refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::ac40:9bdf Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/5849cwe5
Effective URL:
https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&...
Submission: On August 03 via manual (August 3rd 2023, 9:57:21 pm UTC) from PL — Scanned from US

Summary HTTP 106 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 37 IPs in 2 countries across 41 domains to perform 106 HTTP transactions. The main IP is 2606:4700:4400::ac40:9bdf, located in United States and belongs to CLOUDFLARENET, US. The main domain is refinance.quickenloans.com. The Cisco Umbrella rank of the primary domain is 852431.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on December 20th 2022. Valid for: a year.

This is the only time refinance.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::ac43:1e1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	23.192.50.210 23.192.50.210	16625 (AKAMAI-AS) (AKAMAI-AS)
1	199.188.200.56 199.188.200.56	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 1	44.239.163.116 44.239.163.116	16509 (AMAZON-02) (AMAZON-02)
1 1	44.227.143.1 44.227.143.1	16509 (AMAZON-02) (AMAZON-02)
1 2	35.201.76.131 35.201.76.131	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	2606:4700:303... 2606:4700:3036::ac43:b54c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2606:4700:440... 2606:4700:4400::ac40:9bdf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.32.151.107 13.32.151.107	16509 (AMAZON-02) (AMAZON-02)
1	3.18.206.181 3.18.206.181	16509 (AMAZON-02) (AMAZON-02)
4	2600:1418:a00... 2600:1418:a000:49d::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	99.84.208.86 99.84.208.86	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:402... 2607:f8b0:4020:807::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:3865	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 6	52.22.148.156 52.22.148.156	14618 (AMAZON-AES) (AMAZON-AES)
1	13.32.195.219 13.32.195.219	16509 (AMAZON-02) (AMAZON-02)
17	2607:f8b0:402... 2607:f8b0:4020:804::2008	15169 (GOOGLE) (GOOGLE)
4 9	54.235.130.106 54.235.130.106	14618 (AMAZON-AES) (AMAZON-AES)
1 3	52.46.130.91 52.46.130.91	16509 (AMAZON-02) (AMAZON-02)
1 3	172.217.13.130 172.217.13.130	15169 (GOOGLE) (GOOGLE)
3 3	2607:f8b0:402... 2607:f8b0:4020:806::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:402... 2607:f8b0:4020:805::2004	15169 (GOOGLE) (GOOGLE)
1	54.204.58.171 54.204.58.171	14618 (AMAZON-AES) (AMAZON-AES)
2	63.140.38.219 63.140.38.219	14618 (AMAZON-AES) (AMAZON-AES)
5 5	3.223.10.198 3.223.10.198	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.38.128 63.140.38.128	14618 (AMAZON-AES) (AMAZON-AES)
2	2607:f8b0:402... 2607:f8b0:4020:804::2003	15169 (GOOGLE) (GOOGLE)
2	3.216.213.80 3.216.213.80	14618 (AMAZON-AES) (AMAZON-AES)
2	2607:f8b0:402... 2607:f8b0:4020:807::200e	15169 (GOOGLE) (GOOGLE)
1 1	18.165.98.105 18.165.98.105	16509 (AMAZON-02) (AMAZON-02)
4 4	172.217.13.166 172.217.13.166	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:402... 2607:f8b0:4020:807::2002	() ()
5 5	172.217.13.98 172.217.13.98	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::15	15169 (GOOGLE) (GOOGLE)
1	99.84.108.70 99.84.108.70	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:77::84 2a04:4e42:77::84	() ()
1	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	() ()
1	135.148.151.160 135.148.151.160	() ()
1	2600:9000:250... 2600:9000:2509:b800:8:8845:1500:93a1	() ()
1	151.101.193.44 151.101.193.44	() ()
1	2606:4700:440... 2606:4700:4400::6812:2345	() ()
2	2001:4998:14:... 2001:4998:14:800::1000	() ()
1	2a04:4e42:200... 2a04:4e42:200::396	() ()
1	18.160.10.241 18.160.10.241	() ()
1	23.52.161.201 23.52.161.201	() ()
1	151.101.193.140 151.101.193.140	() ()
106	37

1 2606:4700:10::ac43:1e1 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.192.50.210 (Secaucus, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-192-50-210.deploy.static.akamaitechnologies.com

gmail.us10.list-manage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.188.200.56 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server242-1.web-hosting.com

dsa.bio	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.239.163.116 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-44-239-163-116.us-west-2.compute.amazonaws.com

trking2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.227.143.1 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-44-227-143-1.us-west-2.compute.amazonaws.com

suited45trk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.76.131 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com

www.lmbahsj2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:b54c (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

refinance.quikcenioans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:4700:4400::ac40:9bdf (United States)

ASN13335 (CLOUDFLARENET, US)

refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static-msql-prod.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trackpixel.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
content.refinance.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.151.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-151-107.iad66.r.cloudfront.net

widget.trustpilot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.18.206.181 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-18-206-181.us-east-2.compute.amazonaws.com

cs-cdn.deviceatlas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:1418:a000:49d::1e80 (Eden Prairie, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.84.208.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-208-86.iad79.r.cloudfront.net

api.pushnami.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4020:807::200a (Montreal, Canada)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.22.148.156 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-148-156.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.195.219 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-195-219.iad66.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2607:f8b0:4020:804::2008 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 54.235.130.106 (Ashburn, United States) 4 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-235-130-106.compute-1.amazonaws.com

pixel1083.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.46.130.91 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.13.130 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: yul02s05-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4020:806::2002 (Montreal, Canada) 3 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4020:805::2004 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.204.58.171 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-58-171.compute-1.amazonaws.com

quicken.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.38.219 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-219.data.adobedc.net

somni.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.223.10.198 (Ashburn, United States) 5 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-10-198.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.38.128 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-128.data.adobedc.net

quickenloans.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4020:804::2003 (Montreal, Canada)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.216.213.80 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-216-213-80.compute-1.amazonaws.com

script.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4020:807::200e (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.165.98.105 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-165-98-105.iad55.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.13.166 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4020:807::2002 (None, )

ASN- ()

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.217.13.98 (United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: yul02s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::15 (United States)

ASN15169 (GOOGLE, US)

sgtm.lowermybills.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.108.70 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-108-70.iad79.r.cloudfront.net

ads.anura.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:77::84 (None, )

ASN- ()

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f012:10c:face:b00c:0:3 (None, )

ASN- ()

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 135.148.151.160 (None, )

ASN- ()

ads.revjet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2509:b800:8:8845:1500:93a1 (None, )

ASN- ()

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.44 (None, )

ASN- ()

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2345 (None, )

ASN- ()

cdn.mortgage.quickenloans.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4998:14:800::1000 (None, )

ASN- ()

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::396 (None, )

ASN- ()

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.160.10.241 (None, )

ASN- ()

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.52.161.201 (None, )

ASN- ()

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (None, )

ASN- ()

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 73	1 MB
17	quickenloans.com refinance.quickenloans.com — Cisco Umbrella Rank: 852431 static-msql-prod.refinance.quickenloans.com trackpixel.refinance.quickenloans.com somni.quickenloans.com — Cisco Umbrella Rank: 246062 content.refinance.quickenloans.com cdn.mortgage.quickenloans.com	314 KB
14	everesttech.net 9 redirects pixel1083.everesttech.net — Cisco Umbrella Rank: 737017 cm.everesttech.net — Cisco Umbrella Rank: 1085 pixel.everesttech.net — Cisco Umbrella Rank: 4577	7 KB
12	doubleclick.net 12 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 55 ad.doubleclick.net — Cisco Umbrella Rank: 183 cm.g.doubleclick.net — Cisco Umbrella Rank: 239	5 KB
7	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 216 quicken.demdex.net — Cisco Umbrella Rank: 73849	11 KB
5	google.com www.google.com — Cisco Umbrella Rank: 3 adservice.google.com	1 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 79	3 KB
4	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 428	112 KB
3	anura.io script.anura.io — Cisco Umbrella Rank: 55633 ads.anura.io — Cisco Umbrella Rank: 72861	21 KB
3	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 163	20 KB
3	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 319	3 KB
2	yimg.com s.yimg.com	13 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 58	21 KB
2	gstatic.com fonts.gstatic.com	46 KB
2	pushnami.com api.pushnami.com — Cisco Umbrella Rank: 5508 psp.pushnami.com Failed	20 KB
2	lmbahsj2.com 1 redirects www.lmbahsj2.com — Cisco Umbrella Rank: 728299	19 KB
1	reddit.com alb.reddit.com	637 B
1	mathtag.com pixel.mathtag.com	6 KB
1	sc-static.net sc-static.net	16 KB
1	redditstatic.com www.redditstatic.com	8 KB
1	taboola.com cdn.taboola.com	18 KB
1	liadm.com b-code.liadm.com	15 KB
1	revjet.com ads.revjet.com	8 KB
1	facebook.net connect.facebook.net	47 KB
1	pinimg.com s.pinimg.com	2 KB
1	lowermybills.com sgtm.lowermybills.com	534 B
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 537	632 B
1	omtrdc.net quickenloans.tt.omtrdc.net — Cisco Umbrella Rank: 141379	853 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1838	37 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1186	7 KB
1	deviceatlas.com cs-cdn.deviceatlas.com — Cisco Umbrella Rank: 136102	22 KB
1	trustpilot.com widget.trustpilot.com — Cisco Umbrella Rank: 5384	7 KB
1	quikcenioans.com 1 redirects refinance.quikcenioans.com	694 B
1	suited45trk.com 1 redirects suited45trk.com — Cisco Umbrella Rank: 332892	793 B
1	trking2.com 1 redirects trking2.com	273 B
1	dsa.bio dsa.bio	358 B
1	list-manage.com 1 redirects gmail.us10.list-manage.com — Cisco Umbrella Rank: 735552	2 KB
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 16870	573 B
0	lockerdomecdn.com Failed cdn1.lockerdomecdn.com Failed
0	pmsrv.co Failed c.pmsrv.co Failed
0	decide.dev Failed cdn1.decide.dev Failed
106	41

	Domain	Requested by
17	www.googletagmanager.com	refinance.quickenloans.com assets.adobedtm.com www.googletagmanager.com trackpixel.refinance.quickenloans.com
8	pixel.everesttech.net	4 redirects
6	dpm.demdex.net	1 redirects refinance.quickenloans.com www.datadoghq-browser-agent.com
5	cm.g.doubleclick.net	5 redirects
5	content.refinance.quickenloans.com	refinance.quickenloans.com static-msql-prod.refinance.quickenloans.com
5	cm.everesttech.net	5 redirects
5	refinance.quickenloans.com	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
4	ad.doubleclick.net	4 redirects
4	fonts.googleapis.com	static-msql-prod.refinance.quickenloans.com
4	assets.adobedtm.com	refinance.quickenloans.com assets.adobedtm.com
3	www.google.com	refinance.quickenloans.com
3	googleads.g.doubleclick.net	3 redirects www.googletagmanager.com
3	www.googleadservices.com	1 redirects www.googletagmanager.com trackpixel.refinance.quickenloans.com
3	s.amazon-adsystem.com	1 redirects refinance.quickenloans.com
2	s.yimg.com	dsa.bio
2	adservice.google.com	refinance.quickenloans.com
2	www.google-analytics.com	www.googletagmanager.com www.datadoghq-browser-agent.com
2	script.anura.io	static-msql-prod.refinance.quickenloans.com www.datadoghq-browser-agent.com
2	fonts.gstatic.com	fonts.googleapis.com
2	somni.quickenloans.com	www.datadoghq-browser-agent.com
2	api.pushnami.com	refinance.quickenloans.com api.pushnami.com
2	trackpixel.refinance.quickenloans.com	refinance.quickenloans.com trackpixel.refinance.quickenloans.com
2	static-msql-prod.refinance.quickenloans.com	refinance.quickenloans.com
2	www.lmbahsj2.com	1 redirects trackpixel.refinance.quickenloans.com
1	alb.reddit.com
1	pixel.mathtag.com	trackpixel.refinance.quickenloans.com
1	sc-static.net	dsa.bio
1	www.redditstatic.com	dsa.bio
1	cdn.mortgage.quickenloans.com	trackpixel.refinance.quickenloans.com
1	cdn.taboola.com	dsa.bio
1	b-code.liadm.com	trackpixel.refinance.quickenloans.com
1	ads.revjet.com	dsa.bio
1	connect.facebook.net	dsa.bio
1	s.pinimg.com	dsa.bio
1	ads.anura.io	www.datadoghq-browser-agent.com
1	sgtm.lowermybills.com	www.datadoghq-browser-agent.com
1	aa.agkn.com	1 redirects
1	quickenloans.tt.omtrdc.net	www.datadoghq-browser-agent.com
1	quicken.demdex.net	assets.adobedtm.com
1	pixel1083.everesttech.net	refinance.quickenloans.com
1	www.datadoghq-browser-agent.com	refinance.quickenloans.com
1	static.cloudflareinsights.com	refinance.quickenloans.com
1	cs-cdn.deviceatlas.com	refinance.quickenloans.com
1	widget.trustpilot.com	refinance.quickenloans.com
1	refinance.quikcenioans.com	1 redirects
1	suited45trk.com	1 redirects
1	trking2.com	1 redirects
1	dsa.bio
1	gmail.us10.list-manage.com	1 redirects
1	tinyurl.com	1 redirects
0	psp.pushnami.com Failed	www.datadoghq-browser-agent.com
0	cdn1.lockerdomecdn.com Failed	trackpixel.refinance.quickenloans.com
0	c.pmsrv.co Failed	trackpixel.refinance.quickenloans.com
0	cdn1.decide.dev Failed	trackpixel.refinance.quickenloans.com
106	54

This site contains links to these domains. Also see Links.

Domain
www.lowermybills.com
privacyportal-cdn.onetrust.com
www.fhfa.gov
capitalmarkets.fanniemae.com
www.nmlsconsumeraccess.org
www.rocketmortgage.com
www.remodelingcalculator.org
www.nytimes.com
www.lendingtree.com
marketing.lowermybills.com

Subject Issuer	Validity	Valid
dsa.bio Sectigo RSA Domain Validation Secure Server CA	`2023-03-22` - `2024-03-22`	a year	crt.sh
refinance.quickenloans.com Cloudflare Inc ECC CA-3	`2022-12-20` - `2023-12-20`	a year	crt.sh
*.trustpilot.com Amazon RSA 2048 M02	`2023-02-02` - `2024-03-02`	a year	crt.sh
*.deviceatlas.com Go Daddy Secure Certificate Authority - G2	`2023-03-04` - `2024-04-04`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
*.pushnami.com Amazon RSA 2048 M01	`2023-03-04` - `2024-04-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-14` - `2024-01-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.tmogul.com Amazon RSA 2048 M01	`2023-05-16` - `2024-06-13`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
somni.quickenloans.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-14` - `2024-04-13`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
script.anura.io Amazon RSA 2048 M01	`2023-04-24` - `2024-05-21`	a year	crt.sh
sgtm.lowermybills.com GTS CA 1D4	`2023-07-05` - `2023-10-03`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
ads.anura.io Amazon RSA 2048 M01	`2023-05-30` - `2024-06-27`	a year	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-31` - `2024-08-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-05-13` - `2023-08-11`	3 months	crt.sh
*.revjet.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-04-11`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M02	`2023-02-28` - `2024-01-30`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2022-12-08` - `2023-12-31`	a year	crt.sh
mortgage.quickenloans.com Cloudflare Inc ECC CA-3	`2022-11-10` - `2023-11-10`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-07-03` - `2023-08-23`	2 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-12` - `2023-10-08`	6 months	crt.sh
sc-static.net Amazon RSA 2048 M02	`2023-01-20` - `2024-02-18`	a year	crt.sh
pixel.mathtag.com DigiCert TLS RSA SHA256 2020 CA1	`2023-05-07` - `2024-05-07`	a year	crt.sh
lmbahsj2.com Starfield Secure Certificate Authority - G2	`2023-04-28` - `2024-05-13`	a year	crt.sh
s.amazon-adsystem.com Amazon RSA 2048 M01	`2023-03-03` - `2024-02-19`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-19` - `2023-10-15`	6 months	crt.sh

This page contains 4 frames:

Primary Page: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
Frame ID: 9E6BCC2272B370E4F24137563D990574
Requests: 80 HTTP requests in this frame

Frame: https://quicken.demdex.net/dest5.html?d_nsid=0
Frame ID: 7A1A5703944CDDEC7B958D05B183C5BA
Requests: 11 HTTP requests in this frame

Frame: https://s.pinimg.com/ct/core.js
Frame ID: 61D45A795CE6C2FF38DC2C09F0DBDEA4
Requests: 13 HTTP requests in this frame

Frame: https://api.pushnami.com/scripts/v1/hub
Frame ID: BF505E0F18782CB55B1ACB77A22D3DD0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Refinance Mortgage, Refinancing Rates, Mortgage Rates

Page URL History Show full URLs

https://tinyurl.com/5849cwe5 HTTP 301
https://gmail.us10.list-manage.com/track/click?u=02bfa2749aa0281afbfa2adfb&id=f86c2ee6ae&e=6fec864243 HTTP 302
https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_... Page URL
https://trking2.com/?f5c=UDaX%2bSIFps0UeFuYfzI7YIGv1HWZG%2fpN&s1=mc1 HTTP 302
https://suited45trk.com/?f5c=UDaX%2bSIFps0UeFuYfzI7YIGv1HWZG%2fpN&s1=mc1&ckmguid=15888630-6b14-46bc-... HTTP 302
https://www.lmbahsj2.com/5MX46D/FGXLG/?sub1=515&sub2=500251123 HTTP 302
https://refinance.quikcenioans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-548... HTTP 302
https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-548... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Pushnami (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

api\.pushnami\.com

Page Statistics

106
Requests

72 %
HTTPS

41 %
IPv6

41
Domains

54
Subdomains

37
IPs

2
Countries

1947 kB
Transfer

5530 kB
Size

37
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.lowermybills.com/legal/stateprivacy/
Title: Information that we collect and share about you

Search URL Search Domain Scan URL

URL: https://privacyportal-cdn.onetrust.com/dsarwebform/37cf9a71-5b40-4cf5-a30e-8beabeed8379/c3baaee8-0b37-4f2b-bf4c-76b0e035482e.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

URL: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx
Title: https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Eliminates-Adverse-Market-Refinance-Fee.aspx

Search URL Search Domain Scan URL

URL: https://capitalmarkets.fanniemae.com/media/20371/display
Title: https://capitalmarkets.fanniemae.com/media/20371/display

Search URL Search Domain Scan URL

URL: https://www.nmlsconsumeraccess.org/
Title: www.NMLSConsumerAccess.org

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/email-policy
Title: E-Mail Policy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/security-privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/disclosures-licenses
Title: Disclosures and Licenses

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/legal/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.rocketmortgage.com/opt-out?show=email
Title: Communication Opt-Out

Search URL Search Domain Scan URL

URL: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/
Title: https://www.remodelingcalculator.org/kitchen-remodeling-calculator/

Search URL Search Domain Scan URL

URL: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates
Title: https://www.nytimes.com/live/2022/03/16/business/fed-meeting-interest-rates

Search URL Search Domain Scan URL

URL: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/
Title: https://www.lendingtree.com/home/mortgage/home-equity-loans-study/

Search URL Search Domain Scan URL

URL: https://www.lowermybills.com/legal/terms/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.lowermybills.com/legal/privacy/
Title: Our Privacy

Search URL Search Domain Scan URL

URL: https://www.lowermybills.com/legal/licenses/
Title: Licenses & Disclosures

Search URL Search Domain Scan URL

URL: https://www.lowermybills.com/legal/ad-targeting/
Title: Ad Targeting Policy

Search URL Search Domain Scan URL

URL: https://marketing.lowermybills.com/api/marketing/redirect?uid=214966&prd=MS
Title: Go To LowerMyBills

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/5849cwe5 HTTP 301
https://gmail.us10.list-manage.com/track/click?u=02bfa2749aa0281afbfa2adfb&id=f86c2ee6ae&e=6fec864243 HTTP 302
https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D Page URL
https://trking2.com/?f5c=UDaX%2bSIFps0UeFuYfzI7YIGv1HWZG%2fpN&s1=mc1 HTTP 302
https://suited45trk.com/?f5c=UDaX%2bSIFps0UeFuYfzI7YIGv1HWZG%2fpN&s1=mc1&ckmguid=15888630-6b14-46bc-a43d-2b6be4054460 HTTP 302
https://www.lmbahsj2.com/5MX46D/FGXLG/?sub1=515&sub2=500251123 HTTP 302
https://refinance.quikcenioans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035 HTTP 302
https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tinyurl.com/5849cwe5 HTTP 301
https://gmail.us10.list-manage.com/track/click?u=02bfa2749aa0281afbfa2adfb&id=f86c2ee6ae&e=6fec864243 HTTP 302
https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D

Request Chain 14

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1691099839906 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1691099839906

Request Chain 22

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894 HTTP 302
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Request Chain 23

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=wCLMZPCECoOYNcKAk_gB&random=1764183109&sscte=1&crd=&pscrd=IhMI8OSC6r3BgAMVA0wNCh1CwAQf HTTP 302
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1764183109&sscte=1&crd=&pscrd=IhMI8OSC6r3BgAMVA0wNCh1CwAQf&is_vtc=1&ocp_id=wCLMZPCECoOYNcKAk_gB&random=3686970850

Request Chain 27

https://cm.everesttech.net/cm/dd?d_uuid=25604498747523259433125248355605689836 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZMwiwAAAAFCRpQNw

Request Chain 45

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=25604498747523259433125248355605689836 HTTP 302
https://dpm.demdex.net/ibs:dpid=21&dpuuid=213900604597015531317

Request Chain 46

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=260894560.1691099841;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CLCqo-q9wYADFcUJaAgd6dMAZg;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=260894560.1691099841;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CLCqo-q9wYADFcUJaAgd6dMAZg;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035

Request Chain 48

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjU2MDQ0OTg3NDc1MjMyNTk0MzMxMjUyNDgzNTU2MDU2ODk4MzY= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKGSAd2iKfzv9HttmIqMAxQ&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 49

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=260894560.1691099841;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CPSxo-q9wYADFc1cDQodAU8JkA;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=260894560.1691099841;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035 HTTP 302
https://adservice.google.com/ddm/fls/z/dc_pre=CPSxo-q9wYADFc1cDQodAU8JkA;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035

Request Chain 54

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESECQzAwg6sLBJa0KXFY-9lpo&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 55

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935 HTTP 302
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=813794451

Request Chain 56

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=1790070191&cv=11&fst=1691099840656&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=wCLMZNO6KteZoPMPsK2o-AQ&sscte=1&crd=&pscrd=Ek5DaEVJOEtDdHBnWVExLXZSemNlUnhPT25BUklsQUVDZGVxd3ZCSGJPdDFXNFpOa3ZXRFI3ei1fc1lfbHE5Q1U0UEpaRjZqYWd3YUtJMVEaWENoRUk4S0N0cGdZUWdaWHc1Y3lVcFl6UUFSSXRBTlRsX2ZkVVM4SkF5TU9IX1pWa1Uwb2xfQU92SGJkOXkxdV9zSG5GOGg0YVFFb0xEb1NYQ3pfV3NfaHIiEwjTmqPqvcGAAxXXDGgIHbAWCk8 HTTP 302
https://www.google.com/pagead/1p-conversion/1062919768/?random=1790070191&cv=11&fst=1691099840656&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOEtDdHBnWVExLXZSemNlUnhPT25BUklsQUVDZGVxd3ZCSGJPdDFXNFpOa3ZXRFI3ei1fc1lfbHE5Q1U0UEpaRjZqYWd3YUtJMVEaWENoRUk4S0N0cGdZUWdaWHc1Y3lVcFl6UUFSSXRBTlRsX2ZkVVM4SkF5TU9IX1pWa1Uwb2xfQU92SGJkOXkxdV9zSG5GOGg0YVFFb0xEb1NYQ3pfV3NfaHIiEwjTmqPqvcGAAxXXDGgIHbAWCk8&is_vtc=1&ocp_id=wCLMZNO6KteZoPMPsK2o-AQ&cid=CAQSKQBpAlJW_gzEV78aHhnATOP5Y0TEVEFfS1MIfQB2cZgjhJHm7s5SG5yR&random=815613616

Request Chain 57

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESECQzAwg6sLBJa0KXFY-9lpo&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 58

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESECQzAwg6sLBJa0KXFY-9lpo&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 89

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESECQzAwg6sLBJa0KXFY-9lpo&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 91

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESECQzAwg6sLBJa0KXFY-9lpo&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 92

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__

106 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
dsa.bio/aa/
Redirect Chain

https://tinyurl.com/5849cwe5
https://gmail.us10.list-manage.com/track/click?u=02bfa2749aa0281afbfa2adfb&id=f86c2ee6ae&e=6fec864243
https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D

212 B
358 B

288ms
90ms

Document
text/html

199.188.200.56
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 199.188.200.56 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server242-1.web-hosting.com
Software: LiteSpeed /
Resource Hash: a8a370038413886d430ec5ec0a54b6db03ada51ee7b4679fca41efa3d42c612d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
content-length: 212
content-type: text/html
date: Thu, 03 Aug 2023 21:57:17 GMT
last-modified: Thu, 03 Aug 2023 12:31:25 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed

Redirect headers

content-encoding: gzip
content-length: 20
content-type: text/html; charset=UTF-8
date: Thu, 03 Aug 2023 21:57:16 GMT
location: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D
referrer-policy: same-origin
server: openresty
vary: Accept-Encoding
x-ua-compatible: IE=edge,chrome=1

GET
H2

200

Primary Request / Show response
refinance.quickenloans.com/
Redirect Chain

https://trking2.com/?f5c=UDaX%2bSIFps0UeFuYfzI7YIGv1HWZG%2fpN&s1=mc1
https://suited45trk.com/?f5c=UDaX%2bSIFps0UeFuYfzI7YIGv1HWZG%2fpN&s1=mc1&ckmguid=15888630-6b14-46bc-a43d-2b6be4054460
https://www.lmbahsj2.com/5MX46D/FGXLG/?sub1=515&sub2=500251123
https://refinance.quikcenioans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464b...
https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464b...

125 KB
25 KB

672ms
583ms

Document
text/html

2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e7cb1955427a9543b91cc0c7237f4603841f9ca5f439c2bc5fa8fdd1080e8f3d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 7f11d0c759a922f9-ORD
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type: text/html; charset=utf-8
date: Thu, 03 Aug 2023 21:57:19 GMT
server: cloudflare
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: Express
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7f11d0c5dbbc2240-ORD
content-type: text/html; charset=UTF-8
date: Thu, 03 Aug 2023 21:57:18 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8UsXtWSdcjvfxtKsANEcTVGcN0faGdX1zVX9cpzWRNV54KnITF7qJoBj5HbtBHUs9TZRxcYVL1xYCZMsq74vBdOg0hCkRWv%2FNQslZXp0sjbsykKkyQeodfZMPPKHM3lMVXkdS0ibaYOis7PZ7RhsBjoA5S6mm87NyA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 main.dddae0ff5c27623fcee1.css
static-msql-prod.refinance.quickenloans.com/ 70 KB
12 KB 71ms
45ms Stylesheet
text/css 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.css

Requested by

Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3775095b5023f3744c937e2588d989968a020a89e2d0dbe66b725ab55d12960a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
x-amz-version-id: jdciJDwQmlnVBatNaqTEE0bnBbzkJIo9
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 e3da1744f17646ea239e89a01adcd79e.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD56-P5
age: 2016
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 24 Jul 2023 08:40:09 GMT
server: cloudflare
etag: W/"c61f1d14816f572ea85ba9993d111356"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 7f11d0cb2ed422f9-ORD
x-amz-cf-id: eF4KpQrlSAlQ4ZNVVCw6RvpqPoDdGYyw36yl6L8VDn0HviP1RVntCw==
expires: Fri, 04 Aug 2023 01:57:19 GMT

GET
H2 200 tp.widget.bootstrap.min.js Show response
widget.trustpilot.com/bootstrap/v5/ 21 KB
7 KB 171ms
50ms Script
application/x-javascript 13.32.151.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.151.107 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-151-107.iad66.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b58109431c3adc92bccc460ac5dc394dc4f0979d24656f7a52503e6c77709d0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 03 Aug 2023 07:14:16 GMT
via: 1.1 8a39851a9fdfa096ba6f1e618ed88f40.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD66-C2
age: 52984
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6676
x-xss-protection: 1; mode=block
last-modified: Wed, 03 May 2023 13:48:29 GMT
server: AmazonS3
etag: "befec09eb386fc68a0869c8d1b529dd6"
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: OqXVVLCbCWEjwEql8ZfJoKhX2ixaNUSFZx8HH2rLFhUsXpPmltogZA==

GET
H2 200 dacs.js Show response
cs-cdn.deviceatlas.com/ 21 KB
22 KB 502ms
72ms Script
application/javascript 3.18.206.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cs-cdn.deviceatlas.com/dacs.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

3.18.206.181 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-18-206-181.us-east-2.compute.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

1ef8b676943da5a052097007d8e7f47d3b3216a4ef8b1f5db32705f187d28c6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 06 Apr 2023 14:32:01 GMT
server: nginx/1.17.9
accept-ch: DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data
etag: "231a1b0e4a218e6728e35e117d2dcf49"
x-cache: HIT
content-type: application/javascript
cache-control: no-cache
accept-ranges: bytes
content-length: 21948
expires: Thu, 03 Aug 2023 21:57:18 GMT

GET
H2 200 pixel.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 411 B
690 B 67ms
42ms Script
application/javascript 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bed1e78b60bf9e02ade39d2380fc1318c14b3b75636e1ba2792c96f96ff7ff3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-website-redirect-location: /msql-lre/pixel-ba075c19eedf55c29f16.js
date: Thu, 03 Aug 2023 21:57:19 GMT
via: 1.1 9c7ae2750e58d9a653e6d187cd1189ae.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD52-C1
age: 1583
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 31 May 2023 19:51:24 GMT
server: cloudflare
etag: W/"7b268e0ff874a6b2bb77eaa2600cef14"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7f11d0cb2ed322f9-ORD
x-amz-cf-id: 0XvqT_eTX5r2ZArKCgYRlIyQbzuiY69szS7p14v5VdJFS_06bzNeIQ==
expires: Fri, 04 Aug 2023 01:57:19 GMT

GET
H2 200 launch-ENac0456a305144bd1997bb2b709c90a1c.min.js Show response
assets.adobedtm.com/ 281 KB
89 KB 223ms
39ms Script
application/x-javascript 2600:1418:a000:49d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1418:a000:49d::1e80 Eden Prairie, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 2677ade12878022f72b418ea075be3a4fd528719383bc9f335af9ee9f9dd53a1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
last-modified: Tue, 25 Apr 2023 12:25:18 GMT
server: AkamaiNetStorage
etag: "13f57d277ab7314152718fd2470ef6da:1682425518.775812"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 90816
expires: Thu, 03 Aug 2023 22:57:19 GMT

GET
H2 200 623bac6703b37600138f67a3 Show response
api.pushnami.com/scripts/v1/push/ 87 KB
18 KB 182ms
57ms Script
application/javascript 99.84.208.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.208.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-208-86.iad79.r.cloudfront.net
Software: /
Resource Hash: 6596ea36bf758c2f1d6dd8d40249ab6dae02d46a4aa02c393d65acb0fab0866f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:51:51 GMT
content-encoding: gzip
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD79-C1
age: 328
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: pLUYWbYcsurPDRuqO79Q4Jazf7TYIw-7_UhLiEfH5XquKfPPUYvDxg==

GET
H2 200 css2
fonts.googleapis.com/ 875 B
835 B 188ms
71ms Stylesheet
text/css 2607:f8b0:4020:807::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d67e275d853c297024837a57545bfa7dc91b3c3cfd71f865a9c696787dc87fe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:57:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 03 Aug 2023 21:57:19 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
801 B 188ms
72ms Stylesheet
text/css 2607:f8b0:4020:807::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1775d1af9f09d4e8665774e90493d6c8235d25867cff11bb2139b03b64c84289

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 20:12:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 03 Aug 2023 21:57:19 GMT

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
812 B 189ms
73ms Stylesheet
text/css 2607:f8b0:4020:807::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@100;200;300;400;500&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cde44c4426c7e3043486c1b6f95e4ab538c0855cb4852367fcc040c825e5233a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:57:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 03 Aug 2023 21:57:19 GMT

GET
H2 200 css2
fonts.googleapis.com/ 427 B
376 B 191ms
75ms Stylesheet
text/css 2607:f8b0:4020:807::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Antic+Didone&display=swap

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:57:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 03 Aug 2023 21:57:19 GMT

GET
H2 200 main.dddae0ff5c27623fcee1.js Show response
static-msql-prod.refinance.quickenloans.com/ 548 KB
153 KB 44ms
44ms Script
application/javascript 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0f01de74623470f59785aaa43f62284e4135c4e7dcb28510e35c72ca9d2c00e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
x-amz-version-id: 69C9U6cESm22CUkLkTGjxF_gD7XPg_fn
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 23d3676d60ebf037f9ab907c86a95bbc.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD56-P5
age: 5002
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Mon, 24 Jul 2023 08:40:09 GMT
server: cloudflare
etag: W/"a54d9f94e50bccd714efa5ebad47329f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7f11d0cc483222f9-ORD
x-amz-cf-id: F_WfZTLnL-nvzY1dTo5tP5AXe8M5Glxnji_FG6QoG175BIpbAq-d9Q==
expires: Fri, 04 Aug 2023 01:57:19 GMT

GET
H2 200 v8b253dfea2ab4077af8c6f58422dfbfd1689876627854 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 150ms
66ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v8b253dfea2ab4077af8c6f58422dfbfd1689876627854
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c235f21017bcc11fcaa31d7dfd9855aaebcbf5f6d7ee9bf9f2e98a910907c391

Request headers

Referer: https://refinance.quickenloans.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
last-modified: Thu, 20 Jul 2023 18:10:27 GMT
server: cloudflare
etag: W/"2023.7.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7f11d0cebf85104e-ORD

GET
H2 200 pixel-ba075c19eedf55c29f16.js Show response
trackpixel.refinance.quickenloans.com/msql-lre/ 183 KB
24 KB 66ms
66ms Script
application/javascript 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15a8cca63e2bef5cd07d65e641215a9ac9c8775281897770791dfbf6b97faa6f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
via: 1.1 a1a6e8c498ac24bc4342d4acc68709cc.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD58-P7
age: 1583
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 31 May 2023 19:51:21 GMT
server: cloudflare
etag: W/"d3bbb110ec1f7c022aeb94e528c7dfb1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7f11d0ceeb9322f9-ORD
x-amz-cf-id: yvMXBJJlLtYpC88q0cEDi0DKEwAhHD53DO1QOKDmVgQJbsKG2Nb0FQ==
expires: Fri, 04 Aug 2023 01:57:19 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1691099839906
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1691099839906

4 KB
2 KB

52ms
52ms

XHR
application/json

52.22.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1691099839906

Requested by

Protocol

HTTP/1.1

Server

52.22.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-148-156.compute-1.amazonaws.com

Software

Resource Hash

9aa4a126271ddde3daa53496f063fbad5b2c55419d5080ac74ea2d7a1918b2e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v049-0532594e1.edge-va6.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: 3lGVFkGRQDA=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1253
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-va6-2-v049-05e0f33ed.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: Jk/yoCuJTCw=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&ts=1691099839906
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 34 KB
12 KB 40ms
39ms Script
application/x-javascript 2600:1418:a000:49d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1418:a000:49d::1e80 Eden Prairie, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "dfdd9e1f988805f0c2fbb10cd6b8f034:1663863409.614694"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12384
expires: Thu, 03 Aug 2023 22:57:19 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 3 KB
2 KB 40ms
39ms Script
application/x-javascript 2600:1418:a000:49d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1418:a000:49d::1e80 Eden Prairie, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "b89fcb8870ac40eecb6d3cc844d35389:1663863409.92483"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1598
expires: Thu, 03 Aug 2023 22:57:19 GMT

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 25 KB
9 KB 38ms
37ms Script
application/x-javascript 2600:1418:a000:49d::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1418:a000:49d::1e80 Eden Prairie, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:19 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:50 GMT
server: AkamaiNetStorage
etag: "d220d501715e0484d0dddeac614f902c:1663863410.217006"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8755
expires: Thu, 03 Aug 2023 22:57:19 GMT

GET
H2 200 datadog-rum-v3.js Show response
www.datadoghq-browser-agent.com/ 115 KB
37 KB 180ms
57ms Script
application/javascript 13.32.195.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.195.219 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-195-219.iad66.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:56:33 GMT
content-encoding: br
via: 1.1 6cdec19f98848143f7f7c8c92c568d02.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
x-amz-cf-pop: IAD66-C1
age: 48
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: qbKQMr2gJcqv9_XA4CeD_FGn1LzKFt17Zq02INhVc-bcu4En7_U2ig==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 111 KB
43 KB 206ms
91ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c7e03a4130a53ccb26197c9ef685beb6ddc326c8a175bd9edca1c2b67f009def

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43360
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:20 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 162ms
102ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

23875f44871dee4adee475357b39e52e0447e1b88cf17ecc5a2e75adfe503470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65426
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:20 GMT

GET
H/1.1 200
OK p
pixel1083.everesttech.net/1083/ 128 B
796 B 333ms
47ms Image
image/png 54.235.130.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel1083.everesttech.net/1083/p?ev_transid=&ev_=%loanpurpose%&_lead=1
Requested by: Host: refinance.quickenloans.com
URL: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.235.130.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-130-106.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 03 Aug 2023 21:57:20 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

GET
H/1.1

200
OK

iui3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...
https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refin...

43 B
855 B

84ms
84ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t

Requested by

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Aug 2023 21:57:20 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YB0AJY7XR488Q065JSE1
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 03 Aug 2023 21:57:20 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: ZF7BS1MHGE54HSADVP45
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3Dba052675-2c42-cb77-3962-268513d6d894%26type%3D30%26m%3D1&ex-fch=416613&ex-src=https://mortgage.quickenloans.com/lending/home-refinance/&ex-hargs=v%3D1.0%3Bc%3D8442225550101%3Bp%3DBA052675-2C42-CB77-3962-268513D6D894&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/776757481/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=wCLMZPCECoOYNc...
https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1764183109&sscte=1&crd=&pscrd=IhMI8...

42 B
455 B

204ms
77ms

Image
image/gif

2607:f8b0:4020:805::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1764183109&sscte=1&crd=&pscrd=IhMI8OSC6r3BgAMVA0wNCh1CwAQf&is_vtc=1&ocp_id=wCLMZPCECoOYNcKAk_gB&random=3686970850

Requested by

Protocol

Server

2607:f8b0:4020:805::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/776757481/?label=B6FECKv8wZEBEOnBsfIC&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1764183109&sscte=1&crd=&pscrd=IhMI8OSC6r3BgAMVA0wNCh1CwAQf&is_vtc=1&ocp_id=wCLMZPCECoOYNcKAk_gB&random=3686970850
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 click Show response
refinance.quickenloans.com/api/ 4 KB
2 KB 137ms
137ms XHR
application/json 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/click

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

b671857a0e787569bbf9f03c7eabfd0b4bffbbd69e8ebc6a5a33635658d8aba2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
accept-language: en-US,en;q=0.9
Authorization: Bearer null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"eb4-QOi54legqBpX28+7BoHlCGElenc"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 7f11d0d0ae5222f9-ORD
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK dest5.html Show response
quicken.demdex.net/ Frame 7A1A 7 KB
3 KB 204ms
49ms Document
text/html 54.204.58.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://quicken.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENac0456a305144bd1997bb2b709c90a1c.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.58.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-58-171.compute-1.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-va6-2-v049-0dcb686ce.edge-va6.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: JHOlOBtTT9o=
content-encoding: gzip
date: Thu, 3 Aug 2023 21:57:20 GMT
last-modified: Wed, 28 Jun 2023 13:21:13 GMT
transfer-encoding: chunked
vary: accept-encoding

GET
H2 200 id Show response
somni.quickenloans.com/ 48 B
469 B 187ms
51ms XHR
application/x-javascript 63.140.38.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=5D60123F5245B13E0A490D45%40AdobeOrg&mid=25771871258484444153103988683265962276&ts=1691099840186

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.219 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-219.data.adobedc.net

Software

jag /

Resource Hash

9a4168f8425763e4414c7193f476180e8cf9fa3dbef61eb6dac99e953b72ea08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=ZMwiwAAAAFCRpQNw
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=25604498747523259433125248355605689836
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZMwiwAAAAFCRpQNw

42 B
940 B

51ms
50ms

Image
image/gif

52.22.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZMwiwAAAAFCRpQNw

Requested by

Protocol

HTTP/1.1

Server

52.22.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-148-156.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v049-06985809c.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 6LVL64oaQ2c=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZMwiwAAAAFCRpQNw
Date: Thu, 03 Aug 2023 21:57:20 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
quickenloans.tt.omtrdc.net/rest/v1/ 355 B
853 B 194ms
59ms XHR
application/json 63.140.38.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://quickenloans.tt.omtrdc.net/rest/v1/delivery?client=quickenloans&sessionId=b9b1c9797d5149daa820ae0092c62758&version=2.10.2

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.128 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-128.data.adobedc.net

Software

jag /

Resource Hash

ce9e5f3064f3fd1d335e4765478e5f356646d23497e7c079c7cf1d8ff58c946b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: 0c2cf1f0-e742-4c2e-9844-05ffca71e9c4

GET
H2 200 Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 551 B
939 B 72ms
47ms Image
image/png 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
via: 1.1 b75f3304a39fe185ba1556322bdff970.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD58-P2
age: 5393
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 551
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Feb 2023 23:45:55 GMT
server: cloudflare
etag: "90732fd581b4624530c995d70d3f17a8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7f11d0d1bf8b22f9-ORD
x-amz-cf-id: eGWWHYU82VRXps63ULn_i1Brl8KXIHKqNFFTemGxokd1YNbS5L5JVA==
expires: Fri, 04 Aug 2023 01:57:20 GMT

GET
H2 200 overlay-close.svg
content.refinance.quickenloans.com/msql/EdisonOverlay/ 586 B
575 B 69ms
44ms Image
image/svg+xml 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/EdisonOverlay/overlay-close.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
via: 1.1 94ce039b0b6c2c94ce86d44130e6f0e2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD58-P2
age: 5393
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Feb 2023 23:45:55 GMT
server: cloudflare
etag: W/"58887760fe01f3933d5ae2d7bcc3f373"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 7f11d0d1bf8c22f9-ORD
x-amz-cf-id: akkffKFbIUjhP2CmSwBlk_wRR8529_5JhL1BrUFGlEagPUrCn153Ug==
expires: Fri, 04 Aug 2023 01:57:20 GMT

POST
H2 200 ip Show response
refinance.quickenloans.com/api/geo/ 163 B
264 B 206ms
205ms XHR
application/json 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/geo/ip

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

14510a6b195b06ee9dcca0194b02a77fd50239c7b65eb46da1efcb65581acd33

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"a3-pn0QAVburr5FUmF1dQYW6oUmMng"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cf-ray: 7f11d0d1cf9022f9-ORD
x-xss-protection: 1; mode=block

POST
H2 200 track Show response
refinance.quickenloans.com/api/ 2 B
110 B 382ms
379ms XHR
text/plain 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/api/track

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
cf-ray: 7f11d0d1cf9b22f9-ORD
content-length: 2
x-xss-protection: 1; mode=block

GET
H2 200 qllogo.png
content.refinance.quickenloans.com/msql/ 4 KB
4 KB 63ms
61ms Image
image/png 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/qllogo.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
via: 1.1 fd2db6134edb8d86c73939caf69370fa.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD58-P2
age: 1954
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 3877
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Feb 2023 00:50:15 GMT
server: cloudflare
etag: "277055237f3837abfae204219c13fa6c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7f11d0d1efc822f9-ORD
x-amz-cf-id: Uy-u-M7YSKrTkdY2kDDwwjt06-HgVyxemIOeyqcSbz6QnojYjKcoaQ==
expires: Fri, 04 Aug 2023 01:57:20 GMT

GET
H2 200 redarrow1.png
content.refinance.quickenloans.com/msql/ 7 KB
7 KB 61ms
60ms Image
image/png 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/redarrow1.png

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.css

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://static-msql-prod.refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
via: 1.1 7b4f4d0815aab86f9f1429fa39615564.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD58-P2
age: 6555
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 6656
x-xss-protection: 1; mode=block
last-modified: Tue, 28 Feb 2023 00:50:15 GMT
server: cloudflare
etag: "55eb59d4535de0b41be9b7465ec7d9c3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7f11d0d1efc922f9-ORD
x-amz-cf-id: s7c0qPpfvHPoouk2nJzZ69h5A5jWAShscPWvMLEmQwBHjU8J_dtBdw==
expires: Fri, 04 Aug 2023 01:57:20 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
30 KB 175ms
63ms Font
font/woff2 2607:f8b0:4020:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:thin,extra-light,light,100,200,300,400,500,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 00:58:33 GMT
x-content-type-options: nosniff
age: 161927
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Aug 2024 00:58:33 GMT

GET
H2 200 quicken_sprite_4_4_18.png
content.refinance.quickenloans.com/msql/ 75 KB
75 KB 61ms
59ms Image
image/png 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content.refinance.quickenloans.com/msql/quicken_sprite_4_4_18.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
via: 1.1 e4be8819440826baa031b48a31a3fcde.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=2592000
x-amz-cf-pop: ORD58-P2
age: 1953
x-amz-server-side-encryption: AES256
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache: Hit from cloudfront
content-length: 76537
x-xss-protection: 1; mode=block
last-modified: Sat, 25 Feb 2023 00:04:51 GMT
server: cloudflare
etag: "1f80b3d1f05cc5648c262fba9d39b61a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7f11d0d1efca22f9-ORD
x-amz-cf-id: fYAJEWyK9_FMZP4IiHSe_HHNddKCIJ6_XzYSBunXMCxgyuVuBNTuzw==
expires: Fri, 04 Aug 2023 01:57:20 GMT

GET
H2 200 4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2
fonts.gstatic.com/s/shadowsintolighttwo/v14/ 15 KB
16 KB 161ms
51ms Font
font/woff2 2607:f8b0:4020:804::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/shadowsintolighttwo/v14/4iC86LVlZsRSjQhpWGedwyOoW-0A6_kpsyNmpAzHGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Shadows+Into+Light+Two&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://refinance.quickenloans.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 01:52:03 GMT
x-content-type-options: nosniff
age: 590717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15832
x-xss-protection: 0
last-modified: Tue, 02 May 2023 14:54:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Jul 2024 01:52:03 GMT

GET
H2 200 request.js Show response
script.anura.io/ 55 KB
20 KB 230ms
100ms Script
application/javascript 3.216.213.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/request.js?instance=3439535758&exid=4c12ce7c-bb40-55aa-9b97-5a5ae28f9664&source=lmb-54867-113582-103&campaign=515&551132501121

Requested by

Host: static-msql-prod.refinance.quickenloans.com
URL: https://static-msql-prod.refinance.quickenloans.com/main.dddae0ff5c27623fcee1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.216.213.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-216-213-80.compute-1.amazonaws.com

Software

nginx /

Resource Hash

f011a623c11f90c8bc8431730b76286ab4a369af3c4bf92ab47032878761c8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 226 KB
79 KB 84ms
82ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-WQ7TGZQSWQ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9cac4cd092da7ff57ba820f6fb5d6f2c57ce29edeb4a726e2f0fa7fb6c883640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 81242
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 03 Aug 2023 21:57:20 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 87ms
85ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-4641735&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0c9273f8cc9dc38c3e03c9ed628bef99838d2847db172f608021f5f1729bd7a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65379
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:20 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 226 KB
77 KB 112ms
111ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e05e2c3adab298048b6b41999197900a6b00cb4dcb3a08f4cb520db2fa09596b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78744
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:20 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 99ms
98ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9045885&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

48d0c1bd04d3f726b1a1d2ce7e5f67e6836180e2cb59f2e2fb030ce48c40658b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65338
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:20 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 165ms
50ms Script
text/javascript 2607:f8b0:4020:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-3849768-74&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 03 Aug 2023 20:37:29 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 4791
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 03 Aug 2023 22:37:29 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 4 KB
2 KB 54ms
53ms XHR
application/json 52.22.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=5D60123F5245B13E0A490D45%40AdobeOrg&d_nsid=0&d_mid=25771871258484444153103988683265962276&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=MCID%0125771871258484444153103988683265962276&ts=1691099840378

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.22.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-148-156.compute-1.amazonaws.com

Software

Resource Hash

53a72b4f1864f7779c6556c01ae8b5c782dd29e7ebfb6b8599d76bfd5e5030a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-va6-1-v049-0a44897b1.edge-va6.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: Df5vixgGSY0=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://refinance.quickenloans.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1252
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1

200
OK

ibs:dpid=21&dpuuid=213900604597015531317
dpm.demdex.net/ Frame 7A1A
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9211132908&aam=25604498747523259433125248355605689836
https://dpm.demdex.net/ibs:dpid=21&dpuuid=213900604597015531317

42 B
940 B

53ms
52ms

Image
image/gif

52.22.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=21&dpuuid=213900604597015531317

Requested by

Protocol

HTTP/1.1

Server

52.22.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-148-156.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v049-0fd42264a.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 2Kdue0kfTlY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
via: 1.1 a5f3f63e5cb1bdf37811b61ad2c25cbc.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: IAD55-P4
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dpm.demdex.net/ibs:dpid=21&dpuuid=213900604597015531317
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
x-amz-cf-id: AjnFoCSk8CHUj_lQGQshnV3pLXE3673O6co-amsIsfsadVeXqY0loQ==
expires: 0

GET
H2

200

dc_pre=CLCqo-q9wYADFcUJaAgd6dMAZg;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~ore...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=260894560.1691099841;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uap...
https://ad.doubleclick.net/activity;dc_pre=CLCqo-q9wYADFcUJaAgd6dMAZg;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=260894560.1691099841;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa...
https://adservice.google.com/ddm/fls/z/dc_pre=CLCqo-q9wYADFcUJaAgd6dMAZg;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;ua...

42 B
107 B

185ms
73ms

Image
image/gif

2607:f8b0:4020:807::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLCqo-q9wYADFcUJaAgd6dMAZg;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035

Requested by

Protocol

Server

2607:f8b0:4020:807::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CLCqo-q9wYADFcUJaAgd6dMAZg;src=4641735;type=conve0;cat=cored0;ord=1;num=6892756161873;auiddc=*;u3=;u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 s38894107728543 Show response
somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LDQM/ 4 KB
4 KB 58ms
57ms XHR
application/x-javascript 63.140.38.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://somni.quickenloans.com/b/ss/quickenglobalprod/10/JS-2.23.0-LDQM/s38894107728543

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.219 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-219.data.adobedc.net

Software

jag /

Resource Hash

964d436ac0d805ae99afc68dcdc60871c8a771ae356d8648782ab260abb7be53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-aam-tid: bhno0tGXQT0=
date: Thu, 03 Aug 2023 21:57:20 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 4218
x-xss-protection: 1; mode=block
dcs: dcs-prod-va6-1-v049-0e608a5ad.edge-va6.demdex.com 3 ms
pragma: no-cache
last-modified: Fri, 04 Aug 2023 21:57:20 GMT
server: jag
etag: 3631609255103397888-4619703211290692404
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Wed, 02 Aug 2023 21:57:20 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEKGSAd2iKfzv9HttmIqMAxQ&google_cver=1
dpm.demdex.net/ Frame 7A1A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjU2MDQ0OTg3NDc1MjMyNTk0MzMxMjUyNDgzNTU2MDU2ODk4MzY=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKGSAd2iKfzv9HttmIqMAxQ&google_cver=1?gdpr=0&gdpr_consent=

42 B
940 B

51ms
51ms

Image
image/gif

52.22.148.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKGSAd2iKfzv9HttmIqMAxQ&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Server

52.22.148.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-22-148-156.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v049-0357bbe6b.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: tPowGMI6RMU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEKGSAd2iKfzv9HttmIqMAxQ&google_cver=1?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

dc_pre=CPSxo-q9wYADFc1cDQodAU8JkA;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;...
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/activity;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=260894560.1691099841;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uaf...
https://ad.doubleclick.net/activity;dc_pre=CPSxo-q9wYADFc1cDQodAU8JkA;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=260894560.1691099841;u3=Date.now().toString();u14=%25qls.v...
https://adservice.google.com/ddm/fls/z/dc_pre=CPSxo-q9wYADFc1cDQodAU8JkA;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe...

42 B
401 B

169ms
72ms

Image
image/gif

2607:f8b0:4020:807::2002

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPSxo-q9wYADFc1cDQodAU8JkA;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035

Requested by

Protocol

Server

2607:f8b0:4020:807::2002 -, , ASN (),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/dc_pre=CPSxo-q9wYADFc1cDQodAU8JkA;src=9045885;type=conversi;cat=corethan;ord=1;num=737712512647;auiddc=*;u3=Date.now().toString();u14=%25qls.value%25;gtm=45fe3820;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect Show response
sgtm.lowermybills.com/g/ 65 B
534 B 158ms
59ms XHR
text/plain 2001:4860:4802:34::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://sgtm.lowermybills.com/g/collect?v=2&tid=G-WQ7TGZQSWQ&gtm=45je3820&_p=1537912420&cid=737025425.1691099841&ul=en-us&sr=1600x1200&_fplc=0&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=US&sst.ngs=1&_s=1&sid=1691099840&sct=1&seg=0&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&dr=https%3A%2F%2Fdsa.bio%2F&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&en=page_view&_fv=1&_nsi=1&_ss=1&richsstsse

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::15 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 google
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache
access-control-allow-credentials: true

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/1062919768/ 3 KB
2 KB 77ms
77ms Script
text/javascript 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1062919768/?random=1691099840656&cv=11&fst=1691099840656&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1062919768&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

bba2b84cec6052749e1723cd3c61a98e2bcdc38f852028f7bef1507ea13aab46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1721
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
213 B 72ms
71ms XHR
text/plain 2607:f8b0:4020:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1537912420&t=pageview&_s=1&dl=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&dr=https%3A%2F%2Fdsa.bio%2F&ul=en-us&de=UTF-8&dt=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAQABAAAAACAAs~&jid=2097129830&gjid=1760099353&cid=737025425.1691099841&uid=&tid=UA-3849768-74&_gid=316833095.1691099841&_r=1&gtm=457e3820&z=1177318511

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://refinance.quickenloans.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 showads.js Show response
ads.anura.io/ 0
353 B 184ms
49ms XHR
application/javascript 99.84.108.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.anura.io/showads.js?22352316163
Requested by: Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.108.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-108-70.iad79.r.cloudfront.net
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 05:08:35 GMT
content-encoding: gzip
via: 1.1 f672414ac3f5fcc589dd2a6d8cdee8be.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: IAD79-C2
age: 60525
vary: Accept-Encoding
x-cache: Hit from cloudfront
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: application/javascript; charset=utf-8
x-amz-cf-id: CiIk5qoHCPzTXfrdQvT3EB0OTM5GMkE9Y1y9oArsAmM7JOTzWflU2w==

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7A1A
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESECQzAwg6sLBJa0KXFY-9lpo&google_cver=1
https://pixel.everesttech.net/1x1

128 B
796 B

50ms
48ms

Image
image/png

54.235.130.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.235.130.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-130-106.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 03 Aug 2023 21:57:21 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 03 Aug 2023 21:57:21 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2

200

/
www.google.com/pagead/1p-user-list/5830051840/ Frame 7A1A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/5830051840/?value=0&guid=ON&script=0&data=aam=21408935
https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=813794451

42 B
108 B

75ms
74ms

Image
image/gif

2607:f8b0:4020:805::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=813794451

Requested by

Protocol

Server

2607:f8b0:4020:805::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-user-list/5830051840/?value=0&guid=ON&script=0&data=aam=21408935&is_vtc=1&random=813794451
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/1062919768/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1062919768/?random=1790070191&cv=11&fst=1691099840656&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Fref...
https://www.google.com/pagead/1p-conversion/1062919768/?random=1790070191&cv=11&fst=1691099840656&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.c...

42 B
108 B

80ms
80ms

Image
image/gif

2607:f8b0:4020:805::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/1062919768/?random=1790070191&cv=11&fst=1691099840656&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOEtDdHBnWVExLXZSemNlUnhPT25BUklsQUVDZGVxd3ZCSGJPdDFXNFpOa3ZXRFI3ei1fc1lfbHE5Q1U0UEpaRjZqYWd3YUtJMVEaWENoRUk4S0N0cGdZUWdaWHc1Y3lVcFl6UUFSSXRBTlRsX2ZkVVM4SkF5TU9IX1pWa1Uwb2xfQU92SGJkOXkxdV9zSG5GOGg0YVFFb0xEb1NYQ3pfV3NfaHIiEwjTmqPqvcGAAxXXDGgIHbAWCk8&is_vtc=1&ocp_id=wCLMZNO6KteZoPMPsK2o-AQ&cid=CAQSKQBpAlJW_gzEV78aHhnATOP5Y0TEVEFfS1MIfQB2cZgjhJHm7s5SG5yR&random=815613616

Requested by

Protocol

Server

2607:f8b0:4020:805::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:21 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:20 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/1062919768/?random=1790070191&cv=11&fst=1691099840656&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&label=562ECMyTkAgQ2Lzr-gM&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&gtm_ee=1&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOEtDdHBnWVExLXZSemNlUnhPT25BUklsQUVDZGVxd3ZCSGJPdDFXNFpOa3ZXRFI3ei1fc1lfbHE5Q1U0UEpaRjZqYWd3YUtJMVEaWENoRUk4S0N0cGdZUWdaWHc1Y3lVcFl6UUFSSXRBTlRsX2ZkVVM4SkF5TU9IX1pWa1Uwb2xfQU92SGJkOXkxdV9zSG5GOGg0YVFFb0xEb1NYQ3pfV3NfaHIiEwjTmqPqvcGAAxXXDGgIHbAWCk8&is_vtc=1&ocp_id=wCLMZNO6KteZoPMPsK2o-AQ&cid=CAQSKQBpAlJW_gzEV78aHhnATOP5Y0TEVEFfS1MIfQB2cZgjhJHm7s5SG5yR&random=815613616
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7A1A
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEC...
https://pixel.everesttech.net/1x1

128 B
691 B

48ms
48ms

Image
image/png

54.235.130.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.235.130.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-130-106.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 03 Aug 2023 21:57:21 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 03 Aug 2023 21:57:21 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7A1A
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
691 B

50ms
50ms

Image
image/png

54.235.130.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.235.130.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-130-106.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 03 Aug 2023 21:57:21 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 03 Aug 2023 21:57:21 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 182 KB
67 KB 88ms
87ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-966730890

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6425a5a18f90552004ebe3b2364ce327e076eae8ec26165b1de51341d59215dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68296
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H2 200 core.js
s.pinimg.com/ct/ Frame 61D4 3 KB
2 KB 317ms
45ms Script
application/javascript 2a04:4e42:77::84

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: dsa.bio
URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:77::84 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
x-cdn: fastly
etag: "b890a703adcb559f5e5d300aa7e4294f"
x-amz-server-side-encryption: AES256
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: X-CDN
vary: Accept-Encoding, Origin
cache-control: max-age=7200
alt-svc: h3=":443";ma=600
content-length: 1466

GET
H3 200 js
www.googletagmanager.com/gtag/ 176 KB
64 KB 112ms
112ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-852807

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65341
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H2 200 fbevents.js
connect.facebook.net/en_US/ Frame 61D4 172 KB
47 KB 322ms
50ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: dsa.bio
URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 -, , ASN (),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 03 Aug 2023 21:57:21 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 47151
x-xss-protection: 0
pragma: public
x-fb-debug: QfK4LPNF4Ziexv8l+jUG//1q5PWTgHy2I79gNYytLQ8odQ3Inlp1Ug6RIcC5RYDfVHpFLoVgWi3UISkNSCK9Mg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics
ads.revjet.com/ Frame 61D4 19 KB
8 KB 326ms
51ms Script
application/javascript 135.148.151.160

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.revjet.com/analytics?acu=3394
Requested by: Host: dsa.bio
URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 135.148.151.160 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: gzip
last-modified: Fri, 26 May 2023 06:04:49 GMT
server: nginx
etag: W/"64704c01-4c14"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
expires: Thu, 03 Aug 2023 22:07:21 GMT

GET
H2 200 a-06d7.min.js
b-code.liadm.com/ Frame 61D4 45 KB
15 KB 319ms
51ms Script
application/javascript 2600:9000:2509:b800:8:8845:1500:93a1

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-06d7.min.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2509:b800:8:8845:1500:93a1 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 08:53:10 GMT
content-encoding: gzip
via: 1.1 2959f5d118b77b5c8e1e086d4a1147c6.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P2
age: 47051
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: "public, max-age=86400"
x-amz-cf-id: b-sOnp00NQRmGCvdt_9R8VgwdjnLYasAQKOjrr9vvL9WDcUhM4cupQ==

GET
H3 200 conversion.js Show response
www.googleadservices.com/pagead/ 49 KB
18 KB 76ms
76ms Script
text/javascript 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

acd67ad087fc6061dfdc4fb2c4ac89fb1cde0654225885b81a889dcbf75141d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18400
x-xss-protection: 0
server: cafe
etag: 8482130582040313580
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H3 200 js
www.googletagmanager.com/gtag/ 193 KB
70 KB 153ms
153ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-700319321

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71177
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H2 200 tfa.js
cdn.taboola.com/libtrc/unip/1390358/ Frame 61D4 58 KB
18 KB 313ms
62ms Script
application/javascript 151.101.193.44

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1390358/tfa.js
Requested by: Host: dsa.bio
URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 -, , ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: Nm8CPfQbqffQ.2ms091OiSuBdWswr7K2
content-encoding: gzip
via: 1.1 varnish
date: Thu, 03 Aug 2023 21:57:21 GMT
x-amz-request-id: 3W9N86AAY6QWG7CA
age: 71
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
fastly-restarts: 1
x-amz-id-2: F7B3gILyhSUvqMx2c2qvSVq4gdeopEvwREnUPBx/8BDXsJYmZEgk6qx1z+jMhZXffuUnXyFXVjU=
x-served-by: cache-chi-klot8100039-CHI
content-length: 17913
last-modified: Wed, 02 Aug 2023 17:10:40 GMT
server: AmazonS3
x-tbl-debug: bestatus=200,beresp=OK
x-timer: S1691099841.417128,VS0,VE31
etag: "bf49549936dfcbebcaea15bcd5673448"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 78
access-control-allow-origin: *
cache-control: private,max-age=14401
accept-ranges: bytes
x-cache-hits: 5314

GET
H3 200 js
www.googletagmanager.com/gtag/ 193 KB
70 KB 203ms
202ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-813495030

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71148
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H3 200 js
www.googletagmanager.com/gtag/ 193 KB
70 KB 221ms
221ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-755089552

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71241
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H2 200 deviceAtlasLmb.min.js
cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/ Frame 61D4 8 KB
3 KB 308ms
42ms Script
application/javascript 2606:4700:4400::6812:2345

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.mortgage.quickenloans.com/lending-images/presentations/common/navapi/deviceAtlasLmb.min.js

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::6812:2345 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .lowermybills.com .quickenloans.com app.optimizely.com
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com
age: 4780
p3p: CP="NON DSP COR LAW CONi TELi OUR SAM IND CNT"
x-xss-protection: 1; mode=block
last-modified: Fri, 21 May 2021 02:42:28 GMT
server: cloudflare
etag: W/"20fc-5c2ce02c32fd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 7f11d0d8fd832d0d-ORD
expires: Fri, 04 Aug 2023 01:57:21 GMT

GET
H3 200 destination
www.googletagmanager.com/gtag/ 182 KB
67 KB 164ms
164ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-966730890&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68315
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H2 200 ytc.js
s.yimg.com/wi/ 18 KB
7 KB 312ms
51ms Script
application/javascript 2001:4998:14:800::1000

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: dsa.bio
URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1000 -, , ASN (),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:17 GMT
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: TXSS1ZGNC44S1C8E
age: 5
x-amz-server-side-encryption: AES256
x-amz-id-2: 1Gyb9MXH2OtNENESCgzld4sKvmAtT5Gazq9hbaO6IPGEBxkCJxQSobI59OTUFcsYJYYpzOHJzpcyJ7CdYhwkGEFHlBNaJo8T
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
server: ATS
etag: "5c6ed25dce803fd84288922b8928409e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 283ms
28ms Script
application/javascript 2a04:4e42:200::396

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: dsa.bio
URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 -, , ASN (),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H3 200 js
www.googletagmanager.com/gtag/ 198 KB
70 KB 237ms
237ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866179376

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72073
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H3 200 js
www.googletagmanager.com/gtag/ 193 KB
70 KB 202ms
202ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-865435318

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71194
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H3 200 js
www.googletagmanager.com/gtag/ 198 KB
70 KB 170ms
169ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-857412364

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72041
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H2 200 scevent.min.js
sc-static.net/ Frame 61D4 37 KB
16 KB 348ms
91ms Script
application/javascript 18.160.10.241

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: dsa.bio
URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.241 -, , ASN (),
Reverse DNS
Software: CloudFront /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: gzip
via: 1.1 fb1dc2e3bf4105b403e3bfa3a5067970.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: IAD12-P3
x-cache: Miss from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 16342
x-amz-cf-id: L6Y8sntBNUl4E6s0uj9wYn_loKmIOoFepxIieIyxEjQg8ThWN_9G6A==

GET
H/1.1 200
OK js
pixel.mathtag.com/event/ Frame 61D4 5 KB
6 KB 323ms
72ms Script
text/javascript 23.52.161.201

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/event/js?mt_id=1541200&mt_adid=245296&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.52.161.201 -, , ASN (),
Reverse DNS
Software: MT3 1031 59fd23a master ord ord-pixel-x25 config_version:"1969" /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 03 Aug 2023 21:57:21 GMT
Server: MT3 1031 59fd23a master ord ord-pixel-x25 config_version:"1969"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: text/javascript
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 5540
Expires: Thu, 03 Aug 2023 21:57:20 GMT

GET quickenloans_lander.js
cdn1.decide.dev/tracking/ Frame 61D4 0
0

GET
H2 200 ytc.js
s.yimg.com/wi/ Frame 61D4 18 KB
6 KB 71ms
70ms Script
application/javascript 2001:4998:14:800::1000

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: dsa.bio
URL: https://dsa.bio/aa/?utm_source=madisonrogers&utm_campaign=20c5683180-EMAIL_CAMPAIGN_2023_03_09_05_36_COPY_01&utm_medium=email&utm_term=0_-151dea10b0-%5BLIST_EMAIL_ID%5D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1000 -, , ASN (),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:17 GMT
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: TXSS1ZGNC44S1C8E
age: 5
x-amz-server-side-encryption: AES256
x-amz-id-2: 1Gyb9MXH2OtNENESCgzld4sKvmAtT5Gazq9hbaO6IPGEBxkCJxQSobI59OTUFcsYJYYpzOHJzpcyJ7CdYhwkGEFHlBNaJo8T
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
server: ATS
etag: "5c6ed25dce803fd84288922b8928409e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H3 200 js
www.googletagmanager.com/gtag/ 198 KB
70 KB 262ms
261ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10910338944&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5VHPB6M

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72001
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET src
c.pmsrv.co/v2/conversion/ Frame 61D4 0
0

GET
H3 200 js
www.googletagmanager.com/gtag/ 193 KB
69 KB 265ms
265ms Script
application/javascript 2607:f8b0:4020:804::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10866176763

Requested by

Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:804::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71126
x-xss-protection: 0
last-modified: Thu, 03 Aug 2023 21:03:07 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 03 Aug 2023 21:57:21 GMT

GET
H2 200 everflow.js Show response
www.lmbahsj2.com/scripts/sdk/ 60 KB
19 KB 62ms
62ms Script
text/javascript 35.201.76.131
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lmbahsj2.com/scripts/sdk/everflow.js
Requested by: Host: trackpixel.refinance.quickenloans.com
URL: https://trackpixel.refinance.quickenloans.com/msql-lre/pixel-ba075c19eedf55c29f16.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 131.76.201.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7579fea8b4d6ea390f1a708a3b08b08911f3df414f650fa850780d0b3211cab7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
content-encoding: gzip
via: 1.1 google
accept-ch: Sec-Ch-Ua-Platform-Version
server: nginx
vary: Origin
content-type: text/javascript
cache-control: max-age=14400
x-eflow-request-id: fab561f7-acfc-457a-aa7d-8d47a9902ab7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET quickenloans_lander.js
cdn1.lockerdomecdn.com/tracking/ Frame 61D4 0
0

GET
H/1.1 200
OK iui3
s.amazon-adsystem.com/ Frame 61D4 43 B
855 B 64ms
63ms Image
image/gif 52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/iui3?d=forester-did&ex-fargs=%3Fid%3D6acaf65c-54d3-788f-2e4f-971d4f6b7886%26type%3D4%26m%3D1&ex-fch=416613&ex-src=https://home.rocketmortgage.com&ex-hargs=v%3D1.0%3Bc%3D584239139431578754%3Bp%3D6ACAF65C-54D3-788F-2E4F-971D4F6B7886

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 03 Aug 2023 21:57:21 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 0367HHE1MYVYV8J2DKHY
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 hub Show response
api.pushnami.com/scripts/v1/ Frame BF50 2 KB
1 KB 50ms
50ms Document
text/html 99.84.208.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pushnami.com/scripts/v1/hub

Requested by

Host: api.pushnami.com
URL: https://api.pushnami.com/scripts/v1/push/623bac6703b37600138f67a3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.208.86 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-208-86.iad79.r.cloudfront.net

Software

Resource Hash

2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'unsafe-inline' *
X-Content-Security-Policy	default-src 'unsafe-inline' *

Request headers

Referer: https://refinance.quickenloans.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *
age: 1736
cache-control: no-cache
content-encoding: gzip
content-security-policy: default-src 'unsafe-inline' *
content-type: text/html; charset=utf-8
date: Thu, 03 Aug 2023 21:28:25 GMT
vary: accept-encoding
via: 1.1 e7311287a3a52035e5fcaf9a58791104.cloudfront.net (CloudFront)
x-amz-cf-id: b1ddpChmPgnjyVbYdQSbAiurgojbr67lgNvnjwYr60Ovdp_Za6LdcQ==
x-amz-cf-pop: IAD79-C1
x-cache: Hit from cloudfront
x-content-security-policy: default-src 'unsafe-inline' *
x-webkit-csp: default-src 'unsafe-inline' *

POST
H2 204 rum Show response
refinance.quickenloans.com/cdn-cgi/ 0
178 B 66ms
65ms XHR
text/plain 2606:4700:4400::ac40:9bdf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://refinance.quickenloans.com/cdn-cgi/rum?

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:4400::ac40:9bdf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://refinance.quickenloans.com/?pkey1=103&pkey2=515&pkey3=e9e884c62a51464ba611391cf194b035&sourceid=lmb-54867-113582-103&sid=9&cmpid=9&crtid=&oid=9&affid=103&_ef_transaction_id=e9e884c62a51464ba611391cf194b035
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
content-type: application/json

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://refinance.quickenloans.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 7f11d0d79ed922f9-ORD

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 7A1A
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

49ms
49ms

Image
image/png

54.235.130.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 54.235.130.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-130-106.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://quicken.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Thu, 03 Aug 2023 21:57:21 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type: image/png
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Thu, 03 Aug 2023 21:57:21 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 400 response.json Show response
script.anura.io/ 21 B
320 B 223ms
123ms XHR
application/json 3.216.213.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://script.anura.io/response.json

Requested by

Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.216.213.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-216-213-80.compute-1.amazonaws.com

Software

nginx /

Resource Hash

d7cb2c2f08454c0b1f346e0343bbf085b65da2d6b0997b5e12bbea90ed541be6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://refinance.quickenloans.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 03 Aug 2023 21:57:21 GMT
x-content-type-options: nosniff
server: nginx
access-control-allow-methods: POST
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Sun, 28 Dec 1980 18:57:00 EST

GET

1x1
pixel.everesttech.net/ Frame 7A1A
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

0
0

GET

pixel
cm.g.doubleclick.net/ Frame 7A1A
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...

0
0

POST psp
psp.pushnami.com/api/ 0
0

OPTIONS psp
psp.pushnami.com/api/ Frame 0
0

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 123ms
56ms Image
image/gif 151.101.193.140

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1691099841458&id=t2_1fj2owc9&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=964bcd66-7643-45d7-b981-fdb1b9ecd363&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 -, , ASN (),
Reverse DNS
Software: Varnish /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://refinance.quickenloans.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Thu, 03 Aug 2023 21:57:21 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET /
googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/ 0
0

GET js
www.googletagmanager.com/gtag/ 0
0

GET yh
cm.everesttech.net/cm/ Frame 7A1A 0
0

GET /
googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/ 0
0

GET /
googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/ 0
0

GET /
googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/ 0
0

GET /
googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/ 0
0

GET /
googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn1.decide.dev
URL: https://cdn1.decide.dev/tracking/quickenloans_lander.js

Domain: c.pmsrv.co
URL: https://c.pmsrv.co/v2/conversion/src?a=01c6d627-6102-4850-a756-2978545ac884&event=land&dnt=true

Domain: cdn1.lockerdomecdn.com
URL: https://cdn1.lockerdomecdn.com/tracking/quickenloans_lander.js

Domain: pixel.everesttech.net
URL: https://pixel.everesttech.net/1x1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=Wk13aXdBQUFBRkNScFFOdw&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__

Domain: psp.pushnami.com
URL: https://psp.pushnami.com/api/psp

Domain: psp.pushnami.com
URL: https://psp.pushnami.com/api/psp

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1691099841494&cv=11&fst=1691099841494&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&label=EVlnCPzHxqoBEIrJ_MwD&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&value=1&currency_code=USD&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/966730890/?random=1691099841510&cv=11&fst=1691099841510&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Domain: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-848879802&l=dataLayer&cx=c

Domain: cm.everesttech.net
URL: https://cm.everesttech.net/cm/yh

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/700319321/?random=1691099841702&cv=11&fst=1691099841702&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10866179376/?random=1691099841732&cv=11&fst=1691099841732&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857412364/?random=1691099841765&cv=11&fst=1691099841765&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/865435318/?random=1691099841794&cv=11&fst=1691099841794&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/813495030/?random=1691099841823&cv=11&fst=1691099841823&bg=ffffff&guid=ON&async=1&gtm=45be3820&u_w=1600&u_h=1200&url=https%3A%2F%2Frefinance.quickenloans.com%2F%3Fpkey1%3D103%26pkey2%3D515%26pkey3%3De9e884c62a51464ba611391cf194b035%26sourceid%3Dlmb-54867-113582-103%26sid%3D9%26cmpid%3D9%26crtid%3D%26oid%3D9%26affid%3D103%26_ef_transaction_id%3De9e884c62a51464ba611391cf194b035&ref=https%3A%2F%2Fdsa.bio%2F&hn=www.googleadservices.com&frm=0&tiba=Refinance%20Mortgage%2C%20Refinancing%20Rates%2C%20Mortgage%20Rates&auid=260894560.1691099841&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

37 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
gmail.us10.list-manage.com/	1970-01-20 22:30:35	Name: _mcid Value: 1.93a5f982e9ea3149571e13d38102c54d.84264ef09243b7868deb57e70378e4037bcd56b6a138aae3100a68c0f368b852
.list-manage.com/	1970-01-20 22:30:35	Name: _abck Value: 1C1813E2ACE0E0936AB0940384C8A898~-1~YAAQXDe50AKUcLeJAQAAArJnvQrhaUSyHsVLRa8D/XausMPjCbWI20/GayiIhfyDEeV5HME1mSBWW4pdtOVMQ71fB/zmuPA8XkfyddzbLHv4uTrF7iqIoOpVuYKqDiMavzBxkQhPfH6wmtxqLMg8hXdWI2xWswD3bOpmxGpoMcX/57dNQD1uYTrPff0wjIItUjixi2Nt9K4tVLdfCfu5dBh7EZcINkscdnjXCnse0WuWtyhaD2TvlvWqZTo1iOjtFSzq5OV7H7IYIDjciTqUxOE6tKhlamMm9AWRMIe6nbbi3fpQDd64NwOroWNsYlsHxtc/mpKPbENlXiWcwiyTrxXCyD6BToeK/Ce5Jre+kYJZ/6w26cmdHApB5ZQVSf0mrw==~-1~-1~-1
.us10.list-manage.com/	1970-01-20 13:45:07	Name: ak_bmsc Value: 3EBADFD53C2CFEC47039B2E18601829B~000000000000000000000000000000~YAAQXDe50AOUcLeJAQAAArJnvRS4/RJJY27V69jIaNipQgwNKr/NVOfaOnn/jsUVGtqJv/nRoduaUYnJ0u762JZxX4gqRI8LbQG5GfX/CJjYENRirnsfIupW5Dvy0lK/n4dBYBgOZiWdk3X54ekgojBlobEKkniC95V+dgDd4rycmdFX9nbKz479NqfL5w4LR9Aw43LG8Y+12D1S9Wqd7Gwv+9D5yzhcuux5r2507yh5JzxRQJywUrSPQS12ZktY18Zp+/L2UbVBLkEXmzfqKcZNIc3YA7lhcBXLQ7m8wvqzaY280OUGHFdKoP0D39AH5l84u9adp3HVFHi9Eo/uAxSrRGlu+n7VuuLdmWOhtFTfjWJs7IyJjPlxf/jFRE1moKkQVSUvQyS8M1cYzNQLifuqfg==
.list-manage.com/	1970-01-20 13:45:14	Name: bm_sz Value: 45BA2AEFDBDFCE7949454C8E5D3C70C2~YAAQXDe50ASUcLeJAQAAArJnvRRps9byTDIOJ6VF1xy38qZUbYdgLbcAvKsD3odFGHWy94igUiiG7RekJoW33dQ+nhnmerLxrOcF9yS5PlrvdIPS4hyBH3F294hsItpvwwB5tA0DlTKyYiiu68bbfOdfUPn5Ddu7Ex8YrMDNpPyCkalbqonk3a7L+UGfuaHTXxpb+J3RzkM+QN93usksIaGMCW/nI6c2s/HhZLfzOApqiVb04FezaXeAl75n9mG/OjQEUw2GJrGV9x3u2XRFS3GcOxvvrRR9b77C53AOYNjqKRxXGmWglg==~3159349~3422533
.suited45trk.com/	1969-12-31 23:59:59	Name: st Value: T+ANQgM6WhqU3xV4CYF1tWyIWl61JxYG/q+ol3fOSQo+75es7OyXZg==
.suited45trk.com/	1970-01-20 23:20:59	Name: tym Value: eaPiee/J8K61niCIs3hAsmyIWl61JxYG/q+ol3fOSQo+75es7OyXZg==
.suited45trk.com/	1970-01-20 14:28:11	Name: c4295 Value: T+ANQgM6WhqGYSMD/lnztY1ui8jMeKfaCbOGesJxelAE2HquX0EIrg==
www.lmbahsj2.com/	1970-01-20 13:46:26	Name: uniqueClick_FGXLG Value: 2cbb3904-1695-4619-9bfa-5891972e50f4:1691099838
www.lmbahsj2.com/	1970-01-20 15:54:35	Name: transaction_id Value: e9e884c62a51464ba611391cf194b035
refinance.quikcenioans.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 23486283a01df3b731623faa017af721
refinance.quickenloans.com/	1970-01-20 22:30:35	Name: visitorId Value: 6f3ed0ec-4ab9-487a-af90-fe4267e44b2c
refinance.quickenloans.com/	1970-01-20 13:55:04	Name: contentTarget Value: %7B%22sourceId%22%3A%22lmb-54867-113582-103%22%7D
.refinance.quickenloans.com/	1970-01-20 13:45:01	Name: __cf_bm Value: jBKxfS7iOHDfggiTPvl8QRHtm7FAB.fVKebvYWs.l_g-1691099839-0-Aeft1Uuow0OiFMQDX8edK9M0usnw8B/m/UqTNktEOTxeZPuCUaGxmVR/XnNdtM6+J2HaRYiLffz5yUSqsPHfEvg=
.quickenloans.com/	1969-12-31 23:59:59	Name: at_check Value: true
.demdex.net/	1970-01-20 18:04:11	Name: demdex Value: 25604498747523259433125248355605689836
refinance.quickenloans.com/	1970-01-20 13:45:00	Name: _dd_s Value: rum=0&expire=1691100740168
.quickenloans.com/	1969-12-31 23:59:59	Name: AMCVS_5D60123F5245B13E0A490D45%40AdobeOrg Value: 1
refinance.quickenloans.com/	1970-01-20 13:55:04	Name: click Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNGMxMmNlN2MtYmI0MC01NWFhLTliOTctNWE1YWUyOGY5NjY0IiwidmlzaXRvcklkIjoiNmYzZWQwZWMtNGFiOS00ODdhLWFmOTAtZmU0MjY3ZTQ0YjJjIiwic2Vzc2lvbklkIjoiY2ZmZWQzN2EtNjI5MS00YjVkLThjYWEtMTc4MzcxYmRiOTlkIiwicHVibGlzaGVyRGV2aWNlIjoiIiwicGtleTEiOiIxMDMiLCJwa2V5MiI6IjUxNSIsInBrZXkzIjoiZTllODg0YzYyYTUxNDY0YmE2MTEzOTFjZjE5NGIwMzUiLCJzb3VyY2VJZCI6ImxtYi01NDg2Ny0xMTM1ODItMTAzIiwic2lkIjoiOSIsImNtcGlkIjoiOSIsImNydGlkIjoiIiwib2lkIjoiOSIsImFmZmlkIjoiMTAzIiwiX2VmX3RyYW5zYWN0aW9uX2lkIjoiZTllODg0YzYyYTUxNDY0YmE2MTEzOTFjZjE5NGIwMzUiLCJhZ2UiOm51bGwsImRldmljZSI6bnVsbCwiZm9yY2VOYW1lcyI6bnVsbCwiZm9yY2VJcCI6bnVsbCwiZm9yY2VUZXN0SWRzIjpudWxsLCJpbnF1aXJ5SWQiOm51bGwsImlucXVpcnlTaWduYXR1cmUiOm51bGwsImlzVGVzdCI6bnVsbCwibGV2ZWxPZkVkdWNhdGlvbiI6bnVsbCwibW9pZCI6bnVsbCwicHJvcGVydHlTdGF0ZUNvZGUiOm51bGwsInJlc29sdXRpb24iOiIiLCJ0dFRyYWNlSWQiOm51bGwsInByb3ZpZGVySWQiOm51bGwsInFscyI6bnVsbCwic3RpZCI6bnVsbCwib3ZrZXkiOm51bGwsIm92cmF3IjpudWxsLCJvdm10YyI6bnVsbCwibW9ydGdhZ2VCYWxhbmNlUmFuZ2UiOm51bGwsImRhdGVOb3ciOjE2OTEwOTk4Mzk5OTAsInJhbmRvbU51bWJlciI6NzQ1MjEsIm1hcmtldGluZ09mZmVySWQiOm51bGwsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDIzLTA4LTAzVDIxOjU3OjIwLjA5MFoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL3JlZmluYW5jZS5xdWlja2VubG9hbnMuY29tIiwicHJlc2VudGF0aW9uTmFtZSI6IjI4NzA1MDBfTVNRTF9MUkVfTFBfMjAyMy0wNS0yNSIsImRlc3RpbmF0aW9uVXJsIjoiaHR0cHM6Ly9yZWZpbmFuY2UucXVpY2tlbmxvYW5zLmNvbS8_cGtleTE9MTAzJnBrZXkyPTUxNSZwa2V5Mz1lOWU4ODRjNjJhNTE0NjRiYTYxMTM5MWNmMTk0YjAzNSZzb3VyY2VpZD1sbWItNTQ4NjctMTEzNTgyLTEwMyZzaWQ9OSZjbXBpZD05JmNydGlkPSZvaWQ9OSZhZmZpZD0xMDMmX2VmX3RyYW5zYWN0aW9uX2lkPWU5ZTg4NGM2MmE1MTQ2NGJhNjExMzkxY2YxOTRiMDM1IiwidmVydGljYWxOYW1lIjoiTVNRTF9MUkVfTEFORElORyIsInJlZmVycmluZ1VyaSI6Imh0dHBzOi8vZHNhLmJpby8iLCJmbG93SWQiOiJNU1FMX0xSRV9MQU5ESU5HX1ZFUlRJQ0FMX0ZMT1dfMSIsInRlc3RJZCI6MjEyODE3MywiY2xpZW50SXBBZGRyZXNzIjoiMjYwMjpmZmM4OjE6MTo6NiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTUuMC41NzkwLjExMCBTYWZhcmkvNTM3LjM2IiwiYm90IjpmYWxzZSwiaWF0IjoxNjkxMDk5ODQwfQ.EbCH83ThN_GwsUiHsTCkuMRR5cPd6JhF198wA2jcZqZu8mfTaQMrn5q38tM41uQoMMyCzOu9IB0mxeu4RJClm9U2Lk2qb4nzWWVPUHQxKlqjgRD1P_byAAlH8pJ5tEhssJ1ycH3ZSWsBOHdk2bnqq6JmfNy8SgS4ZU-72zKWRXs
.amazon-adsystem.com/	1970-01-20 19:33:28	Name: ad-id Value: A4ZLeiERj0yLn8jEzeOwtv8
.amazon-adsystem.com/	1970-01-20 23:20:59	Name: ad-privacy Value: 0
.quickenloans.com/	1970-01-20 23:20:59	Name: s_ecid Value: MCMID%7C25771871258484444153103988683265962276
.quickenloans.com/	1970-01-20 23:20:59	Name: mbox Value: session#b9b1c9797d5149daa820ae0092c62758#1691101701\|PC#b9b1c9797d5149daa820ae0092c62758.34_0#1754344641
.everesttech.net/	1970-01-20 22:30:35	Name: everest_g_v2 Value: g_surferid~ZMwiwAAAAFCRpQNw
.quickenloans.com/	1970-01-20 15:54:35	Name: _gcl_au Value: 1.1.260894560.1691099841
.dpm.demdex.net/	1970-01-20 18:04:11	Name: dpm Value: 25604498747523259433125248355605689836
.quickenloans.com/	1970-01-20 23:20:59	Name: s_v12 Value: 1691099840560
.quickenloans.com/	1970-01-20 13:45:01	Name: s_v12_s Value: First%20Visit
.quickenloans.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.agkn.com/	1970-01-20 22:30:35	Name: ab Value: 0001%3Amj%2BXsndms8ErsCpfRnx4QmTCaHG6i229
.quickenloans.com/	1970-01-20 23:20:59	Name: _ga_WQ7TGZQSWQ Value: GS1.1.1691099840.1.0.1691099840.0.0.0
.quickenloans.com/	1970-01-20 23:20:59	Name: _ga Value: GA1.1.737025425.1691099841
.quickenloans.com/	1970-01-20 23:20:59	Name: AMCV_5D60123F5245B13E0A490D45%40AdobeOrg Value: 179643557%7CMCIDTS%7C19573%7CMCMID%7C25771871258484444153103988683265962276%7CMCAAMLH-1691704640%7C7%7CMCAAMB-1691704640%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1691107040s%7CNONE%7CMCAID%7CNONE%7CMCCIDH%7C-1435624826%7CMCSYNCSOP%7C411-19580%7CvVersion%7C5.5.0
.refinance.quickenloans.com/	1969-12-31 23:59:59	Name: Value: GA1.3.737025425.1691099841
.refinance.quickenloans.com/	1970-01-20 13:46:26	Name: _gid Value: GA1.3.316833095.1691099841
.refinance.quickenloans.com/	1970-01-20 13:44:59	Name: _gat_gtag_UA_3849768_74 Value: 1
.doubleclick.net/	1970-01-20 23:20:59	Name: IDE Value: AHWqTUl5oEW2S5gh43gbVtoaTrKkD5PH7KV1692DXN1_uEsSAo-r3WTxHFe7ivWmdI8
.demdex.net/	1970-01-20 18:04:11	Name: dextp Value: 21-1-1691099840428\|771-1-1691099840567\|1083-1-1691099840836\|1085-1-1691099840952\|1086-1-1691099841053

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://script.anura.io/response.json Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
ad.doubleclick.net
ads.anura.io
ads.revjet.com
adservice.google.com
alb.reddit.com
api.pushnami.com
assets.adobedtm.com
b-code.liadm.com
c.pmsrv.co
cdn.mortgage.quickenloans.com
cdn.taboola.com
cdn1.decide.dev
cdn1.lockerdomecdn.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
content.refinance.quickenloans.com
cs-cdn.deviceatlas.com
dpm.demdex.net
dsa.bio
fonts.googleapis.com
fonts.gstatic.com
gmail.us10.list-manage.com
googleads.g.doubleclick.net
pixel.everesttech.net
pixel.mathtag.com
pixel1083.everesttech.net
psp.pushnami.com
quicken.demdex.net
quickenloans.tt.omtrdc.net
refinance.quickenloans.com
refinance.quikcenioans.com
s.amazon-adsystem.com
s.pinimg.com
s.yimg.com
sc-static.net
script.anura.io
sgtm.lowermybills.com
somni.quickenloans.com
static-msql-prod.refinance.quickenloans.com
static.cloudflareinsights.com
suited45trk.com
tinyurl.com
trackpixel.refinance.quickenloans.com
trking2.com
widget.trustpilot.com
www.datadoghq-browser-agent.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
www.redditstatic.com
c.pmsrv.co
cdn1.decide.dev
cdn1.lockerdomecdn.com
cm.everesttech.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
pixel.everesttech.net
psp.pushnami.com
www.googletagmanager.com
13.32.151.107
13.32.195.219
135.148.151.160
151.101.193.140
151.101.193.44
172.217.13.130
172.217.13.166
172.217.13.98
18.160.10.241
18.165.98.105
199.188.200.56
2001:4860:4802:34::15
2001:4998:14:800::1000
23.192.50.210
23.52.161.201
2600:1418:a000:49d::1e80
2600:9000:2509:b800:8:8845:1500:93a1
2606:4700:10::ac43:1e1
2606:4700:3036::ac43:b54c
2606:4700:4400::6812:2345
2606:4700:4400::ac40:9bdf
2606:4700::6810:3865
2607:f8b0:4020:804::2003
2607:f8b0:4020:804::2008
2607:f8b0:4020:805::2004
2607:f8b0:4020:806::2002
2607:f8b0:4020:807::2002
2607:f8b0:4020:807::200a
2607:f8b0:4020:807::200e
2a03:2880:f012:10c:face:b00c:0:3
2a04:4e42:200::396
2a04:4e42:77::84
3.18.206.181
3.216.213.80
3.223.10.198
35.201.76.131
44.227.143.1
44.239.163.116
52.22.148.156
52.46.130.91
54.204.58.171
54.235.130.106
63.140.38.128
63.140.38.219
99.84.108.70
99.84.208.86
0c9273f8cc9dc38c3e03c9ed628bef99838d2847db172f608021f5f1729bd7a5
0cada708e119149edd948291e531ccce6385fe040e74e3bb4d482ec74bd3f22d
14510a6b195b06ee9dcca0194b02a77fd50239c7b65eb46da1efcb65581acd33
15a8cca63e2bef5cd07d65e641215a9ac9c8775281897770791dfbf6b97faa6f
1775d1af9f09d4e8665774e90493d6c8235d25867cff11bb2139b03b64c84289
1ef8b676943da5a052097007d8e7f47d3b3216a4ef8b1f5db32705f187d28c6e
1f8a0f8934a39dd0cf8070958124385b83e38b2965be076bee6470c0aac88532
23875f44871dee4adee475357b39e52e0447e1b88cf17ecc5a2e75adfe503470
2677ade12878022f72b418ea075be3a4fd528719383bc9f335af9ee9f9dd53a1
2843128d287da3614565182de89a84deb0e43fd049be6a4ed4d3a682bdd186c4
3775095b5023f3744c937e2588d989968a020a89e2d0dbe66b725ab55d12960a
4271182f88bdd24c04c139be25fa435a8ee7d84b36b69f6790a060db5ab1de71
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
48d0c1bd04d3f726b1a1d2ce7e5f67e6836180e2cb59f2e2fb030ce48c40658b
4bed1e78b60bf9e02ade39d2380fc1318c14b3b75636e1ba2792c96f96ff7ff3
4f1f80216a63e56ce52cb1660993e5688ed78059d87116de59c43e4c2839d18b
53a72b4f1864f7779c6556c01ae8b5c782dd29e7ebfb6b8599d76bfd5e5030a3
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
6425a5a18f90552004ebe3b2364ce327e076eae8ec26165b1de51341d59215dd
6596ea36bf758c2f1d6dd8d40249ab6dae02d46a4aa02c393d65acb0fab0866f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7579fea8b4d6ea390f1a708a3b08b08911f3df414f650fa850780d0b3211cab7
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7f4a787fc9a4b2a5aba8fb8cacef8408bbea999b0352565fda8fac6dc96f36e5
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
964d436ac0d805ae99afc68dcdc60871c8a771ae356d8648782ab260abb7be53
9a4168f8425763e4414c7193f476180e8cf9fa3dbef61eb6dac99e953b72ea08
9aa4a126271ddde3daa53496f063fbad5b2c55419d5080ac74ea2d7a1918b2e6
9cac4cd092da7ff57ba820f6fb5d6f2c57ce29edeb4a726e2f0fa7fb6c883640
a8a370038413886d430ec5ec0a54b6db03ada51ee7b4679fca41efa3d42c612d
acd67ad087fc6061dfdc4fb2c4ac89fb1cde0654225885b81a889dcbf75141d0
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
b01bd01687b15585b2740273c8c3c6674dd9f559cfe52eeffdf43b1f93a12d05
b58109431c3adc92bccc460ac5dc394dc4f0979d24656f7a52503e6c77709d0b
b671857a0e787569bbf9f03c7eabfd0b4bffbbd69e8ebc6a5a33635658d8aba2
bba2b84cec6052749e1723cd3c61a98e2bcdc38f852028f7bef1507ea13aab46
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c0f01de74623470f59785aaa43f62284e4135c4e7dcb28510e35c72ca9d2c00e
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c235f21017bcc11fcaa31d7dfd9855aaebcbf5f6d7ee9bf9f2e98a910907c391
c7e03a4130a53ccb26197c9ef685beb6ddc326c8a175bd9edca1c2b67f009def
cde44c4426c7e3043486c1b6f95e4ab538c0855cb4852367fcc040c825e5233a
ce9e5f3064f3fd1d335e4765478e5f356646d23497e7c079c7cf1d8ff58c946b
d67e275d853c297024837a57545bfa7dc91b3c3cfd71f865a9c696787dc87fe1
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
d7cb2c2f08454c0b1f346e0343bbf085b65da2d6b0997b5e12bbea90ed541be6
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e05e2c3adab298048b6b41999197900a6b00cb4dcb3a08f4cb520db2fa09596b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64954dc34e12c7190cc2338a54b07644ff0f102aa71cc7209bcbb49c3009f7c
e7cb1955427a9543b91cc0c7237f4603841f9ca5f439c2bc5fa8fdd1080e8f3d
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f011a623c11f90c8bc8431730b76286ab4a369af3c4bf92ab47032878761c8af
f09a1f55680dfd61629bce9cb7c51a4a73b6e81f7af441573b65f2550c27c9b0

refinance.quickenloans.com Open in urlscan Pro 2606:4700:4400::ac40:9bdf Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

106 Requests

72 %HTTPS

41 %IPv6

41 Domains

54 Subdomains

37 IPs

2 Countries

1947 kBTransfer

5530 kBSize

37 Cookies

18 Outgoing links

Page URL History

Redirected requests

106 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

refinance.quickenloans.com Open in urlscan Pro
2606:4700:4400::ac40:9bdf Public Scan

Screenshot
Live screenshot

Full Image

106
Requests

72 %
HTTPS

41 %
IPv6

41
Domains

54
Subdomains

37
IPs

2
Countries

1947 kB
Transfer

5530 kB
Size

37
Cookies

106 HTTP transactions
0 data transactions