires: Sun, 15 Sep 2024 09:06:22 GMT

GET
H2 204 has-permission-json Show response
app.hubspot.com/content-tools-menu/api/v1/tools-menu/ 0
1 KB 179ms
125ms XHR
text/plain 104.16.117.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.hubspot.com/content-tools-menu/api/v1/tools-menu/has-permission-json?portalId=167518

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/hs/hsstatic/HubspotToolsMenu/static-1.354/js/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.117.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	no-sniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: no-sniff
cf-cache-status: DYNAMIC
x-hs-worker-debug-mode: false
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 8554da25-6939-433e-b7c5-8a49d36057ac
x-envoy-upstream-service-time: 4
x-evy-trace-route-configuration: listener_https/all
reporting-endpoints: default="https://send.hsbrowserreports.com/csp/reports?cfRay=8c376e861c7bac27&resource=unknown"
x-evy-trace-listener: listener_https
x-request-id: 8554da25-6939-433e-b7c5-8a49d36057ac
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET
report-to: {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]}
access-control-allow-origin: https://www.benefitsguide.com
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-5f4dcb8bc8-ps9qc
cache-control: max-age=0
access-control-allow-credentials: true
x-evy-trace-virtual-host: all
cf-ray: 8c376e861c7bac27-YYZ

GET
H3 200 postlisting Show response
www.benefitsguide.com/_hcms/ 7 KB
2 KB 37ms
36ms XHR
application/json 199.60.103.225
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.benefitsguide.com/_hcms/postlisting?blogId=2420031539&maxLinks=4&listingType=recent&orderByViews=false&hs-expires=1757849609&hs-version=2&hs-signature=AJ2IBuGqGHzLxZxHBxNrX7Sf-oob4dKwUg&currentUrl=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/hs/hsstatic/AsyncSupport/static-1.122/js/post_listing_asset.js

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.225 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f9736b718021e24ab5e4faebf8e77b54e5de2074e80eeb897dcf42427fd65cc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000
age: 0
x-evy-trace-route-service-name: envoyset-translator
content-security-policy: upgrade-insecure-requests
x-hubspot-correlation-id: 1672d658-94f0-4188-bb92-5598c026f840
x-envoy-upstream-service-time: 15
alt-svc: h3=":443"; ma=86400
content-length: 1200
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 1672d658-94f0-4188-bb92-5598c026f840
last-modified: Sun, 15 Sep 2024 08:23:52 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wqu8bLnWIO0uTuwT0sqlx5Nod1WbiyOr8OfqEvqlZBZ5tdNBMEhREva1uSZeADL9itIgLCcoabF5llqvvvF67PYsPZP1xP8vE5ni4lZdkaolRLwOmVhoO2GrHiXGWw9hjFxa%2FroT8A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json;charset=utf-8
x-evy-trace-served-by-pod: iad02/cms-10-19-td/envoy-proxy-cc6445dd6-6n7f2
x-evy-trace-virtual-host: all
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 8c376e85df9babca-YYZ
x-robots-tag: none

GET
H3 200 home_1.jpg
www.benefitsguide.com/hs-fs/hubfs/ 123 KB
124 KB 356ms
352ms Image
image/webp 199.60.103.225
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.benefitsguide.com/hs-fs/hubfs/home_1.jpg?width=4280&height=1560&name=home_1.jpg

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.225 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef4af681d215fb4e485ed56007c2cc4f0c180d74a0fb0ad9e6b6fbd2e24133c1

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 21c66eb5f493a6e3ddbaa803cebfe014.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-tag: F-3994949994,P-167518,FLS-ALL
alt-svc: h3=":443"; ma=86400
content-length: 126438
cf-resized: internal=ram/- q=0 n=0+0 c=0+0 v=2024.9.1 l=126438
last-modified: Sun, 08 Oct 2017 02:59:15 GMT
cf-bgj: imgq:86,h2pri
server: cloudflare
etag: "cfRP5Ca6hBkGvTCnk6qbzrV2k3fMtIsxMag_KwYHnyDQ:137fbc59bbd8ca84bbf81d109274dd47"
vary: Accept, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lbKMoyhkT79002Zm1PgMx1ckm19fzGIZvbmMNZn%2F9qWCXL6s%2BJvFetHC%2B3mBEx4ORabFQVyGl3rBDUVtnzLMm0xw7jewii1L3%2BhORhcxY7JFULVtybFkUJV6jhPBfoLhESRew8NRaA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
accept-ranges: bytes
cf-ray: 8c376e85df9dabca-YYZ
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/fonts/ 55 KB
56 KB 54ms
31ms Font
font/woff2 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/fonts/fontawesome-webfont.woff2?v=4.3.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css
Origin: https://www.benefitsguide.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 871
age: 0
cdn-cachedat: 05/18/2024 16:57:23
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 56780
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: "97493d3f11c0a3bd5cbd959f5d19b699"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 76fdbd125fd16b6c7cd5c3b8dccfe499
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 8c376e860a4636ca-YYZ
cdn-requestpullsuccess: True

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 1131ms
32ms Image
text/plain 31.13.71.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=370267720426217&ev=PageView&dl=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&rl=&if=false&ts=1726390882229&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726390882226.260730415938838661&ler=empty&cdl=API_unavailable&it=1726390882085&coo=false&rqm=GET

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.71.36 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=31, rtx=0, c=10, mss=1316, tbw=2819, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 15 Sep 2024 09:01:23 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 1228ms
130ms Image
image/png 31.13.71.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=370267720426217&ev=PageView&dl=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&rl=&if=false&ts=1726390882229&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726390882226.260730415938838661&ler=empty&cdl=API_unavailable&it=1726390882085&coo=false&rqm=FGET

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.71.36 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: zstd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Sun, 15 Sep 2024 09:01:23 GMT
document-policy: force-load-at-top
x-fb-server-load: 44
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7414792383678198940", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=31, rtx=0, c=14, mss=1316, tbw=3137, tp=-1, tpl=-1, uplat=98, ullat=0
pragma: no-cache
x-fb-debug: vbNqCRW1NRt2scmOb70bgeJZp8jvT7u3rGE3v5PAWQuQg8zO2au1LPtoTbh57THF0KZczX+ke0yohERkKELwsA==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7414792383678198940"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 111ms
34ms Script
text/javascript 142.251.40.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N4TVF96

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 15 Sep 2024 08:06:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3318
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 15 Sep 2024 10:06:04 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 230 KB
83 KB 59ms
57ms Script
application/javascript 142.251.41.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-771006873

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N4TVF96

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.41.8 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a80e2211a255b6b5af392f8af84649fe9af26088099fad8d6205ef46215c4cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 84834
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 15 Sep 2024 09:01:22 GMT

GET
H3 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
849 B 408ms
80ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: b5dce517-6ab4-4a00-8f64-f45685b08068
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: b5dce517-6ab4-4a00-8f64-f45685b08068
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-xq7tw
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8c376e886a7faae8-YYZ

GET
H3 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
886 B 313ms
54ms Image
image/gif 104.19.175.188
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 931dce6d-e92d-47fd-a9a0-330dede16676
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 931dce6d-e92d-47fd-a9a0-330dede16676
server: cloudflare
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-9nz4q
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8c376e886a80aae8-YYZ

GET
H2 200 cf-location Show response
js.hs-banner.com/v2/ 5 B
149 B 3141ms
50ms Fetch
text/plain 104.18.40.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/cf-location
Requested by: Host: js.hs-banner.com
URL: https://js.hs-banner.com/v2/167518/banner.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.40.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e23be7c7fcc65f7f05618151f04af59ee18125d97df87a3b476e258404129118

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:25 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=1500
cf-ray: 8c376e9a4fbd369d-YYZ
content-length: 5

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 186 KB
67 KB 57ms
55ms Script
application/javascript 142.251.41.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-N3PTGLT

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.8 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f14.1e100.net

Software

Google Tag Manager /

Resource Hash

a52b185e206f4725c14ca521f39ff113fa32032a89743899f55039385dc982d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 68690
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 15 Sep 2024 09:01:22 GMT

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 122 B
1 KB 3191ms
100ms XHR
application/json 104.18.243.108
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=167518

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.243.108 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d707175429333c8ab6f7856fa39d3f6050e2981d245889d0f022adf73e89d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: ffd80f8d-e1f1-4503-891c-10e728c2d991
content-encoding: br
x-envoy-upstream-service-time: 8
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ffd80f8d-e1f1-4503-891c-10e728c2d991
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.benefitsguide.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-58bbf9c46c-5qqvs
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5S7DfwlSLrN%2BotenLjmT8wslW79Yjglbu8WwF6L06wxMODL0SmjCXIqyBwP8t1MRJNlJHONfkVD6ITQn%2FRn1kakmj8ixHSi8Djy0hVNMtc1YFgoSkUY8kHUkljFHxrwb"}],"group":"cf-nel","max_age":604800}
cf-ray: 8c376e9a5ba8ac51-YYZ
access-control-allow-headers: *

GET
H2 200 combinedConfigs Show response
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/ 95 B
1 KB 59ms
58ms Fetch
application/json 104.16.118.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=167518&currentUrl=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&contentId=6158145311

Requested by

Host: js.hubspot.com
URL: https://js.hubspot.com/web-interactives-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.118.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f212e942ac33fd93669f03a55e2c0192224cdb6870b376fac8d3c5255cd01225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: d8a65351-b6b5-429d-8a92-7b888db0d153
content-encoding: br
x-envoy-upstream-service-time: 7
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d8a65351-b6b5-429d-8a92-7b888db0d153
server: cloudflare
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.benefitsguide.com
x-evy-trace-virtual-host: all
access-control-max-age: 180
access-control-allow-credentials: true
cache-control: max-age=0, no-cache, no-store
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Y6AVouyeczphtt84jjBW2bFI4NxJP8PMqRcseL8Lk27NQiDop4Qden%2B4bPSr%2BzOFbFRQoH3ty%2BGEniMYtdhHKS90ZOIV0Bl1PJ3K8cUMU3sWCOid9eBOQ5Odc%2B5wFpdDTimuV39RVpssS1sF84%3D"}],"group":"cf-nel","max_age":604800}
x-robots-tag: noindex, follow
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 8c376e86ee99ac82-YYZ
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-rvb7q

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
225 B 52ms
46ms XHR
text/plain 142.251.40.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1973120981&t=pageview&_s=1&dl=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&ul=en-ca&de=UTF-8&dt=Start%20Here&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=268125874&gjid=1089569397&cid=906940419.1726390882&tid=UA-20562145-1&_gid=680340482.1726390882&_r=1&_slc=1&gtm=45He4990n81N4TVF96za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&z=298768333

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

d4b5d480bcfd3e38a1546d305c15e3f120b53a444c8d624ecd3ed293a5044116

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitsguide.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
68 B 49ms
45ms XHR
text/plain 142.251.40.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1973120981&t=pageview&_s=1&dl=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&ul=en-ca&de=UTF-8&dt=Start%20Here&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAACAAI~&jid=1512125314&gjid=2087903961&cid=906940419.1726390882&tid=UA-20562145-1&_gid=680340482.1726390882&_r=1&z=892330970

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitsguide.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 counters.gif
perf-na1.hsforms.com/embed/v3/ 35 B
928 B 88ms
60ms Image
image/gif 104.18.80.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 035dda89-f4e0-4062-998b-572185077ab6
x-envoy-upstream-service-time: 2
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 035dda89-f4e0-4062-998b-572185077ab6
last-modified: Sun, 15 Sep 2024 09:01:22 GMT
server: cloudflare
vary: origin, Accept-Encoding
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-ffbf7bf5c-k8vrm
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
cf-ray: 8c376e877c3936a4-YYZ

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 264 KB
93 KB 56ms
55ms Script
application/javascript 142.251.41.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-5PBSDVZRFS&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.8 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-200-3-19.deploy.static.akamaitechnologies.com

Software

Google Tag Manager /

Resource Hash

59c7bf9d265aaa5a220387be465b7bda37668364a8cd77bf85faeef6d6888deb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 95092
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 15 Sep 2024 09:01:22 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 1144ms
39ms Script
application/javascript 23.200.3.19
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3PTGLT

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.3.19 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=78975
accept-ranges: bytes
content-length: 14628

GET
H2 200 loader.js Show response
www.gstatic.com/wcm/ 6 KB
3 KB 121ms
31ms Script
text/javascript 142.250.72.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/wcm/loader.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-771006873

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f3.1e100.net

Software

sffe /

Resource Hash

670f77f11cb4c747f5de1affa5b53687cf7a20d1eaf99b0ef5c9c60858aefa55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 08:03:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3450
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2133
x-xss-protection: 0
last-modified: Wed, 20 Mar 2024 23:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 15 Sep 2024 09:03:53 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 50ms
49ms Fetch
text/plain 142.251.40.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-5PBSDVZRFS&gtm=45je4990v9128802946za200&_p=1726390881939&gcs=G100&gcd=13p3p3p3p6l1&npa=1&dma_cps=-&dma=0&tag_exp=0&gdid=dZTQ1Zm&ul=en-ca&sr=1600x1200&cid=906940419.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&dt=Start%20Here&sid=1726390882&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2245
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5PBSDVZRFS&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:23 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitsguide.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
762 B 151ms
76ms XHR
application/json 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=3215196&time=1726390883651&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: *
Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:23 GMT
content-encoding: gzip
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 81758DC91F594E6BA5FB3C7F5323922A Ref B: YTO01EDGE0814 Ref C: 2024-09-15T09:01:23Z
access-control-allow-methods: GET, OPTIONS
x-li-fabric: prod-lva1
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
content-type: application/json
x-li-proto: http/2
x-restli-protocol-version: 1.0.0
access-control-allow-headers: *
x-li-uuid: AAYiJLNeiBHOASuMotxtyQ==
x-fs-uuid: 00062224b35e8811ce012b8ca2dc6dc9

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3215196&time=1726390883651&li_adsId=c5ce63ba-2839-4f2d-bddc-a8167427c7b1&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3215196&time=1726390883651&li_adsId=c5ce63ba-2839-4f2d-bddc-a8167427c7b1&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3215196%26time%3D1726390883651%26li_adsId%3Dc5ce63ba-2839-4f2d-bddc-a8167427c7b1%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3215196&time=1726390883651&li_adsId=c5ce63ba-2839-4f2d-bddc-a8167427c7b1&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&cookiesTest=true&liS...

0
163 B

60ms
59ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3215196&time=1726390883651&li_adsId=c5ce63ba-2839-4f2d-bddc-a8167427c7b1&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&cookiesTest=true&liSync=true
Requested by: Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:24 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 8932ADB5BAD84CE8B50AE81C5268F2A6 Ref B: YTO01EDGE0721 Ref C: 2024-09-15T09:01:24Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYiJLNxYargTJBtWPRQng==

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
date: Sun, 15 Sep 2024 09:01:24 GMT
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAYiJLNwR02Ei4FHxlrGDA==
pragma: no-cache
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: C5130DFA2620457C83CF93D5EEDFB172 Ref B: YTO01EDGE0721 Ref C: 2024-09-15T09:01:24Z
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3215196&time=1726390883651&li_adsId=c5ce63ba-2839-4f2d-bddc-a8167427c7b1&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&cookiesTest=true&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 call-tracking_9.js Show response
www.gstatic.com/call-tracking/ 62 KB
21 KB 33ms
32ms Script
text/javascript 142.250.72.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/call-tracking/call-tracking_9.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/loader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.99 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f3.1e100.net

Software

sffe /

Resource Hash

6d8f8fd6de0b42e3acc7b2f3005c599e9f54d21355c3d6850a5c13daca10d5ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 13 Sep 2024 08:41:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 174018
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-telephony
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20777
x-xss-protection: 0
last-modified: Mon, 22 Jan 2024 22:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-telephony"
vary: Accept-Encoding
report-to: {"group":"ads-telephony","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-telephony"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 13 Sep 2025 08:41:05 GMT

GET
H3

200

wcm Show response
www.google.ca/pagead/attribution/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/771006873/wcm?cc=ZZ&dn=6464613000&cl=Y7ZsCP3iupMBEJnD0u8C&dma=0&dma_cps=-&npa=1&ct_eid=2
https://www.google.ca/pagead/attribution/wcm?cc=ZZ&dn=6464613000&cl=Y7ZsCP3iupMBEJnD0u8C&dma=0&dma_cps=-

80 B
111 B

86ms
45ms

XHR
application/json

142.251.40.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.ca/pagead/attribution/wcm?cc=ZZ&dn=6464613000&cl=Y7ZsCP3iupMBEJnD0u8C&dma=0&dma_cps=-

Requested by

Host: www.benefitsguide.com
URL: https://www.benefitsguide.com/start-here

Protocol

Server

142.251.40.195 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d933a98657089095397ca6126d62e3a07c39e70f82b36f8cea002c0ba5bf1e2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: null
content-type: application/json; charset=UTF-8
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87
x-xss-protection: 0

Redirect headers

date: Sun, 15 Sep 2024 09:01:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.google.ca/pagead/attribution/wcm?cc=ZZ&dn=6464613000&cl=Y7ZsCP3iupMBEJnD0u8C&dma=0&dma_cps=-
access-control-allow-origin: https://www.benefitsguide.com
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
201 B 64ms
63ms XHR
text/plain 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sun, 15 Sep 2024 09:01:24 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: DE46C4F9486649E1901C52DB67B6B48F Ref B: YTO01EDGE0721 Ref C: 2024-09-15T09:01:25Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
access-control-allow-origin: https://www.benefitsguide.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYiJLNya3+Cm8jx7JjCwA==

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
423 B 89ms
76ms Image
image/gif 104.16.117.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-ca&bfp=1682466047&v=1.1&a=167518&pi=6158145311&ct=standard-page&ccu=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&cpi=6158145311&lpi=6158145311&lvi=6158145311&pu=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&t=Start+Here&cts=1726390885039&vi=40f306257072c38ee6e7fece10ff3d85&nc=true&u=238250911.40f306257072c38ee6e7fece10ff3d85.1726390885035.1726390885035.1726390885035.1&b=238250911.1.1726390885036&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.117.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 8d8f5109-1510-4d98-90bc-9f1f7dcff0d5
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 5
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 8d8f5109-1510-4d98-90bc-9f1f7dcff0d5
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XfPq1GIFdw%2BmoXMZPShcz98cu3qle5wNKzhEaG7YKEdGirm4u%2FPJDuCSnMHSXJ3E0X5jTQ1gPjm1z4Kf0u1OJUIqW6mSonpN4z96fIo%2FLeGTOvNCe8QBb316u9VCIWlMpD2M"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-c4tkw
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8c376e97aaf1ac27-YYZ
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
595 B 80ms
72ms Image
image/gif 104.16.117.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=7c908f20-5346-45f2-bf32-e707acc6aed7&fci=a77dc203-a638-4f3d-bde0-d152fc765f3d&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-ca&bfp=1682466047&v=1.1&a=167518&pi=6158145311&ct=standard-page&ccu=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&cpi=6158145311&lpi=6158145311&lvi=6158145311&pu=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&t=Start+Here&cts=1726390885040&vi=40f306257072c38ee6e7fece10ff3d85&nc=true&u=238250911.40f306257072c38ee6e7fece10ff3d85.1726390885035.1726390885035.1726390885035.1&b=238250911.1.1726390885036&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.117.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 15 Sep 2024 09:01:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 2abc5871-8e11-4c28-a070-7042060a88de
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 6
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2abc5871-8e11-4c28-a070-7042060a88de
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YxaMKQBKJMm0jXmZXfz6mk7KrHm74kJgnOE3q3t3f1%2F2IDWXyDsqUgbFPBBxtMLVm843y2CO%2FU2iO4PE8CKLWlHfYcxKXuw13ii33rUZAsbTdpnE04zujCTlVOnwdCXCHWpn"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-7bf556f6f-jv576
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8c376e97aaf0ac27-YYZ
x-robots-tag: none

GET
H3 200 favicon.ico
cdn2.hubspot.net/hub/167518/ 1 KB
1 KB 62ms
62ms Other
image/vnd.microsoft.icon 104.18.89.62
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/167518/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.89.62 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f62ca764e686c4be460218a2b1a8af3d182119a237d3480d9161786c0019716

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-encoding: br
age: 2
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
edge-cache-tag: F-18392671,P-167518,FLS-ALL
x-amz-replication-status: COMPLETED
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-evy-trace-listener: listener_https
etag: W/"d889d10e9569f26fadf2d27d3066ed12"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: image/vnd.microsoft.icon
access-control-allow-origin: *
x-amz-meta-created-unix-time-millis: 1358797154000
cache-control: public, max-age=60
x-evy-trace-virtual-host: all
x-robots-tag: all
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3
date: Sun, 15 Sep 2024 09:01:25 GMT
via: 1.1 b140d5b0fbed1dab248b0959f44a7944.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: IAD61-P1
x-hubspot-correlation-id: d92f9394-eae0-4abb-8223-c3b573a5e3e1
x-cache: Miss from cloudfront
cache-tag: F-18392671,P-167518,FLS-ALL
x-amz-meta-index-tag: all
x-amz-storage-class: INTELLIGENT_TIERING
x-envoy-upstream-service-time: 233
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: d92f9394-eae0-4abb-8223-c3b573a5e3e1
last-modified: Tue, 14 Feb 2023 18:59:49 GMT
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8WEtxMwbjKwocpbvVtrtG4VZI40U67T676i9LkuF1mf3EJ7CKKFN57l%2FUXl9pxXXxcR2qVnERUpc4IKrWICyFFsP1bOrDJTAFoEWY%2BWaohJfEI13CloQ4angjB6YbV%2BFc5M%3D"}],"group":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod: iad02/cms-cdn2-td/envoy-proxy-6748d4cfc8-4xkm9
cf-ray: 8c376e97ac31aad3-YYZ
timing-allow-origin: cdn2.hubspot.net
x-amz-cf-id: HbkH5qgdmHmrDictMQ8z1Q90a0_1ykl87VFd2yOaVIeLh72ky-b89A==

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/771006873/ 5 KB
2 KB 133ms
58ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/771006873/?random=1726390885507&cv=11&fst=1726390885507&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=935751645.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-771006873

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f2.1e100.net

Software

cafe /

Resource Hash

b395212be63c9bc2a4d0f41c2dd699392fb2448e2e349e186b70582fa69fcb9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 771006873
td.doubleclick.net/td/rul/ Frame 4402 0
0 155ms
55ms Document
text/html 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/771006873?random=1726390885507&cv=11&fst=1726390885507&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=935751645.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-771006873

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 09:01:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/771006873/ 5 KB
2 KB 123ms
55ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/771006873/?random=1726390885528&cv=11&fst=1726390885528&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=935751645.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-771006873

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f2.1e100.net

Software

cafe /

Resource Hash

95fa9f32b1cc75aabec46c8910da96651b9f1878230e8d711840eaa751ddcd81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2299
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 771006873
td.doubleclick.net/td/rul/ Frame 2D81 0
0 165ms
70ms Document
text/html 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/771006873?random=1726390885528&cv=11&fst=1726390885528&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=935751645.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-771006873

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 09:01:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/771006873/ 5 KB
2 KB 93ms
92ms Script
text/javascript 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/771006873/?random=1726390885534&cv=11&fst=1726390885534&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcs=G111&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&label=Y7ZsCP3iupMBEJnD0u8C&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&gtm_ee=1&npa=0&pscdl=noapi&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&auid=935751645.1726390882&fledge=1&capi=1&gcu=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-771006873

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da9ea39963b80160cb65959a3937c72d13d5958bd411cdc071c7d75531c4887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2523
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 771006873
td.doubleclick.net/td/rul/ Frame 4BE2 0
0 145ms
56ms Document
text/html 142.251.40.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/771006873?random=1726390885534&cv=11&fst=1726390885534&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcs=G111&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&label=Y7ZsCP3iupMBEJnD0u8C&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&gtm_ee=1&npa=0&pscdl=noapi&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&auid=935751645.1726390882&fledge=1&capi=1&gcu=1&data=event%3Dgtag.config&ct_cookie_present=0

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-771006873

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Sep 2024 09:01:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.google.ca/pagead/1p-conversion/771006873/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/771006873/?random=307924612&cv=11&fst=1726390885534&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcs=G111&gcd=13r3r3r3r5l1&...
https://www.google.com/pagead/1p-conversion/771006873/?random=307924612&cv=11&fst=1726390885534&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcs=G111&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1...
https://www.google.ca/pagead/1p-conversion/771006873/?random=307924612&cv=11&fst=1726390885534&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcs=G111&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=16...

42 B
64 B

57ms
57ms

Image
image/gif

142.251.40.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/771006873/?random=307924612&cv=11&fst=1726390885534&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcs=G111&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&label=Y7ZsCP3iupMBEJnD0u8C&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&gtm_ee=1&npa=0&pscdl=noapi&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&auid=935751645.1726390882&fledge=1&capi=1&gcu=1&data=event%3Dgtag.config&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7ECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMIoProm8vEiAMVji2ICR07twy4MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOihodHRwczovL3d3dy5iZW5lZml0c2d1aWRlLmNvbS9zdGFydC1oZXJl&is_vtc=1&cid=CAQSGwDpaXnfkEJ_3VFtAJPMx8TzEa1S0eXLc2DO1Q&random=1948911216&ipr=y

Protocol

Server

142.251.40.195 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/771006873/?random=307924612&cv=11&fst=1726390885534&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcs=G111&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&label=Y7ZsCP3iupMBEJnD0u8C&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&gtm_ee=1&npa=0&pscdl=noapi&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&auid=935751645.1726390882&fledge=1&capi=1&gcu=1&data=event%3Dgtag.config&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECCLHDsQIIisWxAgibx7ECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMIoProm8vEiAMVji2ICR07twy4MgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOihodHRwczovL3d3dy5iZW5lZml0c2d1aWRlLmNvbS9zdGFydC1oZXJl&is_vtc=1&cid=CAQSGwDpaXnfkEJ_3VFtAJPMx8TzEa1S0eXLc2DO1Q&random=1948911216&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/771006873/ 42 B
64 B 219ms
50ms Image
image/gif 142.250.72.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/771006873/?random=1726390885528&cv=11&fst=1726390800000&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=935751645.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnf4GutHOkp4KkPJZLFRNdUDCXwnr01Eg&random=306646434&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/771006873/ 42 B
64 B 50ms
49ms Image
image/gif 142.251.40.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/771006873/?random=1726390885528&cv=11&fst=1726390800000&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=935751645.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnf4GutHOkp4KkPJZLFRNdUDCXwnr01Eg&random=306646434&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.195 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/771006873/ 42 B
64 B 209ms
57ms Image
image/gif 142.250.72.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/771006873/?random=1726390885507&cv=11&fst=1726390800000&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=935751645.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfACQVHzt0KzteoqJJH3GKBqgyauQOqA&random=946630689&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsguide.com/start-here
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 15 Sep 2024 09:01:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/771006873/ 42 B
64 B 52ms
51ms Image
image/gif 142.251.40.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/771006873/?random=1726390885507&cv=11&fst=1726390800000&bg=ffffff&guid=ON&async=1&gtm=45be4990v890881446za200&gcd=13r3r3r3r5l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.benefitsguide.com%2Fstart-here&hn=www.googleadservices.com&frm=0&tiba=Start%20Here&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=935751645.1726390882&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfACQVHzt0KzteoqJJH3GKBqgyauQOqA&random=946630689&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.195 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS