urlscan.io logo urlscan.io
SecurityTrails logo

money.quickenloans.com Open in urlscan Pro
2606:4700::6812:b34  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ypf.soundestlink.com/link/6615a80be63ce9cc801b5a87/6615a7f2ca1cef99cbeacaa1/66032de882f723e04192d07e?signature=71af76...
Effective URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac...
Submission: On April 16 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 2 countries across 20 domains to perform 42 HTTP transactions. The main IP is 2606:4700::6812:b34, located in United States and belongs to CLOUDFLARENET, US. The main domain is money.quickenloans.com.
TLS certificate: Issued by GTS CA 1P5 on April 8th 2024. Valid for: 3 months.
This is the only time money.quickenloans.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 172.64.145.78 13335 (CLOUDFLAR...)
1 3 66.29.146.40 22612 (NAMECHEAP...)
1 1 34.36.162.171 396982 (GOOGLE-CL...)
1 1 35.201.76.131 396982 (GOOGLE-CL...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
6 2a02:26f0:350... 20940 (AKAMAI-ASN1)
4 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... ()
1 52.58.191.183 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
4 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 13.32.99.63 ()
1 13.33.218.24 ()
42 13
1    172.64.145.78 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)
ypf.soundestlink.com
3    66.29.146.40 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium227-5.web-hosting.com
grantlocate.org
1    34.36.162.171 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 171.162.36.34.bc.googleusercontent.com
www.npvnt7trk.com
1    35.201.76.131 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 131.76.201.35.bc.googleusercontent.com
www.lmbahsj2.com
2    2606:4700::6812:b34 (United States)

ASN13335 (CLOUDFLARENET, US)
money.quickenloans.com
6    2a02:26f0:3500:16::215:1484 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
use.typekit.net
4    2606:4700::6812:569 (United States)

ASN13335 (CLOUDFLARENET, US)
static-lre.refinance.enhancedrefinow.com
1    2606:4700::6812:469 (None, )

ASN- ()
cdn-refinance.enhancedrefinow.com
1    52.58.191.183 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-191-183.eu-central-1.compute.amazonaws.com
cs-cdn.deviceatlas.com
1    2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
4    2606:4700::6812:1c6d (United States)

ASN13335 (CLOUDFLARENET, US)
content.quickencompare.com
1    2606:4700::6812:d2b (United States)

ASN13335 (CLOUDFLARENET, US)
content.refinance.quickenloans.com
2    2a02:26f0:3500:16::215:1495 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
p.typekit.net
1    13.32.99.63 (None, )

ASN- ()
api.pushnami.com
1    13.33.218.24 (None, )

ASN- ()
www.datadoghq-browser-agent.com
Domain Requested by
6 use.typekit.net money.quickenloans.com
use.typekit.net
4 content.quickencompare.com money.quickenloans.com
static-lre.refinance.enhancedrefinow.com
4 static-lre.refinance.enhancedrefinow.com money.quickenloans.com
3 grantlocate.org 1 redirects
2 p.typekit.net use.typekit.net
2 money.quickenloans.com static-lre.refinance.enhancedrefinow.com
www.datadoghq-browser-agent.com
1 www.datadoghq-browser-agent.com money.quickenloans.com
1 api.pushnami.com money.quickenloans.com
1 content.refinance.quickenloans.com money.quickenloans.com
1 fonts.googleapis.com money.quickenloans.com
1 cs-cdn.deviceatlas.com money.quickenloans.com
1 cdn-refinance.enhancedrefinow.com money.quickenloans.com
1 www.lmbahsj2.com 1 redirects cdn-refinance.enhancedrefinow.com
1 www.npvnt7trk.com 1 redirects
1 ypf.soundestlink.com 1 redirects
0 a44325.actonservice.com Failed grantlocate.org
0 bat.bing.com Failed grantlocate.org
0 www.googleadservices.com Failed cdn-refinance.enhancedrefinow.com
0 ads.revjet.com Failed grantlocate.org
0 cdn.taboola.com Failed grantlocate.org
0 static.ads-twitter.com Failed grantlocate.org
0 s.yimg.com Failed grantlocate.org
0 www.googletagmanager.com Failed cdn-refinance.enhancedrefinow.com
42 23

This site contains no links.

Subject Issuer Validity Valid
grantlocate.org
Sectigo RSA Domain Validation Secure Server CA		 2023-11-17 -
2024-11-17		 a year crt.sh
money.quickenloans.com
GTS CA 1P5		 2024-04-08 -
2024-07-07		 3 months crt.sh
use.typekit.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-02-01 -
2025-03-03		 a year crt.sh
enhancedrefinow.com
Cloudflare Inc ECC CA-3		 2024-01-31 -
2024-12-31		 a year crt.sh
*.deviceatlas.com
Go Daddy Secure Certificate Authority - G2		 2024-03-04 -
2025-04-05		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2024-03-04 -
2024-05-27		 3 months crt.sh
quickencompare.com
GTS CA 1P5		 2024-03-20 -
2024-06-18		 3 months crt.sh
refinance.quickenloans.com
Cloudflare Inc ECC CA-3		 2023-11-20 -
2024-11-19		 a year crt.sh
*.pushnami.com
Amazon RSA 2048 M02		 2024-02-03 -
2025-03-03		 a year crt.sh
*.datadoghq-browser-agent.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-12-12 -
2024-12-14		 a year crt.sh

This page contains 2 frames:

Primary Page: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Frame ID: 42E3EE9E98EF1CA979F807210D47275D
Requests: 39 HTTP requests in this frame

Frame: https://s.yimg.com/wi/ytc.js
Frame ID: A13566AEF9073055A4DD87480BFA509F
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://ypf.soundestlink.com/link/6615a80be63ce9cc801b5a87/6615a7f2ca1cef99cbeacaa1/66032de882f723e04192d... HTTP 302
    http://grantlocate.org/QM?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+... HTTP 307
    https://grantlocate.org/QM?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+... HTTP 301
    https://grantlocate.org/QM/?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy... Page URL
  2. https://www.npvnt7trk.com/28KL61/3ZB15F/?sub1=grantlocator.org HTTP 302
    https://www.lmbahsj2.com/29PD1BG/97HM5R/?source_id=143&sub1=28&sub2=7e3b2301ed6d4c7bb16efba2d29a7155 HTTP 302
    https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • api\.pushnami\.com

Page Statistics

42
Requests

62 %
HTTPS

53 %
IPv6

20
Domains

23
Subdomains

13
IPs

2
Countries

562 kB
Transfer

1878 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ypf.soundestlink.com/link/6615a80be63ce9cc801b5a87/6615a7f2ca1cef99cbeacaa1/66032de882f723e04192d07e?signature=71af769d0432172238c9511238ef12a4268246ecfc37f0dc2010e1e7dbf9b183 HTTP 302
    http://grantlocate.org/QM?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend HTTP 307
    https://grantlocate.org/QM?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend HTTP 301
    https://grantlocate.org/QM/?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend Page URL
  2. https://www.npvnt7trk.com/28KL61/3ZB15F/?sub1=grantlocator.org HTTP 302
    https://www.lmbahsj2.com/29PD1BG/97HM5R/?source_id=143&sub1=28&sub2=7e3b2301ed6d4c7bb16efba2d29a7155 HTTP 302
    https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://ypf.soundestlink.com/link/6615a80be63ce9cc801b5a87/6615a7f2ca1cef99cbeacaa1/66032de882f723e04192d07e?signature=71af769d0432172238c9511238ef12a4268246ecfc37f0dc2010e1e7dbf9b183 HTTP 302
  • http://grantlocate.org/QM?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend HTTP 307
  • https://grantlocate.org/QM?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend HTTP 301
  • https://grantlocate.org/QM/?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend

42 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
grantlocate.org/QM/
Redirect Chain
  • https://ypf.soundestlink.com/link/6615a80be63ce9cc801b5a87/6615a7f2ca1cef99cbeacaa1/66032de882f723e04192d07e?signature=71af769d0432172238c9511238ef12a4268246ecfc37f0dc2010e1e7dbf9b183
  • http://grantlocate.org/QM?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend
  • https://grantlocate.org/QM?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend
  • https://grantlocate.org/QM/?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend
454 B
358 B 		Document
General
Check archive.org
Download Go to
Full URL
https://grantlocate.org/QM/?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
66.29.146.40 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium227-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
00cfc6d16ee8450caa113138c7bacb2e895ce091fb53b186131bfd0965aac150

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
content-encoding
br
content-length
192
content-type
text/html
date
Tue, 16 Apr 2024 04:41:27 GMT
last-modified
Tue, 02 Apr 2024 05:13:58 GMT
server
LiteSpeed
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed

Redirect headers

content-length
795
content-type
text/html
date
Tue, 16 Apr 2024 04:41:27 GMT
location
https://grantlocate.org/QM/?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend
server
LiteSpeed
x-turbo-charged-by
LiteSpeed
favicon.ico
grantlocate.org/ 		1 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://grantlocate.org/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
66.29.146.40 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium227-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://grantlocate.org/QM/?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Tue, 16 Apr 2024 04:41:27 GMT
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by
LiteSpeed
server
LiteSpeed
content-length
1251
content-type
text/html
Primary Request /
money.quickenloans.com/
Redirect Chain
  • https://www.npvnt7trk.com/28KL61/3ZB15F/?sub1=grantlocator.org
  • https://www.lmbahsj2.com/29PD1BG/97HM5R/?source_id=143&sub1=28&sub2=7e3b2301ed6d4c7bb16efba2d29a7155
  • https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=16...
35 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2606:4700::6812:b34 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4471eb0cf01cbf5cab7a0d9df76132fac22c4c289274fa0f679490040e20b10
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://grantlocate.org/QM/?omnisendContactID=66032de882f723e04192d07e&utm_campaign=campaign%3A+Copy+of%3A+PL+%286615a543c3d93dc37a49c369%29&utm_medium=email&utm_source=omnisend
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-store
cf-cache-status
DYNAMIC
cf-ray
875180dbfc4130c4-FRA
content-encoding
gzip
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
content-type
text/html; charset=utf-8
date
Tue, 16 Apr 2024 04:41:31 GMT
referrer-policy
same-origin
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

accept-ch
Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
323
content-type
text/html; charset=utf-8
date
Tue, 16 Apr 2024 04:41:30 GMT
location
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
server
nginx
vary
Origin
via
1.1 google
x-eflow-request-id
f966889a-5141-445b-8a1c-732cf8bbcab4
dcq8kbe.css
use.typekit.net/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/dcq8kbe.css
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
9afdd14bf99da6623d565f70abb79f9e9e865c0b632e53e96db05d9b7f1113b8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Tue, 16 Apr 2024 04:41:31 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
884
main.a8a315127ec4d21f77b5.css
static-lre.refinance.enhancedrefinow.com/ 		182 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static-lre.refinance.enhancedrefinow.com/main.a8a315127ec4d21f77b5.css
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
961ca27274d763ccb9fbc880f94e6e81c490c12fad73ce55aef0a938b9e5420f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
via
1.1 85ca8c4198fb707d10ecc2a784a315be.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
strict-transport-security
max-age=2592000
x-amz-cf-pop
FRA56-P7
age
6436
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
last-modified
Wed, 27 Mar 2024 14:38:36 GMT
server
cloudflare
etag
W/"66261baf7603e204ab337f6ce3a39952"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
public, max-age=14400
cf-ray
875180e47aa88ff5-FRA
x-amz-cf-id
Zn-UJvseCETZCv3Y5DCUk37zuRirGHQUfWg0VO02Mv0B2nDsE61hVw==
expires
Tue, 16 Apr 2024 08:41:31 GMT
pixel-3e3389ba7179a6f144fa.js
cdn-refinance.enhancedrefinow.com/ 		139 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-refinance.enhancedrefinow.com/pixel-3e3389ba7179a6f144fa.js
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:469 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
e1f94b013efaf16a82a89df7fec74886ed3b42badc3f54b74f89e1a7fb6f922c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:32 GMT
strict-transport-security
max-age=2592000
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
gzip
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-dns-prefetch-control
off
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Thu, 11 Apr 2024 21:10:57 GMT
server
cloudflare
etag
W/"22b26-18eceffdabc"
x-download-options
noopen
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=14400
cf-ray
875180e47dba68f5-FRA
expires
Tue, 16 Apr 2024 08:41:32 GMT
dacs.js
cs-cdn.deviceatlas.com/ 		21 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cs-cdn.deviceatlas.com/dacs.js
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
52.58.191.183 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-191-183.eu-central-1.compute.amazonaws.com
Software
nginx/1.17.9 /
Resource Hash
145029bd46ef6268a3683431599d1cc5e9b0153c2c5bf840f931e78da99ee2a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
strict-transport-security
max-age=31536000
last-modified
Wed, 24 Jan 2024 11:56:56 GMT
server
nginx/1.17.9
accept-ch
DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data
etag
"cfe6e4ceafbea9f6e6c1edad91770ce9"
x-cache
HIT
content-type
application/javascript
cache-control
no-cache
accept-ranges
bytes
content-length
21896
expires
Tue, 16 Apr 2024 04:41:30 GMT
css2
fonts.googleapis.com/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Montserrat:wght@400;500;700&display=swap
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2ceb044fbea6e5616887f79557f76fe8b1053593d01b862aa3d50f986d9ac272
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Tue, 16 Apr 2024 04:41:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 16 Apr 2024 04:07:20 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 16 Apr 2024 04:41:31 GMT
msd8xng.css
use.typekit.net/ 		3 KB
904 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/msd8xng.css
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
3635c063f773018b9e6952a3fd5fa0952f92d3caf23d9988e2521e81597c6a6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Tue, 16 Apr 2024 04:41:31 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
681
ql_logo.svg
content.quickencompare.com/qlpln/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.quickencompare.com/qlpln/ql_logo.svg
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a92ed9fc3a0e4248ece6c83014a40c1a07f7f4f05934d9449383e2c220b9dafe
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
via
1.1 d01ad8df731d3f120823f9e20df55146.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
gzip
strict-transport-security
max-age=2592000
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
last-modified
Mon, 15 Apr 2024 10:16:58 GMT
server
cloudflare
etag
W/"eea100e4a26adee86914e2dd622d33ae"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
public, max-age=14400
cf-ray
875180e47f4937ce-FRA
x-amz-cf-id
re8FFK8J86vUqDxMLB9GSQaQa20gP3p8Q88D55Lyl1Y2uBtUwjuR0A==
expires
Tue, 16 Apr 2024 08:41:31 GMT
dollar-money-icon-small.svg
content.quickencompare.com/nmn/logo/ 		7 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.quickencompare.com/nmn/logo/dollar-money-icon-small.svg
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a6f8d6721cb9284a4edfca184bc8ea84b0f07165435686528c19eda52923265
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
via
1.1 57eb57a4c7d431365ab5b2e18c495bf4.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
content-encoding
gzip
strict-transport-security
max-age=2592000
x-amz-cf-pop
FRA56-P6
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
last-modified
Mon, 11 Mar 2024 13:46:58 GMT
server
cloudflare
etag
W/"3b280fb1b5f603b076383e1ca6ea531f"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
public, max-age=14400
cf-ray
875180e47f4b37ce-FRA
x-amz-cf-id
xnDqrtohPeImusKxZRQgFLifNCha8uLxRPAzHqwIEKM-c4NeOd-MfQ==
expires
Tue, 16 Apr 2024 08:41:31 GMT
Testimonial_Stars_-_LMB_LRE_FNL_00015.png
content.refinance.quickenloans.com/msql/ 		551 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
via
1.1 22ec86e3f4ec676e17ef8eea76eefba2.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
strict-transport-security
max-age=2592000
x-amz-cf-pop
FRA56-P6
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Hit from cloudfront
content-length
551
x-xss-protection
1; mode=block
last-modified
Mon, 11 Mar 2024 13:46:57 GMT
server
cloudflare
etag
"90732fd581b4624530c995d70d3f17a8"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
875180e5489f3a90-FRA
x-amz-cf-id
-zbdD2oglWky8bxLRN5ebm95OFLYE4br3on1tIzmAJLPEJQMzm0nVA==
expires
Tue, 16 Apr 2024 08:41:31 GMT
qc-financial-control.png
content.quickencompare.com/nmn/logo/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.quickencompare.com/nmn/logo/qc-financial-control.png
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
442b0856c633c8a41e1566de5aea94873cfa27b85e74e2fb2df4c92b55ab5608
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
via
1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
MISS
strict-transport-security
max-age=2592000
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Hit from cloudfront
content-length
12630
x-xss-protection
1; mode=block
last-modified
Mon, 15 Apr 2024 10:16:57 GMT
server
cloudflare
etag
"d9164fb30114b13fdb91bd8011b5f71b"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
875180e50f9e37ce-FRA
x-amz-cf-id
aeqLZJQ4eftDhTknv6wHQEeXe_2Tm2SCdvpByEsgIniXItMEZ71w0A==
expires
Tue, 16 Apr 2024 08:41:31 GMT
main.a8a315127ec4d21f77b5.js
static-lre.refinance.enhancedrefinow.com/ 		743 KB
129 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static-lre.refinance.enhancedrefinow.com/main.a8a315127ec4d21f77b5.js
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
966446899ff9ab1047dfb49ecf7c6956dc2887ca58ae41af63912a023dc822f8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
via
1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
strict-transport-security
max-age=2592000
x-amz-cf-pop
FRA56-P7
age
6436
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
last-modified
Wed, 27 Mar 2024 14:38:36 GMT
server
cloudflare
etag
W/"8156832add5e8628cf2bb24929ccbd44"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
875180e58bbe8ff5-FRA
x-amz-cf-id
USYN36BZnGaHbasrqNPajuKpywL7vC9Z1BjYL10ECYN7N_YwsLkzUA==
expires
Tue, 16 Apr 2024 08:41:31 GMT
manifest.ad8904c83a912006e10f.js
static-lre.refinance.enhancedrefinow.com/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static-lre.refinance.enhancedrefinow.com/manifest.ad8904c83a912006e10f.js
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96acf36eb8b5e5dca414bf96d3f8ea951a43b878ce970e8d7dd734e98ba8fd69
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
via
1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
strict-transport-security
max-age=2592000
x-amz-cf-pop
FRA56-P7
age
6437
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
last-modified
Wed, 27 Mar 2024 14:38:36 GMT
server
cloudflare
etag
W/"663602e058dc07911cf2893d64b5dda2"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
875180e5fc108ff5-FRA
x-amz-cf-id
0DYz4BrGwuaxaNA7OyHm_8IV4ij7Bl7YiK3KoF6ewUjJpypYHxpOTg==
expires
Tue, 16 Apr 2024 08:41:31 GMT
vendor.65d32a6f3f96dc9a4904.js
static-lre.refinance.enhancedrefinow.com/ 		410 KB
129 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static-lre.refinance.enhancedrefinow.com/vendor.65d32a6f3f96dc9a4904.js
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfa16554d9555d746e2f29ae6c897348ed2ab018c0f38116f524579c0c414ff8
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:31 GMT
content-encoding
gzip
via
1.1 2ca7ff1df9f3e8dc634c0ad867d837f2.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-content-type-options
nosniff
strict-transport-security
max-age=2592000
x-amz-cf-pop
CDG53-C1
age
6436
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
last-modified
Tue, 05 Mar 2024 11:12:59 GMT
server
cloudflare
etag
W/"43a2b236fe13a03c0e0e9b645e426c79"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
875180e61c398ff5-FRA
x-amz-cf-id
4_u_sV3hJGwyglGJO75LD_xeCD2_DAiTmvriXpbovAPQBUmgtbl5IQ==
expires
Tue, 16 Apr 2024 08:41:31 GMT
p.css
p.typekit.net/ 		5 B
172 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://p.typekit.net/p.css?s=1&k=dcq8kbe&ht=tk&f=6844.6845.6846.6847.6848.6851.6852.6853&a=176595194&app=typekit&e=css
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/dcq8kbe.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://use.typekit.net/dcq8kbe.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:32 GMT
last-modified
Fri, 23 Jun 2023 17:09:47 GMT
server
nginx
etag
"6495d1db-5"
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
5
5f0797b42693b80012279f39
api.pushnami.com/scripts/v1/pushnami-adv/ 		298 B
499 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.pushnami.com/scripts/v1/pushnami-adv/5f0797b42693b80012279f39
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.63 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
57f3c4164467441afe6981ddfe7c0f9f1b10cb739f5cf49fd217c79f70c76210

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:33 GMT
content-encoding
gzip
via
1.1 b4904c5988fd0eaae341a12cc47f3766.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
vary
accept-encoding
x-cache
Miss from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
no-cache
x-amz-cf-id
-Bjs6H88CM8V-ZqABTuYFArZOA5WtgwcZLTh5cJmqZsNB_PSPSAN-g==
datadog-rum-v3.js
www.datadoghq-browser-agent.com/ 		115 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.datadoghq-browser-agent.com/datadog-rum-v3.js
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.218.24 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:01 GMT
content-encoding
br
via
1.1 43244f77affffa1d8942dd025413b8d8.cloudfront.net (CloudFront)
last-modified
Mon, 03 Jan 2022 16:36:14 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P10
age
46
etag
W/"647fda9a4d3d74344732d76cf1fff47c"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=14400, s-maxage=60
timing-allow-origin
*
x-amz-cf-id
_PD-pBw3CUCg1PQKllE01emzXj7Tb5uAzMmbRoCNSM5jKtepheosfg==
p.css
p.typekit.net/ 		5 B
172 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://p.typekit.net/p.css?s=1&k=msd8xng&ht=tk&f=37513.37518.37522&a=121980931&app=typekit&e=css
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/msd8xng.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://use.typekit.net/msd8xng.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:32 GMT
last-modified
Fri, 23 Jun 2023 17:09:47 GMT
server
nginx
etag
"6495d1db-5"
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
5
visitor
money.quickenloans.com/ 		231 B
331 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://money.quickenloans.com/visitor
Requested by
Host: static-lre.refinance.enhancedrefinow.com
URL: https://static-lre.refinance.enhancedrefinow.com/vendor.65d32a6f3f96dc9a4904.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2606:4700::6812:b34 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f17811b9185c56ce5e90e7236b4f1eba063f3f3a5e1929962f8817e373efef41
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json
Accept
application/json, text/plain, */*
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:33 GMT
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-dns-prefetch-control
off
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
cloudflare
etag
W/"e7-3s5EXBfJor/Q7ggj6Es7ny59t+I"
x-download-options
noopen
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
no-store
cf-ray
875180ecbabd30c4-FRA
BG-BLUE-ICON-WHITE.png
content.quickencompare.com/qc/refi-images/ 		59 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.quickencompare.com/qc/refi-images/BG-BLUE-ICON-WHITE.png
Requested by
Host: static-lre.refinance.enhancedrefinow.com
URL: https://static-lre.refinance.enhancedrefinow.com/main.a8a315127ec4d21f77b5.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
78f6112cc353f90b0f71f3b1c2a5571b1b620290dd2048dc073eb91217c590e7
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://static-lre.refinance.enhancedrefinow.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:32 GMT
via
1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=2592000
x-amz-cf-pop
FRA56-P6
age
3474
x-amz-server-side-encryption
AES256
content-security-policy
frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-cache
Hit from cloudfront
content-length
60242
x-xss-protection
1; mode=block
last-modified
Mon, 18 Mar 2024 10:36:25 GMT
server
cloudflare
etag
"0b525d003df460ee3ef27bb82defdb43"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
875180ecbdef37ce-FRA
x-amz-cf-id
or9KZFML1zluz8K7Dv1hI9X36AQfGfPnigRfjY6VRQ3UvhyYInhp5g==
expires
Tue, 16 Apr 2024 08:41:32 GMT
l
use.typekit.net/af/cafa63/00000000000000000001709a/27/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/dcq8kbe.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
5461e0722bbe365dfa0df4652c60a6ced5f83c840d03021c4abd04ae9f9c6980

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://use.typekit.net/dcq8kbe.css
Origin
https://money.quickenloans.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:33 GMT
server
nginx
etag
"1500587fffa9a4bb64d06e988493ea23a02a484a"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
24272
l
use.typekit.net/af/80c5d0/00000000000000000001709c/27/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/80c5d0/00000000000000000001709c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/dcq8kbe.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
cc62200b7ffb4acffa5ced44e916789729b903e9a39bf86bb6175577500c9fc7

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://use.typekit.net/dcq8kbe.css
Origin
https://money.quickenloans.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:33 GMT
server
nginx
etag
"9852112d8099a97564f64224e106ceeffff9e7c4"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
24264
l
use.typekit.net/af/1b1b1e/00000000000000000001709e/27/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/dcq8kbe.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
9bacad71ca24f6147c4b72a6c0f351b07ba93b70f992082b812681fb3b46d9b6

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://use.typekit.net/dcq8kbe.css
Origin
https://money.quickenloans.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:33 GMT
server
nginx
etag
"f507d4945327bf77fa226b6fef0f1c6a6af3bf09"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
24180
l
use.typekit.net/af/d32e26/00000000000000000001709b/27/ 		24 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/d32e26/00000000000000000001709b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/dcq8kbe.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
6069bebbfc9a535fa8bf81fa81ce8741f6cef9e5fefd807aa1710a365cfed798

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://use.typekit.net/dcq8kbe.css
Origin
https://money.quickenloans.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 16 Apr 2024 04:41:33 GMT
server
nginx
etag
"9689d00c5dfd98cdda07ad0f85b16f1599038e27"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
25016
/
money.quickenloans.com/app-configuration/ 		0
0
71643990-3fbc-4844-8c79-e67f62ee7e82
https://money.quickenloans.com/ 		26 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://money.quickenloans.com/71643990-3fbc-4844-8c79-e67f62ee7e82
Requested by
Host: money.quickenloans.com
URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Length
26149
Content-Type
track
money.quickenloans.com/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
everflow.js
www.lmbahsj2.com/scripts/sdk/ 		0
0
ytc.js
s.yimg.com/wi/ Frame A135 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
uwt.js
static.ads-twitter.com/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
tfa.js
cdn.taboola.com/libtrc/unip/1522456/ Frame A135 		0
0
analytics
ads.revjet.com/ Frame A135 		0
0
conversion.js
www.googleadservices.com/pagead/ 		0
0
bat.js
bat.bing.com/ 		0
0
44325
a44325.actonservice.com/cdnr/forpci43/acton/bn/tracker/ 		0
0
favicon.ico
content.quickencompare.com/qlpln/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
money.quickenloans.com
URL
https://money.quickenloans.com/app-configuration/?path=/lendingLeadGen/fraud/anura/enabled
Domain
money.quickenloans.com
URL
https://money.quickenloans.com/track
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-319191520
Domain
www.lmbahsj2.com
URL
https://www.lmbahsj2.com/scripts/sdk/everflow.js
Domain
s.yimg.com
URL
https://s.yimg.com/wi/ytc.js
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-11411986938
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-320492720
Domain
static.ads-twitter.com
URL
https://static.ads-twitter.com/uwt.js
Domain
www.googletagmanager.com
URL
https://www.googletagmanager.com/gtag/js?id=AW-10865694633
Domain
cdn.taboola.com
URL
https://cdn.taboola.com/libtrc/unip/1522456/tfa.js
Domain
ads.revjet.com
URL
https://ads.revjet.com/analytics?acu=6680
Domain
www.googleadservices.com
URL
https://www.googleadservices.com/pagead/conversion.js
Domain
bat.bing.com
URL
https://bat.bing.com/bat.js
Domain
a44325.actonservice.com
URL
https://a44325.actonservice.com/cdnr/forpci43/acton/bn/tracker/44325
Domain
content.quickencompare.com
URL
https://content.quickencompare.com/qlpln/favicon.ico

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Domain/Path Name / Value
www.npvnt7trk.com/ Name: uniqueClick_3ZB15F
Value: ca798e3b-80d3-4b26-b9a1-cf9ac5e3495a:1713242489
www.npvnt7trk.com/ Name: transaction_id
Value: 7e3b2301ed6d4c7bb16efba2d29a7155
www.lmbahsj2.com/ Name: uniqueClick_97HM5R
Value: cf8987f2-3ad2-4a1e-9479-5aad39fbea80:1713242490
www.lmbahsj2.com/ Name: transaction_id
Value: 98607f76071c414698d07793a25c29ac
money.quickenloans.com/ Name: visitorId
Value: 23e182e2-4ce1-4012-8102-1f167ad45a72
money.quickenloans.com/ Name: sourceId
Value: affl_everflow_ql-mon_166_809
money.quickenloans.com/ Name: connect.sid
Value: s%3AIs279_twCICTDtYOyXl6S1dN3ErAkHZA.A01ZJXMHjJ5ROpITHEKe2iU0yNayvX%2BXsAl%2FO77Fnd0
money.quickenloans.com/ Name: BIGipServerpl.prod-lreernwapp-lnd
Value: !aIsNE9h1PNRFRK2uMIlwIfJZLuI8PnWpvYzChd4dnyak8ZWEWxoYaBCNoXxIpkH6UwJ11fNDZt2G6g==
.money.quickenloans.com/ Name: __cf_bm
Value: bDqb3D_3n8zlaRIhlRTlpqDldLoJqM2IKM0jXz0TWFQ-1713242491-1.0.1.1-HCx9iHYNOnZuIyTB7I0SoNRGlmAQHH_NHcG8cU8S.80Xa8wQkEuO6weO3C90ZeiILThss7nBTU.vuCzgO4d93Q
.enhancedrefinow.com/ Name: __cf_bm
Value: uwumu5yIobCRaXotTwvaPM9L2aBkXxtnCwGr4T8QPu0-1713242491-1.0.1.1-hWBGryI21g4K8CKJ6XqczVDcttTDQRCc06PMEYz_fkAtvPNN9jeQZkO2OmatMlhc6PeZqDP9lqucNbdLvwJ9rA
.quickencompare.com/ Name: __cf_bm
Value: RbDfF4nJ3GJknvgvYkTxF.RyeoRwD0I1ZicX8sEU7NU-1713242491-1.0.1.1-esDydsKyE_dp2NckmYrPvB1w1yYFWU9qDtV1HdLTwQpPnt5DLAmwD19XnRzThlXqiWAecTDAXHTIaarxTm15Bw
.refinance.quickenloans.com/ Name: __cf_bm
Value: mGWSzcV682ulT8jSL9gCNMxLfyWWcOCaL4WqS.k5VY8-1713242491-1.0.1.1-5Zg06eYaQOREMj9n9EKakTy8MCXhRCzW.KPJ3I.pFxhKkjJ6PWCpw84qiAMbsWRX1EJKiWimhQoDxGlJ5ZCmwQ

10 Console Messages

Source Level URL
Text
network error URL: https://grantlocate.org/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://money.quickenloans.com/?sourceid=affl_everflow_ql-mon_166_809&pkey1=809&pkey2=28&pkey3=98607f76071c414698d07793a25c29ac&pkey=7e3b2301ed6d4c7bb16efba2d29a7155&sid=166&cmpid=166&crtid=&oid=166&affid=809&_ef_transaction_id=98607f76071c414698d07793a25c29ac
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a44325.actonservice.com
ads.revjet.com
api.pushnami.com
bat.bing.com
cdn-refinance.enhancedrefinow.com
cdn.taboola.com
content.quickencompare.com
content.refinance.quickenloans.com
cs-cdn.deviceatlas.com
fonts.googleapis.com
grantlocate.org
money.quickenloans.com
p.typekit.net
s.yimg.com
static-lre.refinance.enhancedrefinow.com
static.ads-twitter.com
use.typekit.net
www.datadoghq-browser-agent.com
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
www.npvnt7trk.com
ypf.soundestlink.com
a44325.actonservice.com
ads.revjet.com
bat.bing.com
cdn.taboola.com
content.quickencompare.com
money.quickenloans.com
s.yimg.com
static.ads-twitter.com
www.googleadservices.com
www.googletagmanager.com
www.lmbahsj2.com
13.32.99.63
13.33.218.24
172.64.145.78
2606:4700::6812:1c6d
2606:4700::6812:469
2606:4700::6812:569
2606:4700::6812:b34
2606:4700::6812:d2b
2a00:1450:4001:827::200a
2a02:26f0:3500:16::215:1484
2a02:26f0:3500:16::215:1495
34.36.162.171
35.201.76.131
52.58.191.183
66.29.146.40
00cfc6d16ee8450caa113138c7bacb2e895ce091fb53b186131bfd0965aac150
145029bd46ef6268a3683431599d1cc5e9b0153c2c5bf840f931e78da99ee2a6
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
2ceb044fbea6e5616887f79557f76fe8b1053593d01b862aa3d50f986d9ac272
3635c063f773018b9e6952a3fd5fa0952f92d3caf23d9988e2521e81597c6a6b
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
442b0856c633c8a41e1566de5aea94873cfa27b85e74e2fb2df4c92b55ab5608
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
5461e0722bbe365dfa0df4652c60a6ced5f83c840d03021c4abd04ae9f9c6980
57f3c4164467441afe6981ddfe7c0f9f1b10cb739f5cf49fd217c79f70c76210
6069bebbfc9a535fa8bf81fa81ce8741f6cef9e5fefd807aa1710a365cfed798
78f6112cc353f90b0f71f3b1c2a5571b1b620290dd2048dc073eb91217c590e7
8a6f8d6721cb9284a4edfca184bc8ea84b0f07165435686528c19eda52923265
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
961ca27274d763ccb9fbc880f94e6e81c490c12fad73ce55aef0a938b9e5420f
966446899ff9ab1047dfb49ecf7c6956dc2887ca58ae41af63912a023dc822f8
96acf36eb8b5e5dca414bf96d3f8ea951a43b878ce970e8d7dd734e98ba8fd69
9afdd14bf99da6623d565f70abb79f9e9e865c0b632e53e96db05d9b7f1113b8
9bacad71ca24f6147c4b72a6c0f351b07ba93b70f992082b812681fb3b46d9b6
a4471eb0cf01cbf5cab7a0d9df76132fac22c4c289274fa0f679490040e20b10
a92ed9fc3a0e4248ece6c83014a40c1a07f7f4f05934d9449383e2c220b9dafe
b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be
cc62200b7ffb4acffa5ced44e916789729b903e9a39bf86bb6175577500c9fc7
cfa16554d9555d746e2f29ae6c897348ed2ab018c0f38116f524579c0c414ff8
e1f94b013efaf16a82a89df7fec74886ed3b42badc3f54b74f89e1a7fb6f922c
f17811b9185c56ce5e90e7236b4f1eba063f3f3a5e1929962f8817e373efef41