heloc.westcapitallending.com Open in urlscan Pro
34.96.110.110 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://westcapheloc.com/
Effective URL:
https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Submission: On December 07 via api (December 7th 2024, 1:24:31 pm UTC) from US — Scanned from CA

Summary HTTP 107 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 14 IPs in 1 countries across 11 domains to perform 107 HTTP transactions. The main IP is 34.96.110.110, located in Kansas City, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is heloc.westcapitallending.com.
TLS certificate: Issued by R11 on November 11th 2024. Valid for: 3 months.

This is the only time heloc.westcapitallending.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	15.197.225.128 15.197.225.128	16509 (AMAZON-02) (AMAZON-02)
23	34.96.110.110 34.96.110.110	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	34.98.83.188 34.98.83.188	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	172.253.63.95 172.253.63.95	15169 (GOOGLE) (GOOGLE)
1	3.171.85.95 3.171.85.95	16509 (AMAZON-02) (AMAZON-02)
2	172.67.12.227 172.67.12.227	13335 (CLOUDFLAR...) (CLOUDFLARENET)
52	34.160.235.105 34.160.235.105	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	3.233.158.26 3.233.158.26	14618 (AMAZON-AES) (AMAZON-AES)
2	35.201.112.186 35.201.112.186	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	18.160.18.123 18.160.18.123	16509 (AMAZON-02) (AMAZON-02)
1	172.253.122.207 172.253.122.207	15169 (GOOGLE) (GOOGLE)
2	142.251.167.94 142.251.167.94	15169 (GOOGLE) (GOOGLE)
1	18.67.65.102 18.67.65.102	16509 (AMAZON-02) (AMAZON-02)
3	35.186.194.58 35.186.194.58	15169 (GOOGLE) (GOOGLE)
107	14

1 15.197.225.128 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: aec037177372cc6cd.awsglobalaccelerator.com

westcapheloc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 34.96.110.110 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 110.110.96.34.bc.googleusercontent.com

heloc.westcapitallending.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.98.83.188 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 188.83.98.34.bc.googleusercontent.com

cdn.figure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.63.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.171.85.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-171-85-95.iad89.r.cloudfront.net

cdn.plaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.12.227 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.talkjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 34.160.235.105 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 105.235.160.34.bc.googleusercontent.com

figure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.figure.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.233.158.26 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-233-158-26.compute-1.amazonaws.com

browser-intake-datadoghq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.112.186 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.160.18.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-18-123.iad12.r.cloudfront.net

code.upscope.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.122.207 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f207.1e100.net

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.167.94 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.67.65.102 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-65-102.iad89.r.cloudfront.net

js.upscope.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.186.194.58 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 58.194.186.35.bc.googleusercontent.com

rs.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	figure.com cdn.figure.com — Cisco Umbrella Rank: 438653 figure.com — Cisco Umbrella Rank: 274956 www.figure.com — Cisco Umbrella Rank: 324473	138 KB
23	westcapitallending.com heloc.westcapitallending.com	7 MB
5	fullstory.com edge.fullstory.com — Cisco Umbrella Rank: 2093 rs.fullstory.com — Cisco Umbrella Rank: 2203	87 KB
5	browser-intake-datadoghq.com csp-report.browser-intake-datadoghq.com Failed browser-intake-datadoghq.com — Cisco Umbrella Rank: 542	783 B
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29 storage.googleapis.com — Cisco Umbrella Rank: 314	60 KB
2	gstatic.com fonts.gstatic.com	54 KB
2	upscope.io code.upscope.io — Cisco Umbrella Rank: 25518 js.upscope.io — Cisco Umbrella Rank: 39148	45 KB
2	talkjs.com cdn.talkjs.com — Cisco Umbrella Rank: 76236	78 KB
1	plaid.com cdn.plaid.com — Cisco Umbrella Rank: 15403	48 KB
1	westcapheloc.com 1 redirects westcapheloc.com	382 B
0	googletagmanager.com Failed www.googletagmanager.com Failed
107	11

	Domain	Requested by
46	www.figure.com	heloc.westcapitallending.com
23	heloc.westcapitallending.com	heloc.westcapitallending.com
6	figure.com	heloc.westcapitallending.com
5	browser-intake-datadoghq.com	heloc.westcapitallending.com
4	fonts.googleapis.com	heloc.westcapitallending.com
4	cdn.figure.com	heloc.westcapitallending.com
3	rs.fullstory.com	heloc.westcapitallending.com edge.fullstory.com
2	fonts.gstatic.com	fonts.googleapis.com
2	edge.fullstory.com	heloc.westcapitallending.com
2	cdn.talkjs.com	heloc.westcapitallending.com
1	js.upscope.io	code.upscope.io
1	storage.googleapis.com	heloc.westcapitallending.com
1	code.upscope.io	heloc.westcapitallending.com
1	cdn.plaid.com	heloc.westcapitallending.com
1	westcapheloc.com	1 redirects
0	www.googletagmanager.com Failed	heloc.westcapitallending.com
0	csp-report.browser-intake-datadoghq.com Failed	heloc.westcapitallending.com js.upscope.io
107	17

This site contains links to these domains. Also see Links.

Domain
westcapitallending.com
www.nmlsconsumeraccess.org

Subject Issuer	Validity	Valid
heloc.westcapitallending.com R11	`2024-11-11` - `2025-02-09`	3 months	crt.sh
*.figure.com Go Daddy Secure Certificate Authority - G2	`2024-11-24` - `2025-01-23`	2 months	crt.sh
upload.video.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
secure.plaid.com DigiCert EV RSA CA G2	`2024-03-12` - `2025-03-11`	a year	crt.sh
talkjs.com E5	`2024-10-25` - `2025-01-23`	3 months	crt.sh
*.browser-intake-datadoghq.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-14` - `2025-05-17`	a year	crt.sh
edge.fullstory.com WR3	`2024-10-20` - `2025-01-18`	3 months	crt.sh
upscope.io Amazon RSA 2048 M03	`2024-09-22` - `2025-10-22`	a year	crt.sh
storage.googleapis.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
rs.fullstory.com WR3	`2024-10-22` - `2025-01-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Frame ID: 9DD4322B8DBB5ECF0F7D63B06D272F00
Requests: 88 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WCL | Get Started

Page URL History Show full URLs

https://westcapheloc.com/ HTTP 301
https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

107
Requests

94 %
HTTPS

0 %
IPv6

11
Domains

17
Subdomains

14
IPs

1
Countries

7179 kB
Transfer

8018 kB
Size

5
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://westcapitallending.com/terms-of-use
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://westcapitallending.com/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.nmlsconsumeraccess.org/EntityDetails.aspx/COMPANY/1566096
Title: NMLS consumer access

Search URL Search Domain Scan URL

URL: https://www.nmlsconsumeraccess.org/
Title: www.nmlsconsumeraccess.org

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://westcapheloc.com/ HTTP 301
https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

107 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request register Show response
heloc.westcapitallending.com/account/heloc/
Redirect Chain

https://westcapheloc.com/
https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

5 KB
7 KB

506ms
92ms

Document
text/html

34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

f168316778f97e31e7ed1b99344eb68fc1c1117d66b2de16d7949d3836f54c3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-DqpKHmkO287AzcTlE8zlwQ==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Sat, 07 Dec 2024 13:24:18 GMT
origin-agent-cluster: ?1
referrer-policy: strict-origin
strict-transport-security: max-age=15552000; includeSubDomains
vary: Origin
via: kong/3.4.2, 1.1 google
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-kong-proxy-latency: 0
x-kong-upstream-latency: 16
x-permitted-cross-domain-policies: none
x-xss-protection: 0

Redirect headers

Connection: close
Content-Length: 140
Content-Type: text/html; charset=utf-8
Date: Sat, 07 Dec 2024 13:24:18 GMT
Location: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Server: ip-10-123-124-37.ec2.internal
Vary: Accept-Encoding
X-Request-Id: 7f9ea11b-fe96-47ca-950f-425d233d48cc

GET
H2 200 SharpGroteskMedium21.otf
cdn.figure.com/fonts/ 96 KB
96 KB 865ms
42ms Font
application/octet-stream 34.98.83.188
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.figure.com/fonts/SharpGroteskMedium21.otf
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.83.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 188.83.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 44ce8e208b4ec6dd5fc4639d4df94b720f4dc2f7d6fb512d0b9c2d236b6384ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer: https://heloc.westcapitallending.com/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=Lpo08A==, md5=QNlV3FQiDTuuzFYJhvlJ8g==
etag: "40d955dc54220d3baecc560986f949f2"
age: 41256
x-goog-stored-content-encoding: identity
expires: Sun, 07 Dec 2025 01:56:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 98048
date: Sat, 07 Dec 2024 01:56:43 GMT
last-modified: Mon, 01 May 2023 16:19:07 GMT
content-type: application/octet-stream
x-guploader-uploadid: AFiumC6pScwzwxWCn9Q4PT74i3BCAnvJF_whdh3YW52e_oiLvEV-Lw6HkcsSaWb2TTJY74CoBIlZiOFPsg
cache-control: max-age=31622400, public
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1682957947901988
content-length: 98048
server: UploadServer

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
722 B 955ms
94ms Stylesheet
text/css 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&display=swap

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

ESF /

Resource Hash

3f6fe4e936de332aea22d2b6e44538ce8e99af9ea7f120799fe4f0c66984aa88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 07 Dec 2024 13:24:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:19 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sat, 07 Dec 2024 13:24:19 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 SharpGroteskMedium21.css
cdn.figure.com/fonts/ 196 B
713 B 885ms
64ms Stylesheet
text/css 34.98.83.188
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.figure.com/fonts/SharpGroteskMedium21.css
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.83.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 188.83.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: c9613edf945298c94c54051577badfd41a4d656cebcfab79967ce062e26c6fd6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

x-goog-metageneration: 2
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=gIMERA==, md5=cGE/YONGpZqLYZSYpf9opA==
etag: "70613f60e346a59a8b619498a5ff68a4"
age: 13450
x-goog-stored-content-encoding: identity
expires: Sun, 07 Dec 2025 09:40:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 196
date: Sat, 07 Dec 2024 09:40:09 GMT
last-modified: Thu, 18 Apr 2024 17:58:16 GMT
content-type: text/css
x-guploader-uploadid: AFiumC4UIwx0VPyZNaCdIMwvKs_lJRhNvNJcbhE-h0RuYPAPEjdumhgC-wCtCxsILdGAmjMQlevwZfXdqw
cache-control: max-age=31622400, public
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1713463096968127
content-length: 196
server: UploadServer

GET
H2 200 index-CyES_nyK.css
heloc.westcapitallending.com/account/heloc/assets/ 100 KB
101 KB 95ms
87ms Stylesheet
text/css 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/index-CyES_nyK.css

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

7522d4a4fca21ce5dfc1ff310be24f8ceebe101b122262c3fb8b2630fd9cc194

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"18f30-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:19 GMT
content-type: text/css; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-rI2rU4cOGOTUPxcEg2dMIQ==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
x-kong-upstream-latency: 7
content-length: 102192
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 vendor-DKjsUhCV.css
heloc.westcapitallending.com/account/heloc/assets/ 9 KB
10 KB 89ms
83ms Stylesheet
text/css 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/vendor-DKjsUhCV.css

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

2e5c86b35b2d4629d036b71f6bd5cc5ededb660a8afd42856064d47e82eeef19

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"23b7-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:19 GMT
content-type: text/css; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-324lPUlpf9IytY3mOjuHTw==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
x-kong-upstream-latency: 7
content-length: 9143
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 link-initialize.js Show response
cdn.plaid.com/link/v2/stable/ 157 KB
48 KB 972ms
112ms Script
text/javascript 3.171.85.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.plaid.com/link/v2/stable/link-initialize.js
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.85.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-85-95.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5deeee29d6ebe9a8c0048949aed8b997c860fc32a4e6d7983eea613dcb93b9db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

content-encoding: br
x-amz-version-id: kVgQ2bArzv_0ekLG8STd6g5FI4upkQNZ
etag: W/"0f584050ec8693e96ef74b80291de807"
age: 8231
x-cache: Hit from cloudfront
x-amz-cf-id: 3NafeoN9hQNEdNVV8VwueQkuqMyn99igqDKJaw5Y7JcgIcfW1P-iGw==
date: Sat, 07 Dec 2024 11:07:09 GMT
content-type: text/javascript
vary: accept-encoding
last-modified: Sat, 07 Dec 2024 01:52:27 GMT
x-amz-id-2: c2dDqc00m30pwOUtY7VhytTK1Ap9yIT5ZKdJU4tXfnybEK+jGUIuEHGpOWQtWuuGUModyRDNcpA=
x-amz-replication-status: COMPLETED
cache-control: no-cache,must-revalidate,max-age=0
via: 1.1 e4ed21ef6440d05d23aa2a82e459e776.cloudfront.net (CloudFront)
x-amz-request-id: 7YC6QVY9A9SZYZ35
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
991 B 951ms
93ms Stylesheet
text/css 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Public+Sans:ital,wght@0,100..900;1,100..900&display=swap

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

ESF /

Resource Hash

5ec00663f747b3e2e32b5a3c356139f364b919fc518663e09b97d55c8cc1f738

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 07 Dec 2024 13:24:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:19 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sat, 07 Dec 2024 13:15:17 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ 59 KB
14 KB 956ms
97ms Stylesheet
text/css 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Gothic+A1|Poppins:400,600,700

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

ESF /

Resource Hash

fb6a90533bb1039d96d3b025b8c1d3a727f931d7e038d986ac5408e8753fd27c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 07 Dec 2024 13:24:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:19 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sat, 07 Dec 2024 13:24:19 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 index-VGVW-aGt.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 344 KB
346 KB 142ms
138ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/index-VGVW-aGt.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

aaaa3328b168b7c0abdec5bcfdc55123194f816dd40ba3cbe139d7940aa0c6a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"55f04-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:19 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-ZsxCbxN4GgOeihbmNn0h7A==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 352004
x-xss-protection: 0
x-kong-upstream-latency: 5
origin-agent-cluster: ?1

GET
H2 200 vendor-B8vnu2Vi.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 6 MB
6 MB 139ms
135ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

db388884b2daa2f0c572a951912da8d0446d7e3257ea45fbc4ea70126703cfd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"5f4383-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:19 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-K7DgTMmcq7Hpwq3TO2MPgA==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 6243203
x-xss-protection: 0
x-kong-upstream-latency: 7
origin-agent-cluster: ?1

GET
H2 200 talk.js Show response
cdn.talkjs.com/ 212 KB
66 KB 899ms
60ms Script
application/javascript 172.67.12.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.talkjs.com/talk.js
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.12.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c8916d68ffc33236e339208c3fd32dff34ff057b6fa5c36f3b67f94564a953b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: DNT,X-CustomHeader,x-talkjs-client-build,x-talkjs-client-date,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
content-encoding: gzip
cf-cache-status: HIT
etag: W/"67482d62-351c3"
age: 294
access-control-allow-methods: GET, PATCH, PUT, POST, OPTIONS
expires: Thu, 01 Jan 1970 00:00:01 GMT
traceparent: 00-542c36f2cd134871b5cf4f9415cb89b0-446da86a1fe34812-03
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 08:44:18 GMT
vary: Accept-Encoding
access-control-allow-headers: DNT,X-CustomHeader,x-talkjs-client-build,x-talkjs-client-date,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
x-cache-status: MISS
x-talkjs-node: production-1-6091
cache-control: public, s-maxage=600, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
cf-ray: 8ee4d5e69842ab7e-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 177 KB
40 KB 90ms
88ms Stylesheet
text/css 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Gothic+A1:wght@400;500;700&family=Poppins:wght@700&display=swap

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

ESF /

Resource Hash

5ab2392baa94a81d11bbf695e6be528a25eef7b98e71fe57a090eb034e7b6498

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 07 Dec 2024 13:24:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:21 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sat, 07 Dec 2024 13:24:21 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

POST logs
csp-report.browser-intake-datadoghq.com/api/v2/ 0
0

GET
H2 200 openStatus Show response
figure.com/service-operating-hours/external/api/v1/hours/OPS_CHAT/ 5 B
321 B 94ms
91ms XHR
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://figure.com/service-operating-hours/external/api/v1/hours/OPS_CHAT/openStatus

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

X-With-Origin: https://heloc.westcapitallending.com
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json
x-org: FIGURE

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
referrer-policy: no-referrer
x-content-type-options: nosniff
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 12
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5
x-xss-protection: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin
x-kong-proxy-latency: 0

GET
H3 404 figureinfo Show response
www.figure.com/identity-broker/customer/secure/api/v3/self/ 43 B
60 B 211ms
81ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 50a54babd6925c032ba35886887123edd09916dc3bc17e8e6f6759bf31cdfafa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
X-Auth0-Application-Name: heloc
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
x-kong-response-latency: 1
content-type: application/json
vary: Origin
server: kong/3.4.2

GET
H2 200 metadata Show response
www.figure.com/service-organization-metadata/external/api/v1/organizations/WEST_CAPITAL_LENDING_INC/ 2 KB
2 KB 554ms
109ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-organization-metadata/external/api/v1/organizations/WEST_CAPITAL_LENDING_INC/metadata

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

d871752bfcd63f2efb48c6347faebddb0a26bfe5ed5e7a61c36172b81d93c975

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
referrer-policy: no-referrer
x-content-type-options: nosniff
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 2
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1693
x-xss-protection: 1 ; mode=block
date: Sat, 07 Dec 2024 13:24:21 GMT
content-type: application/json
vary: Origin
x-kong-proxy-latency: 0

GET
H2 200 wl-info Show response
www.figure.com/processor-underwriting/public/api/v1/ 409 B
668 B 555ms
110ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/processor-underwriting/public/api/v1/wl-info?org=WEST_CAPITAL_LENDING_INC

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

cfde7d9f3f077ad894fac5ab368a2069ab1666f5b594e59f77c0913ffbe33743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 2
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

POST
H3 200 session Show response
www.figure.com/ft/external/ 176 B
197 B 232ms
101ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/session

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

cad989f414d70a75733b2ac32369225f3d0cb679ffa5047037c9aef40de563df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 26
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

POST
H3 200 session Show response
www.figure.com/ft/external/ 176 B
197 B 246ms
100ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/session

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

f39f1a273c067f73565b6b83532ff90e7c1e7cd16f9ed1542d6211398699f4bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 24
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

POST
H3 200 session Show response
heloc.westcapitallending.com/ft/external/ 176 B
197 B 120ms
119ms Fetch
application/json 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/ft/external/session

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

8993db6854e432873a3f914db49d4a2684c7b13e14b28f89062d1ed62ed36e1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 21
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:21 GMT
content-type: application/json
vary: Origin

POST
H3 200 session Show response
heloc.westcapitallending.com/ft/external/ 179 B
200 B 87ms
71ms Fetch
application/json 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/ft/external/session

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

ed1be05d0ad7b70d2e5540cd17fbe452a6796dee1488bdd2cd05b37f79ade99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 2
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 5
date: Sat, 07 Dec 2024 13:24:21 GMT
content-type: application/json
vary: Origin

OPTIONS
H2 200 openStatus
figure.com/service-operating-hours/external/api/v1/hours/OPS_CHAT/ 0
0 541ms
135ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://figure.com/service-operating-hours/external/api/v1/hours/OPS_CHAT/openStatus

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: x-org,x-with-origin
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

OPTIONS
H2 200 figureinfo
www.figure.com/identity-broker/customer/secure/api/v3/self/ 0
0 536ms
90ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: x-auth0-application-name
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

OPTIONS
H2 200 session
www.figure.com/ft/external/ 0
0 535ms
91ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/session

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

OPTIONS
H2 200 session
www.figure.com/ft/external/ 0
0 533ms
89ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/session

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

POST
H2 202 rum Show response
browser-intake-datadoghq.com/api/v2/ 53 B
287 B 635ms
105ms Fetch
application/json 3.233.158.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.11.0%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Afrontend-heloc&dd-api-key=pub12f76571c55a1c6efcc45166d57d29b6&dd-evp-origin-version=5.11.0&dd-evp-origin=browser&dd-request-id=4fa5400e-a760-48fc-900b-283c9f1d3812&batch_time=1733577861808

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.158.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-158-26.compute-1.amazonaws.com

Software

Resource Hash

65b07b75376250beec7cb8703fe4de9e0f3b22e062b3dc7d60a2f64132424791

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
dd-request-id: 4fa5400e-a760-48fc-900b-283c9f1d3812

POST
H3 200 feature Show response
heloc.westcapitallending.com/service-optimize/external/api/v1/ 89 B
110 B 112ms
109ms Fetch
application/json 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/service-optimize/external/api/v1/feature

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

35aaaafa3378cf4ee387a9a8179ee2de66f1be28827ef938819c9bda9303d1ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 26
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:21 GMT
content-type: application/json
vary: Origin

GET gtm.js
www.googletagmanager.com/ 0
0

POST logs
csp-report.browser-intake-datadoghq.com/api/v2/ 0
0

POST
H3 200 session Show response
figure.com/ft/external/ 179 B
200 B 81ms
78ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://figure.com/ft/external/session

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

ed1be05d0ad7b70d2e5540cd17fbe452a6796dee1488bdd2cd05b37f79ade99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 4
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

OPTIONS
H2 200 session
figure.com/ft/external/ 0
0 73ms
72ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://figure.com/ft/external/session

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

GET
H2 206 5e83cb28291edefe5f467e9b31453b97.mp3
cdn.talkjs.com/__assets/ 12 KB
13 KB 50ms
47ms Media
audio/mpeg 172.67.12.227
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.talkjs.com/__assets/5e83cb28291edefe5f467e9b31453b97.mp3
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.12.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f39b8368d883d351157f527bc6ce0f505177383e886d2a48b4098ffabb8ac1b5

Request headers

Referer: https://heloc.westcapitallending.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

x-cache-status: HIT
x-talkjs-node: <CACHE>
cf-cache-status: HIT
etag: "6744606d-3194"
age: 712
Content-Range: bytes 0-12691/12692
cf-ray: 8ee4d5e768f2ab7e-YYZ
traceparent
alt-svc: h3=":443"; ma=86400
Content-Length: 12692
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: audio/mpeg
last-modified: Mon, 25 Nov 2024 11:33:01 GMT
vary: Accept-Encoding
server: cloudflare

POST
H3 200 session Show response
www.figure.com/ft/external/ 179 B
200 B 86ms
79ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/session

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

df3faf441d897eac53440dab0836d773ccbc823aaace8c068923839358b5cccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 3
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

POST
H3 200 event Show response
www.figure.com/ft/external/ 181 B
202 B 87ms
85ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/event

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

8c86862a8e57eaded631d5824ea45178d65ec09780ebca58a9f6bca21e32ad57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 6
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 2
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

OPTIONS
H3 200 event
www.figure.com/ft/external/ 0
0 81ms
77ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/event

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

POST logs
csp-report.browser-intake-datadoghq.com/api/v2/ 0
0

POST
H3 200 features Show response
figure.com/service-optimize/external/api/v1/ 10 KB
10 KB 142ms
141ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://figure.com/service-optimize/external/api/v1/features

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

500261b0e3c56adf7f6ad85b47948b3063da2f237ffbb072a04e107732a12c53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 54
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 0
date: Sat, 07 Dec 2024 13:24:21 GMT
content-type: application/json
vary: Origin

POST
H2 202 rum Show response
browser-intake-datadoghq.com/api/v2/ 53 B
113 B 101ms
94ms Fetch
application/json 3.233.158.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.11.0%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Afrontend-heloc&dd-api-key=pub12f76571c55a1c6efcc45166d57d29b6&dd-evp-origin-version=5.11.0&dd-evp-origin=browser&dd-request-id=42dc8c88-853b-460f-9970-79c58804ba36&batch_time=1733577862425

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.158.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-158-26.compute-1.amazonaws.com

Software

Resource Hash

8c7f3efecf86f0e2399abd397028b60830cd5ec67129688eb02e841aced14f47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
dd-request-id: 42dc8c88-853b-460f-9970-79c58804ba36

POST
H3 200 features Show response
www.figure.com/service-optimize/external/api/v1/ 10 KB
10 KB 129ms
128ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-optimize/external/api/v1/features

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

094255ac57289c188e73af016581729d290bc9b7de3ee162f88610b7d09d9695

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 54
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 0
date: Sat, 07 Dec 2024 13:24:21 GMT
content-type: application/json
vary: Origin

OPTIONS
H3 200 features
figure.com/service-optimize/external/api/v1/ 0
0 74ms
74ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://figure.com/service-optimize/external/api/v1/features

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

OPTIONS
H3 200 features
www.figure.com/service-optimize/external/api/v1/ 0
0 77ms
77ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-optimize/external/api/v1/features

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

POST logs
csp-report.browser-intake-datadoghq.com/api/v2/ 0
0

GET
H2 200 fs.js Show response
edge.fullstory.com/s/ 286 KB
78 KB 267ms
44ms Script
application/javascript 35.201.112.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8ee3657560b1a271d276a415951fe1e5451e258da97a10c639e6b9aba2f28e1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer: https://heloc.westcapitallending.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding: br
x-goog-hash: crc32c=ZmBNIA==, md5=0Vgo23dc3Qpu85CjYQ6d0Q==
etag: "d15828db775cdd0a6ef390a3610e9dd1"
age: 2234
x-goog-stored-content-encoding: br
expires: Sat, 07 Dec 2024 13:47:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 79132
date: Sat, 07 Dec 2024 12:47:08 GMT
last-modified: Thu, 14 Nov 2024 14:06:07 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AFiumC7lquFNQNCvqnHh-DSIkEkeaXonYcgry0UIh4qwk1WARtGlrOv-pgxBWEmRxefXsWeLooc
cache-control: public, max-age=3600,no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1731593167065982
content-length: 79132
server: UploadServer

POST
H3 200 session Show response
www.figure.com/ft/external/ 179 B
200 B 104ms
103ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/session

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

df3faf441d897eac53440dab0836d773ccbc823aaace8c068923839358b5cccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 3
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

GET
H3 404 figureinfo Show response
www.figure.com/identity-broker/customer/secure/api/v3/self/ 43 B
60 B 100ms
98ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 130ae159fc42fedaa90c9c50f9f6163f2774ac0c984f8b0f13787c87c84db498

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
X-Auth0-Application-Name: heloc
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
x-kong-response-latency: 0
content-type: application/json
vary: Origin
server: kong/3.4.2

POST
H3 200 session Show response
www.figure.com/ft/external/ 179 B
200 B 98ms
96ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/ft/external/session

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

df3faf441d897eac53440dab0836d773ccbc823aaace8c068923839358b5cccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 3
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

GET
H3 200 register-Cc6ZWpPB.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 88 KB
88 KB 128ms
112ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/register-Cc6ZWpPB.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

dcabb60354dc06c348aef3c95341cb6f95a2a738e66b01dbcd666beb111d9820

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"15ee5-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-FvNC6YFYxQJHp/bnNxo7kA==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 89829
x-xss-protection: 0
x-kong-upstream-latency: 6
origin-agent-cluster: ?1

GET
H3 200 use-get-consent-types-CXFawtYD.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 325 B
360 B 106ms
90ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/use-get-consent-types-CXFawtYD.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

87baf4a2c13e737b00120eb475e458e67404d3835ff05047068ac3ade22713d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"145-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-clT+ERVtfCwoj2ekjAYJFQ==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 325
x-xss-protection: 0
x-kong-upstream-latency: 3
origin-agent-cluster: ?1

GET
H3 200 consent-enums-CpBjFeCY.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 859 B
894 B 147ms
132ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/consent-enums-CpBjFeCY.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

3f1ffb67ef889511c1e04faea88dd21a9f9a9b3e3f77ca62ebb09d77a68cfe4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"35b-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-RpQIzIX7+kTbji5W4MmCeQ==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 859
x-xss-protection: 0
x-kong-upstream-latency: 10
origin-agent-cluster: ?1

GET
H3 200 use-get-profile-consents-Bab0bmqw.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 272 B
307 B 151ms
135ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/use-get-profile-consents-Bab0bmqw.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

36e741500aa8fa3529df2fe924d778f4678ffa00f858124de6c05a1b967e85c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"110-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-vhi9ee7WSYOtFysaIkhqHA==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 272
x-xss-protection: 0
x-kong-upstream-latency: 10
origin-agent-cluster: ?1

GET
H3 200 use-sms-consent-BA5n2s4b.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 3 KB
3 KB 148ms
132ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/use-sms-consent-BA5n2s4b.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

b72a5bb670565127b87da6efaf436780e42c726c6630ff270831e0098eacd5ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"bbd-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-6jtkO3jZ3OBouZ8FiqAq0w==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 3005
x-xss-protection: 0
x-kong-upstream-latency: 10
origin-agent-cluster: ?1

GET
H3 200 section-fieldset-Cu3NA7ze.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 1 KB
1 KB 107ms
90ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/section-fieldset-Cu3NA7ze.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

e0de62f40bbea1d6f71594ff7e78e8e022cf3806e0a89edca280c8cb1e49b9c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"4e9-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-b/v9xsrBMKq0gPncs7hLAw==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 1257
x-xss-protection: 0
x-kong-upstream-latency: 3
origin-agent-cluster: ?1

GET
H3 200 stack-Bajie7cf.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 1 KB
1 KB 144ms
128ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/stack-Bajie7cf.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

a5c22eece63c333b76cb9d8e07a6f7d60f9a40c8844053102288e48ae7b025a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"44a-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-H2vjs3cTSGnTAEaS2T0wZg==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 1098
x-xss-protection: 0
x-kong-upstream-latency: 5
origin-agent-cluster: ?1

GET
H3 200 progress-bar-CaONHhiL.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 2 KB
2 KB 150ms
132ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/progress-bar-CaONHhiL.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

d6bac105161fd802d619ed3a808da0574be32418650ebf515bcae32e07ec9047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"6dc-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-+HZZwzgCqxtb9icHlP4SDA==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 1756
x-xss-protection: 0
x-kong-upstream-latency: 2
origin-agent-cluster: ?1

GET
H3 200 floating-label-input-CTskmnid.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 409 B
444 B 148ms
132ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/floating-label-input-CTskmnid.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

0c21805341b014eca380642219c88f23897a45f4ed7935fdee6870e40aeb4dec

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"199-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-0F4S0mhgDujANhvFo2opEA==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 409
x-xss-protection: 0
x-kong-upstream-latency: 2
origin-agent-cluster: ?1

GET
H3 200 floating-label-styles-vi7H5Kkr.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 3 KB
3 KB 144ms
128ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/floating-label-styles-vi7H5Kkr.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

adf57410203038c8de44893d027f3cc53b3bca84015c2867d696fa216017c595

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"c51-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-72w8wYe4qBsiLitGl/2Bqw==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 3153
x-xss-protection: 0
x-kong-upstream-latency: 2
origin-agent-cluster: ?1

GET
H3 200 date-TS_ghny4.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 463 B
501 B 146ms
125ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/date-TS_ghny4.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

0ea8609a49f324dc8ecae14e529ad9e810e4929decbe2dec1f02f2c13dbca71b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"1cf-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-fDZgjGyEU5rxFaU7Lv/nZw==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 463
x-xss-protection: 0
x-kong-upstream-latency: 3
origin-agent-cluster: ?1

GET
H3 200 is-eighteen-Bn_fBOgW.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 326 B
368 B 137ms
119ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/is-eighteen-Bn_fBOgW.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

2afd4d667593efeeeb8de2d7589036373653affc814c6eab50d84de8fcba851d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"146-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-ZHhHv1seYly57I55INgSxg==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 326
x-xss-protection: 0
x-kong-upstream-latency: 4
origin-agent-cluster: ?1

GET
H3 200 format-date-DZzmujk1.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 453 B
488 B 141ms
123ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/format-date-DZzmujk1.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

74c5097278bedc8f05d0f143d0a014afeb43cd7829d6304e68f7fd43d6a506a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"1c5-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-UR4b3TpTPTGBZ6bHv0WgfQ==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 453
x-xss-protection: 0
x-kong-upstream-latency: 2
origin-agent-cluster: ?1

GET
H3 200 sms-consent-checkbox-Diiiulk6.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 970 B
1013 B 138ms
120ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/sms-consent-checkbox-Diiiulk6.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

eb58eda2924fd165ee9ba6f8623ca3c089dcbe1db9ae0c484b7581b9fcba125c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"3ca-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-l9B4RfTR27nc9NopRHWBBQ==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 970
x-xss-protection: 0
x-kong-upstream-latency: 3
origin-agent-cluster: ?1

GET
H3 200 use-heloc-modal-CiKAVqva.js Show response
heloc.westcapitallending.com/account/heloc/assets/ 404 B
445 B 144ms
125ms Script
application/javascript 34.96.110.110
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://heloc.westcapitallending.com/account/heloc/assets/use-heloc-modal-CiKAVqva.js

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.110.110 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

110.110.96.34.bc.googleusercontent.com

Software

Resource Hash

6cf89880ebca14ac4b385d1acadb90e60c638d104d53b4438ec72693d209abc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
etag: W/"194-1938ddbda40"
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-kong-proxy-latency: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 03 Dec 2024 18:50:16 GMT
vary: Origin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
cache-control: public, max-age=0
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
referrer-policy: strict-origin
content-security-policy-report-only: default-src https://cdn.plaid.com/ 'self';script-src https://cdn.plaid.com/link/v2/stable/link-initialize.js https://test.figure.com https://figure.com 'unsafe-inline' 'nonce-4Bab012eGr/ElcwVbDSKEw==' 'strict-dynamic' 'self';frame-src https://cdn.plaid.com/ 'self';connect-src https://*.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://*.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com;font-src https://cdn.figure.com https://fonts.gstatic.com 'self' https://cdn.figure.com/fonts/SharpGroteskMedium21.otf;style-src https://use.fontawesome.com https://fonts.googleapis.com 'self' 'unsafe-inline' https://cdn.figure.com https://fonts.googleapis.com/css2 https://cdn.figure.com/fonts/SharpGroteskMedium21.css;media-src https://cdn.figure.com https://www.datocms-assets.com https://www.googletagmanager.com https://cdn.talkjs.com 'self';img-src https://ad.doubleclick.net https://cdn.figure.com https://storage.googleapis.com https://www.datocms-assets.com https://www.googletagmanager.com https://www.gstatic.com 'self' data: blob:;form-action 'none';manifest-src 'self';object-src 'none';worker-src 'none';report-uri https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc;base-uri 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
x-download-options: noopen
via: kong/3.4.2, 1.1 google
accept-ranges: bytes
access-control-allow-origin: https://heloc.westcapitallending.com
content-length: 404
x-xss-protection: 0
x-kong-upstream-latency: 2
origin-agent-cluster: ?1

GET
H2 200 wTx6yitcMq.js Show response
code.upscope.io/ 1 KB
956 B 442ms
107ms Script
application/javascript 18.160.18.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://code.upscope.io/wTx6yitcMq.js
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.18.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-18-123.iad12.r.cloudfront.net
Software: /
Resource Hash: 5bb620b2d4c8e362d53d3d52c55d64f058cecdca2525458386162ce634077bc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

cache-control: max-age=60,public
content-encoding: gzip
via: 1.1 db8c74a249442b107d8358be4371339e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-cf-id: 6YnsNwCP6ijcsdAvnGgR7M2CrNR_l4ilB1FWnt12recnHcwYVgLN2A==
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-amz-cf-pop: IAD12-P4

POST
H3 200 decision Show response
www.figure.com/service-optimize/external/api/v2/ 492 B
513 B 115ms
106ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-optimize/external/api/v2/decision

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

207d49c60c75061c89729b95c0829c03daf96b600c8cf683cbb4a7f48f226427

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 26
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

OPTIONS
H3 200 decision
www.figure.com/service-optimize/external/api/v2/ 0
0 95ms
92ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-optimize/external/api/v2/decision

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

POST
H3 200 decision Show response
www.figure.com/service-optimize/external/api/v2/ 176 B
197 B 118ms
110ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-optimize/external/api/v2/decision

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

fcdd50d467f6efd3527077dff92ff0a133c4b01e766675ff88ee577f25403e0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
content-type: application/json
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 27
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
vary: Origin

OPTIONS
H3 200 decision
www.figure.com/service-optimize/external/api/v2/ 0
0 89ms
87ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-optimize/external/api/v2/decision

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:22 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

POST
H2 202 rum Show response
browser-intake-datadoghq.com/api/v2/ 53 B
112 B 125ms
89ms Fetch
application/json 3.233.158.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.11.0%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Afrontend-heloc&dd-api-key=pub12f76571c55a1c6efcc45166d57d29b6&dd-evp-origin-version=5.11.0&dd-evp-origin=browser&dd-request-id=4e0feab9-bc43-41ae-ae36-45d703d5b3d5&batch_time=1733577862902

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.158.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-158-26.compute-1.amazonaws.com

Software

Resource Hash

b7d0f8b432ff7332c4b114aaecfb0db34d067014629dfc88e7597cbb6614fe40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Sat, 07 Dec 2024 13:24:22 GMT
content-type: application/json
dd-request-id: 4e0feab9-bc43-41ae-ae36-45d703d5b3d5

OPTIONS
H3 200 2fd26606-879f-4ff6-a184-7bc407ac74ff
www.figure.com/service-lead-portal/api/lo/ 0
0 77ms
76ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-lead-portal/api/lo/2fd26606-879f-4ff6-a184-7bc407ac74ff

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 2

OPTIONS
H3 200 OPS_PHONE
www.figure.com/service-operating-hours/external/api/v1/hours/ 0
0 75ms
75ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-operating-hours/external/api/v1/hours/OPS_PHONE?display=true

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: x-org
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

OPTIONS
H3 200 states-eligibility
www.figure.com/service-application/external/api/v2/heloc/ 0
0 80ms
79ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-application/external/api/v2/heloc/states-eligibility?orgCode=WEST_CAPITAL_LENDING_INC

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

OPTIONS
H3 200 zip-eligibility
www.figure.com/service-application/external/api/v1/heloc/ 0
0 77ms
75ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-application/external/api/v1/heloc/zip-eligibility?orgCode=WEST_CAPITAL_LENDING_INC

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

OPTIONS
H3 200 all
www.figure.com/service-application/api/v1/application/heloc/ 0
0 82ms
76ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-application/api/v1/application/heloc/all

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

GET
H3 200 2fd26606-879f-4ff6-a184-7bc407ac74ff Show response
www.figure.com/service-lead-portal/api/lo/ 650 B
673 B 109ms
108ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-lead-portal/api/lo/2fd26606-879f-4ff6-a184-7bc407ac74ff

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

fa2fba122ee727714bdcdab6c4a607f531c8ab61cecbe5a234aba6322350f684

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Authorization
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
referrer-policy: no-referrer
x-content-type-options: nosniff
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 28
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 650
x-xss-protection: 1 ; mode=block
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin
x-kong-proxy-latency: 2

GET
H3 404 figureinfo Show response
www.figure.com/identity-broker/customer/secure/api/v3/self/ 43 B
60 B 76ms
76ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 5b026052f38943cc807c78c229210af8f12788185f130cc4f2cb24e67ff23f50

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
X-Auth0-Application-Name: heloc
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:23 GMT
x-kong-response-latency: 1
content-type: application/json
vary: Origin
server: kong/3.4.2

GET
H3 200 metadata Show response
www.figure.com/service-organization-metadata/external/api/v1/organizations/WEST_CAPITAL_LENDING_INC/ 2 KB
2 KB 88ms
88ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-organization-metadata/external/api/v1/organizations/WEST_CAPITAL_LENDING_INC/metadata

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

d871752bfcd63f2efb48c6347faebddb0a26bfe5ed5e7a61c36172b81d93c975

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
referrer-policy: no-referrer
x-content-type-options: nosniff
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 4
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1693
x-xss-protection: 1 ; mode=block
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin
x-kong-proxy-latency: 0

GET
H3 200 metadata Show response
www.figure.com/service-organization-metadata/external/api/v1/organizations/WEST_CAPITAL_LENDING_INC/ 2 KB
2 KB 172ms
85ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-organization-metadata/external/api/v1/organizations/WEST_CAPITAL_LENDING_INC/metadata

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

d871752bfcd63f2efb48c6347faebddb0a26bfe5ed5e7a61c36172b81d93c975

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
referrer-policy: no-referrer
x-content-type-options: nosniff
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 3
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1693
x-xss-protection: 1 ; mode=block
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin
x-kong-proxy-latency: 0

GET
H3 200 state-licenses Show response
www.figure.com/service-application/external/api/v1/heloc/ 4 KB
4 KB 81ms
80ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-application/external/api/v1/heloc/state-licenses?orgCode=WEST_CAPITAL_LENDING_INC

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

11dcb6d31365df8726af9651dba7362e41a60acd409d06fb453b4c5b5b0c90b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 2
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin

GET
H3 200 OPS_PHONE Show response
www.figure.com/service-operating-hours/external/api/v1/hours/ 1 KB
1 KB 92ms
89ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-operating-hours/external/api/v1/hours/OPS_PHONE?display=true

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

abf59526cf4578070e350f6e2c03230f2e431cec2362052077cc7e3c3538f698

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
x-org: WEST_CAPITAL_LENDING_INC
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
referrer-policy: no-referrer
x-content-type-options: nosniff
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 11
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1242
x-xss-protection: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin
x-kong-proxy-latency: 0

GET
H3 200 states-eligibility Show response
www.figure.com/service-application/external/api/v2/heloc/ 226 B
247 B 82ms
79ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-application/external/api/v2/heloc/states-eligibility?orgCode=WEST_CAPITAL_LENDING_INC

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

a48e2cbd4f21b781ea4eca020ef61c566bb717f48d50aee68730e0f37826527f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Authorization
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 2
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin

GET
H3 200 zip-eligibility Show response
www.figure.com/service-application/external/api/v1/heloc/ 2 B
22 B 92ms
89ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-application/external/api/v1/heloc/zip-eligibility?orgCode=WEST_CAPITAL_LENDING_INC

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Authorization
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 13
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 1
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin

GET
H3 401 all Show response
www.figure.com/service-application/api/v1/application/heloc/ 29 B
47 B 81ms
80ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/service-application/api/v1/application/heloc/all
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 1640fd455a67c6eab8e66e311676d6ff925ef4fd693c785373a575e53e394b09

Request headers

Authorization
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
date: Sat, 07 Dec 2024 13:24:23 GMT
x-kong-response-latency: 0
content-type: application/json; charset=utf-8
vary: Origin
server: kong/3.4.2

GET
H2 200 logo.svg
storage.googleapis.com/figure-cdn-production/apps/frontend-private-label/westcapital/ 4 KB
4 KB 638ms
135ms Image
image/svg+xml 172.253.122.207
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/figure-cdn-production/apps/frontend-private-label/westcapital/logo.svg
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.207 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f207.1e100.net
Software: UploadServer /
Resource Hash: 8dfbfa9896ee29dc45d091095009d2228b5aba92f3812520f8771e4b2eb68efd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=yzv6Qw==, md5=w0tvPo6Mv3L3a3EzXszd5w==
etag: "c34b6f3e8e8cbf72f76b71335eccdde7"
x-goog-stored-content-encoding: identity
expires: Sat, 07 Dec 2024 14:24:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 3618
date: Sat, 07 Dec 2024 13:24:23 GMT
last-modified: Fri, 06 Dec 2024 22:29:33 GMT
content-type: image/svg+xml
x-guploader-uploadid: AFiumC6ww5oChi1v0hY33ELZt_py1-nYbpdMNcWhhHUB-AyQwvxEBjRHIAM3Ug_Y0hRW0grO9Dw
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1733524173629914
content-length: 3618
server: UploadServer

GET
H3 200 licensed-states Show response
www.figure.com/service-lead-portal/api/lo/2fd26606-879f-4ff6-a184-7bc407ac74ff/ 125 B
148 B 101ms
100ms XHR
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-lead-portal/api/lo/2fd26606-879f-4ff6-a184-7bc407ac74ff/licensed-states?organization=WEST_CAPITAL_LENDING_INC

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

f9e025f78b06acec31de06a07935993fbb90f81b651f5951f7f4737794da63d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

X-With-Origin: https://heloc.westcapitallending.com
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
x-org: WEST_CAPITAL_LENDING_INC

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
referrer-policy: no-referrer
x-content-type-options: nosniff
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 15
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 125
x-xss-protection: 1 ; mode=block
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin
x-kong-proxy-latency: 2

GET
H3 200 SMS Show response
www.figure.com/service-comms-prefs/external/api/v1/consent/prompt/ 928 B
949 B 99ms
99ms XHR
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-comms-prefs/external/api/v1/consent/prompt/SMS

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

Resource Hash

9228a0f93d4f6e2c6bf7063588b8c4e6deb2399ae5dfa36c71e6d611426acf28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

X-With-Origin: https://heloc.westcapitallending.com
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
x-org: WEST_CAPITAL_LENDING_INC

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: same-origin
via: kong/3.4.2, 1.1 google
x-kong-upstream-latency: 14
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-kong-proxy-latency: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
vary: Origin

OPTIONS
H3 200 licensed-states
www.figure.com/service-lead-portal/api/lo/2fd26606-879f-4ff6-a184-7bc407ac74ff/ 0
0 75ms
74ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-lead-portal/api/lo/2fd26606-879f-4ff6-a184-7bc407ac74ff/licensed-states?organization=WEST_CAPITAL_LENDING_INC

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: x-org,x-with-origin
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

OPTIONS
H3 200 SMS
www.figure.com/service-comms-prefs/external/api/v1/consent/prompt/ 0
0 74ms
73ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-comms-prefs/external/api/v1/consent/prompt/SMS

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: x-org,x-with-origin
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:23 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 0

GET
H2 200 web Show response
edge.fullstory.com/s/settings/14DPH6/v1/ 96 KB
6 KB 84ms
83ms XHR
application/json 35.201.112.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/settings/14DPH6/v1/web
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b01f4b899a6294c71848e07c31c11cfe7bbb8434e30ef29161bbcafd950e2850

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding: gzip
x-goog-hash: crc32c=GMXI0A==, md5=8kTIaFPKYkKVphANwUlYsQ==
etag: "f244c86853ca624295a6100dc14958b1"
age: 0
x-goog-stored-content-encoding: gzip
expires: Sat, 07 Dec 2024 13:39:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 5527
date: Sat, 07 Dec 2024 13:24:23 GMT
last-modified: Sat, 07 Dec 2024 13:23:54 GMT
content-type: application/json
x-guploader-uploadid: AFiumC6YCAW-tR6ZaSZ0PZdqkQtib_CnuOlogCzbFdQcgn45wMr-CQO4yyfwpkU_mz6MqYAaXSEHbK0cCg
cache-control: public,max-age=900,no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1733562834480412
content-length: 5527
server: UploadServer

GET
H2 200 ijwRs572Xtc6ZYQws9YVwnNGfJ4.woff2
fonts.gstatic.com/s/publicsans/v18/ 26 KB
26 KB 904ms
108ms Font
font/woff2 142.251.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/publicsans/v18/ijwRs572Xtc6ZYQws9YVwnNGfJ4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Public+Sans:ital,wght@0,100..900;1,100..900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f94.1e100.net

Software

sffe /

Resource Hash

5ed4d31c988e73b258894244f209069ebe77dc7e564861954b21198b6de90d68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer: https://fonts.googleapis.com/

Response headers

age: 151283
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 05 Dec 2025 19:23:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 19:23:01 GMT
last-modified: Thu, 26 Sep 2024 23:19:20 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 26832
x-xss-protection: 0
server: sffe

GET
H2 200 LDIoaomQNQcsA88c7O9yZ4KMCoOg4Ko20yw.woff2
fonts.gstatic.com/s/plusjakartasans/v8/ 27 KB
27 KB 881ms
86ms Font
font/woff2 142.251.167.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/plusjakartasans/v8/LDIoaomQNQcsA88c7O9yZ4KMCoOg4Ko20yw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f94.1e100.net

Software

sffe /

Resource Hash

1262bff0591c36094d058ab102b84ce34eb1e547e8ff00557bf8d55449e58e40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://heloc.westcapitallending.com
Referer: https://fonts.googleapis.com/

Response headers

age: 179118
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 05 Dec 2025 11:39:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 05 Dec 2024 11:39:06 GMT
last-modified: Thu, 22 Jun 2023 14:14:33 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27444
x-xss-protection: 0
server: sffe

GET
H3 404 figureinfo Show response
www.figure.com/identity-broker/customer/secure/api/v3/self/ 43 B
60 B 79ms
76ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 6ceeca635b1595d547436c7143fc4b9b220c824d50c4cde59139b66a913a8f41

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
X-Auth0-Application-Name: heloc
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:23 GMT
x-kong-response-latency: 0
content-type: application/json
vary: Origin
server: kong/3.4.2

GET
H2 200 upscope-2024.11.13.es6.js Show response
js.upscope.io/ 152 KB
44 KB 352ms
70ms Script
text/javascript 18.67.65.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.upscope.io/upscope-2024.11.13.es6.js
Requested by: Host: code.upscope.io
URL: https://code.upscope.io/wTx6yitcMq.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.65.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-65-102.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bcd91b2a6b4ca302c8fbdac8ca55da1932fdcc218d445cbc9c6fa24394bd5200

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

cache-control: max-age=864000,public
content-encoding: gzip
etag: W/"86b7192145691c3e6076b50da7f3768e"
age: 50
via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 1nWqglPVNxBPm9hzOFxSXodsGbG-kjv26Dvq8tONT1T88rVYc7-USQ==
date: Sat, 07 Dec 2024 13:23:34 GMT
content-type: text/javascript
last-modified: Mon, 02 Dec 2024 23:11:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-P1
vary: Accept-Encoding

POST
H2 202 rum Show response
browser-intake-datadoghq.com/api/v2/ 53 B
135 B 135ms
129ms Fetch
application/json 3.233.158.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.11.0%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Afrontend-heloc&dd-api-key=pub12f76571c55a1c6efcc45166d57d29b6&dd-evp-origin-version=5.11.0&dd-evp-origin=browser&dd-request-id=c99808db-993e-4d79-9ec3-7184c4ae7ef8&batch_time=1733577863410

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.158.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-158-26.compute-1.amazonaws.com

Software

Resource Hash

dca3702815dca47c4f0a2a6af536f14234081afb44718288f5e0e944b0ffbae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json
dd-request-id: c99808db-993e-4d79-9ec3-7184c4ae7ef8

GET
H2 200 22d4d515-1ac1-404d-9cb3-6bb0653b370c_avatar.png
cdn.figure.com/apps/frontend-private-label/shared/images/avatars/ 3 KB
3 KB 160ms
158ms Image
image/png 34.98.83.188
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.figure.com/apps/frontend-private-label/shared/images/avatars/22d4d515-1ac1-404d-9cb3-6bb0653b370c_avatar.png
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.83.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 188.83.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: eb70a8a20f9127e5f97383332ce3731d17caa4147b01ce2ca35364dc9e515c31

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=dX46qg==, md5=2atHjb+sz9TvgJpxojUuLA==
etag: "d9ab478dbfaccfd4ef809a71a2352e2c"
x-goog-stored-content-encoding: identity
expires: Sat, 07 Dec 2024 14:24:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 2850
date: Sat, 07 Dec 2024 13:24:23 GMT
last-modified: Tue, 03 Dec 2024 06:44:22 GMT
content-type: image/png
x-guploader-uploadid: AFiumC7yTN9iAgI67gYaK_RBeLJ0FfEyVlbEkpJR9nSfSymBretLRU7Ydi3lGJPKHjvKJAzhQ-c
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1733208262164510
content-length: 2850
server: UploadServer

POST
H2 200 page Show response
rs.fullstory.com/rec/ 1 KB
868 B 340ms
144ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/page
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: e4051fa0da110e2742fb2aa7d97501e87f0803f8d96c85d6828f05f49a4571a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://heloc.westcapitallending.com/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 679
date: Sat, 07 Dec 2024 13:24:23 GMT
content-type: application/json; charset=utf-8

POST logs
csp-report.browser-intake-datadoghq.com/api/v2/ 0
0

GET
H2 200 integrations Show response
rs.fullstory.com/rec/ 3 KB
3 KB 74ms
72ms Script
text/javascript 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/integrations?OrgId=14DPH6&isInFrame=false&isNative=false
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: f2cd8c1f224de496524c3d6362250eae0c0b4d1d90e2f68ae1fb0ea67cf03138

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:24 GMT
content-type: text/javascript; charset=utf-8
cross-origin-resource-policy: cross-origin

GET
H3 200 base-favicon.png
cdn.figure.com/apps/frontend-private-label/westcapital/ 1 KB
1 KB 114ms
114ms Other
image/png 34.98.83.188
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.figure.com/apps/frontend-private-label/westcapital/base-favicon.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.83.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 188.83.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d83edfab52c5bff71b7b5cfc772f6884b10dda0d5d9454caf015952d519ff631

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://heloc.westcapitallending.com/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
x-goog-hash: crc32c=kW/8vw==, md5=3Redm/GxQ7byofnYoazqTw==
etag: "dd179d9bf1b143b6f2a1f9d8a1acea4f"
x-goog-stored-content-encoding: identity
expires: Sat, 07 Dec 2024 14:24:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 1467
date: Sat, 07 Dec 2024 13:24:24 GMT
last-modified: Fri, 06 Dec 2024 22:29:33 GMT
content-type: image/png
x-guploader-uploadid: AFiumC4TCQDtL1IVK3-wqJoL44O0Tb7dzZih9l2jnJYk1vFDM4dj9-hVuk3pRtzeIn-1vpXtC50
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1733524173647780
content-length: 1467
server: UploadServer

POST
H2 202 rum Show response
browser-intake-datadoghq.com/api/v2/ 53 B
136 B 81ms
77ms Fetch
application/json 3.233.158.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.11.0%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Afrontend-heloc&dd-api-key=pub12f76571c55a1c6efcc45166d57d29b6&dd-evp-origin-version=5.11.0&dd-evp-origin=browser&dd-request-id=930446e4-04b0-41b3-a7a6-c16d74c82a60&batch_time=1733577864445

Requested by

Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.158.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-158-26.compute-1.amazonaws.com

Software

Resource Hash

6b80cadfbfe41e83a182c77c04e6d6d940e90b0b2f1d15e4fd0e9afe5ea81720

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://heloc.westcapitallending.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
content-length: 53
accept-encoding: identity,gzip,x-gzip,deflate,x-deflate,zstd
date: Sat, 07 Dec 2024 13:24:24 GMT
content-type: application/json
dd-request-id: 930446e4-04b0-41b3-a7a6-c16d74c82a60

GET
H3 401 all Show response
www.figure.com/service-application/api/v1/application/heloc/ 29 B
47 B 77ms
77ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/service-application/api/v1/application/heloc/all
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 1640fd455a67c6eab8e66e311676d6ff925ef4fd693c785373a575e53e394b09

Request headers

Authorization
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
date: Sat, 07 Dec 2024 13:24:24 GMT
x-kong-response-latency: 0
content-type: application/json; charset=utf-8
vary: Origin
server: kong/3.4.2

GET
H3 404 figureinfo Show response
www.figure.com/identity-broker/customer/secure/api/v3/self/ 43 B
60 B 75ms
75ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 81348ed0e1d558906dc888bfc5b6bd2c2ca11c46b59bb84b15ec4555355f0418

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
X-Auth0-Application-Name: heloc
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:25 GMT
x-kong-response-latency: 0
content-type: application/json
vary: Origin
server: kong/3.4.2

POST
H3 200 v2 Show response
rs.fullstory.com/rec/bundle/ 29 B
43 B 309ms
108ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/bundle/v2?OrgId=14DPH6&UserId=0f2271bc-5cc1-4341-8e7f-c607b361ec57&SessionId=6adf9dcd-cf9e-4311-9b47-9f2eefd00faf&PageId=67b6fb2d-6083-4854-afb6-ca72c71b86eb&Seq=1&ClientTime=1733577866550&CompiledVersion=aa37b0048e92b9fe820404ebb566a04d7c8aba36&PageStart=1733577863960&PrevBundleTime=0&LastActivity=2375&IsNewSession=true&ContentEncoding=gzip
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 5be77c4621514827d6011048691abe0e1d0b93ffcf2332a76343632d0b19071d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://heloc.westcapitallending.com/

Response headers

via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
date: Sat, 07 Dec 2024 13:24:26 GMT
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

GET
H3 401 all Show response
www.figure.com/service-application/api/v1/application/heloc/ 29 B
47 B 74ms
74ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/service-application/api/v1/application/heloc/all
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 1640fd455a67c6eab8e66e311676d6ff925ef4fd693c785373a575e53e394b09

Request headers

Authorization
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
date: Sat, 07 Dec 2024 13:24:26 GMT
x-kong-response-latency: 0
content-type: application/json; charset=utf-8
vary: Origin
server: kong/3.4.2

GET
H3 404 figureinfo Show response
www.figure.com/identity-broker/customer/secure/api/v3/self/ 43 B
60 B 75ms
75ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 9b697e42dbacdec6596797c4045cd737d2763ef0b13232bef45bb0de140a62f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
X-Auth0-Application-Name: heloc
Referer: https://heloc.westcapitallending.com/

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 07 Dec 2024 13:24:29 GMT
x-kong-response-latency: 0
content-type: application/json
vary: Origin
server: kong/3.4.2

OPTIONS
H3 200 figureinfo
www.figure.com/identity-broker/customer/secure/api/v3/self/ 0
0 75ms
75ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: x-auth0-application-name
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:29 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

GET
H3 401 all Show response
www.figure.com/service-application/api/v1/application/heloc/ 29 B
47 B 78ms
78ms Fetch
application/json 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.figure.com/service-application/api/v1/application/heloc/all
Requested by: Host: heloc.westcapitallending.com
URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 105.235.160.34.bc.googleusercontent.com
Software: kong/3.4.2 /
Resource Hash: 1640fd455a67c6eab8e66e311676d6ff925ef4fd693c785373a575e53e394b09

Request headers

Authorization
Referer: https://heloc.westcapitallending.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

access-control-expose-headers: x-uuid,x-roles,x-groups,x-accomplishments,Authorization,Content-Type,x-with-origin,Origin,x-org,x-3pv-access-code,x-figure-auth,x-addr,x-grp,x-pub,x-eid
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
date: Sat, 07 Dec 2024 13:24:30 GMT
x-kong-response-latency: 1
content-type: application/json; charset=utf-8
vary: Origin
server: kong/3.4.2

OPTIONS
H3 200 all
www.figure.com/service-application/api/v1/application/heloc/ 0
0 74ms
73ms Preflight 34.160.235.105
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.figure.com/service-application/api/v1/application/heloc/all

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.235.105 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

105.235.160.34.bc.googleusercontent.com

Software

kong/3.4.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: GET
Origin: https://heloc.westcapitallending.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Authorization,Content-Type,name,type,x-accomplishments,x-with-origin,Origin,x-org,x-3pv-access-code,x-datadog-trace-id,x-datadog-parent-id,x-datadog-origin,x-datadog-sampling-priority,x-datadog-sampled,x-recaptcha-token,x-figure-auth,wallet-authorization,x-auth0-application-name,x-managed-user-auth0-application-name,x-managed-user-email,affiliate-org,x-wallet-address,x-member-name,x-membership
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS,TRACE,CONNECT
access-control-allow-origin: https://heloc.westcapitallending.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 07 Dec 2024 13:24:30 GMT
referrer-policy: same-origin
server: kong/3.4.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Origin
via: 1.1 google
x-content-type-options: nosniff
x-kong-response-latency: 1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: csp-report.browser-intake-datadoghq.com
URL: https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc

Domain: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PC9CF2DK

Domain: csp-report.browser-intake-datadoghq.com
URL: https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc

Domain: csp-report.browser-intake-datadoghq.com
URL: https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc

Domain: csp-report.browser-intake-datadoghq.com
URL: https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc

Domain: csp-report.browser-intake-datadoghq.com
URL: https://csp-report.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub8a555cb7c86a0dc6930b357a476d6449&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=app-name:heloc

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.westcapitallending.com/	1970-01-21 02:17:36	Name: _upscope__region Value: InVzLWVhc3Qi
.westcapitallending.com/	1970-01-21 01:32:59	Name: fs_lua Value: 1.1733577863597
.westcapitallending.com/	1970-01-21 10:18:33	Name: fs_uid Value: #14DPH6#0f2271bc-5cc1-4341-8e7f-c607b361ec57:6adf9dcd-cf9e-4311-9b47-9f2eefd00faf:1733577863597::1#/1765113865
.westcapitallending.com/	1970-01-21 02:17:36	Name: _upscope__shortId Value: IlNaU0FIVFBSSE5GODBCS05HIg==
heloc.westcapitallending.com/	1970-01-21 01:32:58	Name: _dd_s Value: rum=2&id=10e26cda-7284-4d3f-8b10-2ba75effb337&created=1733577861476&expire=1733578761476

18 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://heloc.westcapitallending.com/account/heloc/register?referrer=2fd26606-879f-4ff6-a184-7bc407ac74ff Message: The Content Security Policy directive 'upgrade-insecure-requests' is ignored when delivered in a report-only policy.
security	error	URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js(Line 307) Message: [Report Only] Refused to connect to 'https://figure.com/service-operating-hours/external/api/v1/hours/OPS_CHAT/openStatus' because it violates the following Content Security Policy directive: "connect-src https://.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com".
security	error	URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js(Line 307) Message: [Report Only] Refused to connect to 'https://figure.com/ft/external/session' because it violates the following Content Security Policy directive: "connect-src https://.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com".
security	error	URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js(Line 307) Message: [Report Only] Refused to connect to 'https://figure.com/ft/external/session' because it violates the following Content Security Policy directive: "connect-src https://.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com".
network	error	URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js(Line 307) Message: [Report Only] Refused to connect to 'https://figure.com/service-optimize/external/api/v1/features' because it violates the following Content Security Policy directive: "connect-src https://.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com".
security	error	URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js(Line 307) Message: [Report Only] Refused to connect to 'https://figure.com/service-optimize/external/api/v1/features' because it violates the following Content Security Policy directive: "connect-src https://.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com".
security	error	URL: https://heloc.westcapitallending.com/account/heloc/assets/vendor-B8vnu2Vi.js(Line 906) Message: [Report Only] Refused to connect to 'wss://chat-gateway-de-na1.niceincontact.com/?brandId=4529&channelId=chat_dc6a4023-69dc-4a84-8b79-d6c294509ae2&consumerId=&v=0' because it violates the following Content Security Policy directive: "connect-src https://.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com".
network	error	URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.figure.com/service-application/api/v1/application/heloc/all Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://js.upscope.io/upscope-2024.11.13.es6.js Message: [Report Only] Refused to connect to 'wss://data--us-east.upscope.io/session?apiKey=wTx6yitcMq&version=2024.11.13' because it violates the following Content Security Policy directive: "connect-src https://.plaid.com/ https://test.figure.com https://www.figure.com https://api.trustpilot.com https://.fullstory.com 'self' https://browser-intake-datadoghq.com https://api.rollbar.com/api/1/item/ https://cdn.figure.com https://fonts.googleapis.com https://fonts.gstatic.com".
network	error	URL: https://www.figure.com/service-application/api/v1/application/heloc/all Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.figure.com/service-application/api/v1/application/heloc/all Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://www.figure.com/identity-broker/customer/secure/api/v3/self/figureinfo Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.figure.com/service-application/api/v1/application/heloc/all Message: Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

browser-intake-datadoghq.com
cdn.figure.com
cdn.plaid.com
cdn.talkjs.com
code.upscope.io
csp-report.browser-intake-datadoghq.com
edge.fullstory.com
figure.com
fonts.googleapis.com
fonts.gstatic.com
heloc.westcapitallending.com
js.upscope.io
rs.fullstory.com
storage.googleapis.com
westcapheloc.com
www.figure.com
www.googletagmanager.com
csp-report.browser-intake-datadoghq.com
www.googletagmanager.com
142.251.167.94
15.197.225.128
172.253.122.207
172.253.63.95
172.67.12.227
18.160.18.123
18.67.65.102
3.171.85.95
3.233.158.26
34.160.235.105
34.96.110.110
34.98.83.188
35.186.194.58
35.201.112.186
094255ac57289c188e73af016581729d290bc9b7de3ee162f88610b7d09d9695
0c21805341b014eca380642219c88f23897a45f4ed7935fdee6870e40aeb4dec
0ea8609a49f324dc8ecae14e529ad9e810e4929decbe2dec1f02f2c13dbca71b
11dcb6d31365df8726af9651dba7362e41a60acd409d06fb453b4c5b5b0c90b0
1262bff0591c36094d058ab102b84ce34eb1e547e8ff00557bf8d55449e58e40
130ae159fc42fedaa90c9c50f9f6163f2774ac0c984f8b0f13787c87c84db498
1640fd455a67c6eab8e66e311676d6ff925ef4fd693c785373a575e53e394b09
207d49c60c75061c89729b95c0829c03daf96b600c8cf683cbb4a7f48f226427
2afd4d667593efeeeb8de2d7589036373653affc814c6eab50d84de8fcba851d
2e5c86b35b2d4629d036b71f6bd5cc5ededb660a8afd42856064d47e82eeef19
35aaaafa3378cf4ee387a9a8179ee2de66f1be28827ef938819c9bda9303d1ec
36e741500aa8fa3529df2fe924d778f4678ffa00f858124de6c05a1b967e85c7
3f1ffb67ef889511c1e04faea88dd21a9f9a9b3e3f77ca62ebb09d77a68cfe4e
3f6fe4e936de332aea22d2b6e44538ce8e99af9ea7f120799fe4f0c66984aa88
44ce8e208b4ec6dd5fc4639d4df94b720f4dc2f7d6fb512d0b9c2d236b6384ce
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
500261b0e3c56adf7f6ad85b47948b3063da2f237ffbb072a04e107732a12c53
50a54babd6925c032ba35886887123edd09916dc3bc17e8e6f6759bf31cdfafa
5ab2392baa94a81d11bbf695e6be528a25eef7b98e71fe57a090eb034e7b6498
5b026052f38943cc807c78c229210af8f12788185f130cc4f2cb24e67ff23f50
5bb620b2d4c8e362d53d3d52c55d64f058cecdca2525458386162ce634077bc4
5be77c4621514827d6011048691abe0e1d0b93ffcf2332a76343632d0b19071d
5deeee29d6ebe9a8c0048949aed8b997c860fc32a4e6d7983eea613dcb93b9db
5ec00663f747b3e2e32b5a3c356139f364b919fc518663e09b97d55c8cc1f738
5ed4d31c988e73b258894244f209069ebe77dc7e564861954b21198b6de90d68
65b07b75376250beec7cb8703fe4de9e0f3b22e062b3dc7d60a2f64132424791
6b80cadfbfe41e83a182c77c04e6d6d940e90b0b2f1d15e4fd0e9afe5ea81720
6ceeca635b1595d547436c7143fc4b9b220c824d50c4cde59139b66a913a8f41
6cf89880ebca14ac4b385d1acadb90e60c638d104d53b4438ec72693d209abc0
74c5097278bedc8f05d0f143d0a014afeb43cd7829d6304e68f7fd43d6a506a9
7522d4a4fca21ce5dfc1ff310be24f8ceebe101b122262c3fb8b2630fd9cc194
81348ed0e1d558906dc888bfc5b6bd2c2ca11c46b59bb84b15ec4555355f0418
87baf4a2c13e737b00120eb475e458e67404d3835ff05047068ac3ade22713d3
8993db6854e432873a3f914db49d4a2684c7b13e14b28f89062d1ed62ed36e1d
8c7f3efecf86f0e2399abd397028b60830cd5ec67129688eb02e841aced14f47
8c86862a8e57eaded631d5824ea45178d65ec09780ebca58a9f6bca21e32ad57
8dfbfa9896ee29dc45d091095009d2228b5aba92f3812520f8771e4b2eb68efd
8ee3657560b1a271d276a415951fe1e5451e258da97a10c639e6b9aba2f28e1b
9228a0f93d4f6e2c6bf7063588b8c4e6deb2399ae5dfa36c71e6d611426acf28
9b697e42dbacdec6596797c4045cd737d2763ef0b13232bef45bb0de140a62f4
a48e2cbd4f21b781ea4eca020ef61c566bb717f48d50aee68730e0f37826527f
a5c22eece63c333b76cb9d8e07a6f7d60f9a40c8844053102288e48ae7b025a9
aaaa3328b168b7c0abdec5bcfdc55123194f816dd40ba3cbe139d7940aa0c6a3
abf59526cf4578070e350f6e2c03230f2e431cec2362052077cc7e3c3538f698
adf57410203038c8de44893d027f3cc53b3bca84015c2867d696fa216017c595
b01f4b899a6294c71848e07c31c11cfe7bbb8434e30ef29161bbcafd950e2850
b72a5bb670565127b87da6efaf436780e42c726c6630ff270831e0098eacd5ec
b7d0f8b432ff7332c4b114aaecfb0db34d067014629dfc88e7597cbb6614fe40
bcd91b2a6b4ca302c8fbdac8ca55da1932fdcc218d445cbc9c6fa24394bd5200
c8916d68ffc33236e339208c3fd32dff34ff057b6fa5c36f3b67f94564a953b7
c9613edf945298c94c54051577badfd41a4d656cebcfab79967ce062e26c6fd6
cad989f414d70a75733b2ac32369225f3d0cb679ffa5047037c9aef40de563df
cfde7d9f3f077ad894fac5ab368a2069ab1666f5b594e59f77c0913ffbe33743
d6bac105161fd802d619ed3a808da0574be32418650ebf515bcae32e07ec9047
d83edfab52c5bff71b7b5cfc772f6884b10dda0d5d9454caf015952d519ff631
d871752bfcd63f2efb48c6347faebddb0a26bfe5ed5e7a61c36172b81d93c975
db388884b2daa2f0c572a951912da8d0446d7e3257ea45fbc4ea70126703cfd9
dca3702815dca47c4f0a2a6af536f14234081afb44718288f5e0e944b0ffbae1
dcabb60354dc06c348aef3c95341cb6f95a2a738e66b01dbcd666beb111d9820
df3faf441d897eac53440dab0836d773ccbc823aaace8c068923839358b5cccc
e0de62f40bbea1d6f71594ff7e78e8e022cf3806e0a89edca280c8cb1e49b9c3
e4051fa0da110e2742fb2aa7d97501e87f0803f8d96c85d6828f05f49a4571a8
eb58eda2924fd165ee9ba6f8623ca3c089dcbe1db9ae0c484b7581b9fcba125c
eb70a8a20f9127e5f97383332ce3731d17caa4147b01ce2ca35364dc9e515c31
ed1be05d0ad7b70d2e5540cd17fbe452a6796dee1488bdd2cd05b37f79ade99f
f168316778f97e31e7ed1b99344eb68fc1c1117d66b2de16d7949d3836f54c3c
f2cd8c1f224de496524c3d6362250eae0c0b4d1d90e2f68ae1fb0ea67cf03138
f39b8368d883d351157f527bc6ce0f505177383e886d2a48b4098ffabb8ac1b5
f39f1a273c067f73565b6b83532ff90e7c1e7cd16f9ed1542d6211398699f4bf
f9e025f78b06acec31de06a07935993fbb90f81b651f5951f7f4737794da63d9
fa2fba122ee727714bdcdab6c4a607f531c8ab61cecbe5a234aba6322350f684
fb6a90533bb1039d96d3b025b8c1d3a727f931d7e038d986ac5408e8753fd27c
fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
fcdd50d467f6efd3527077dff92ff0a133c4b01e766675ff88ee577f25403e0d

heloc.westcapitallending.com Open in urlscan Pro 34.96.110.110 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

107 Requests

94 %HTTPS

0 %IPv6

11 Domains

17 Subdomains

14 IPs

1 Countries

7179 kBTransfer

8018 kBSize

5 Cookies

4 Outgoing links

Page URL History

Redirected requests

107 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

heloc.westcapitallending.com Open in urlscan Pro
34.96.110.110 Public Scan

Screenshot
Live screenshot

Full Image

107
Requests

94 %
HTTPS

0 %
IPv6

11
Domains

17
Subdomains

14
IPs

1
Countries

7179 kB
Transfer

8018 kB
Size

5
Cookies

107 HTTP transactions
0 data transactions