www.benefitsconf.com Open in urlscan Pro
3.212.8.231 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://lrp.omeclk.com/portal/wts/ugmcncmcfx%7Cba8mxaRqFehqPsD0qg89rv-mzGr9ya
Effective URL:
https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917...
Submission: On February 21 via manual (February 21st 2023, 4:50:53 pm UTC) from US — Scanned from DE

Summary HTTP 189 Redirects Links 49 Behaviour Indicators

Summary

This website contacted 61 IPs in 6 countries across 47 domains to perform 189 HTTP transactions. The main IP is 3.212.8.231, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.benefitsconf.com.
TLS certificate: Issued by Amazon on May 2nd 2022. Valid for: a year.

This is the only time www.benefitsconf.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	205.162.42.171 205.162.42.171	53866 (QTS-AS) (QTS-AS)
33	3.212.8.231 3.212.8.231	14618 (AMAZON-AES) (AMAZON-AES)
4	2600:9000:20e... 2600:9000:20eb:2200:1e:5cef:3780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.220.241.194 18.220.241.194	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6811:ba49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:230... 2600:9000:2304:be00:19:16e8:6c00:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:82f::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3031::ac43:9f5c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700::68... 2606:4700::6811:d4cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.216.43.24 52.216.43.24	16509 (AMAZON-02) (AMAZON-02)
4	13.32.110.88 13.32.110.88	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3030::ac43:b641	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.66.217 151.101.66.217	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:400d:806::2013	15169 (GOOGLE) (GOOGLE)
1	178.79.227.76 178.79.227.76	22822 (LLNW) (LLNW)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
6	54.204.247.164 54.204.247.164	14618 (AMAZON-AES) (AMAZON-AES)
1	18.66.15.8 18.66.15.8	16509 (AMAZON-02) (AMAZON-02)
2 21	204.180.130.190 204.180.130.190	53866 (QTS-AS) (QTS-AS)
2	2606:4700::68... 2606:4700::6810:5805	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
11	2a00:1450:400... 2a00:1450:400d:807::2004	15169 (GOOGLE) (GOOGLE)
6 9	52.51.88.84 52.51.88.84	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:1f97	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700:10:... 2606:4700:10::ac43:1ee1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9a55	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:46b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:e8cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:73b0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:400d:80d::2002	15169 (GOOGLE) (GOOGLE)
1	2600:9000:230... 2600:9000:2304:ae00:1f:1336:9b40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400d:807::200d	15169 (GOOGLE) (GOOGLE)
1	3.212.38.84 3.212.38.84	14618 (AMAZON-AES) (AMAZON-AES)
4	204.180.130.165 204.180.130.165	53866 (QTS-AS) (QTS-AS)
3	2a00:1450:400... 2a00:1450:400d:80c::2002	15169 (GOOGLE) (GOOGLE)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1 2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	142.250.180.226 142.250.180.226	15169 (GOOGLE) (GOOGLE)
1 2	185.89.210.90 185.89.210.90	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2606:4700::68... 2606:4700::6810:5905	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
1 3	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1	18.66.123.144 18.66.123.144	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:cccc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:400d:807::2002	15169 (GOOGLE) (GOOGLE)
8	205.162.42.5 205.162.42.5	53866 (QTS-AS) (QTS-AS)
2	98.98.134.242 98.98.134.242	21859 (ZEN-ECN) (ZEN-ECN)
1	2a04:4e42:41:... 2a04:4e42:41::159	54113 (FASTLY) (FASTLY)
2	2600:9000:211... 2600:9000:211a:2000:19:d5e0:9640:93a1	16509 (AMAZON-02) (AMAZON-02)
6	204.180.130.159 204.180.130.159	53866 (QTS-AS) (QTS-AS)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (STACKPATH...) (STACKPATH-CDN)
3	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:1e97	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	13.227.219.86 13.227.219.86	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700::68... 2606:4700::6813:9b53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
189	61

1 205.162.42.171 (Overland Park, United States) 1 redirects

ASN53866 (QTS-AS, US)
PTR: omeclk.com

lrp.omeclk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 3.212.8.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-8-231.compute-1.amazonaws.com

www.benefitsconf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:20eb:2200:1e:5cef:3780:93a1 (United States)

ASN16509 (AMAZON-02, US)

olytics.omeda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.220.241.194 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: captcha.snaphost.com

www.snaphost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:ba49 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2304:be00:19:16e8:6c00:93a1 (United States)

ASN16509 (AMAZON-02, US)

media-cdn.lrp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::ac43:9f5c (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.feathr.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:d4cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.216.43.24 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.32.110.88 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-110-88.vie50.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::ac43:b641 (United States)

ASN13335 (CLOUDFLARENET, US)

komito.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.217 (United States)

ASN54113 (FASTLY, US)

tag.perfectaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:806::2013 (Ireland)

ASN15169 (GOOGLE, US)

i.snoball.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.79.227.76 (Vienna, Austria)

ASN22822 (LLNW, US)
PTR: https-178-79-227-76.vie.llnw.net

up.pixel.ad	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.204.247.164 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-204-247-164.compute-1.amazonaws.com

polo.feathr.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.15.8 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-15-8.vie50.r.cloudfront.net

marco.feathr.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 204.180.130.190 (Lincolnshire, United States) 2 redirects

ASN53866 (QTS-AS, US)

sample.dragonforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
x.dragonforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5805 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:400d:807::2004 (Ireland)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 52.51.88.84 (Dublin, Ireland) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-88-84.eu-west-1.compute.amazonaws.com

pixel-geo.prfct.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1f97 (United States)

ASN13335 (CLOUDFLARENET, US)

signals.aimtell.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:10::ac43:1ee1 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.aimtell.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9a55 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:46b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e8cc (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:73b0 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:80d::2002 (Ireland)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2304:ae00:1f:1336:9b40:93a1 (United States)

ASN16509 (AMAZON-02, US)

lrp-conference-tweets-cdn.lrp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:807::200d (Ireland)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.212.38.84 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-38-84.compute-1.amazonaws.com

cs.choozle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 204.180.130.165 (Lincolnshire, United States)

ASN53866 (QTS-AS, US)

oqs.omeda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400d:80c::2002 (Ireland)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.180.226 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bud02s34-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.90 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5905 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.33.220.150 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.123.144 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-123-144.fra60.r.cloudfront.net

d1eoo1tco6rr5e.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:cccc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400d:807::2002 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 205.162.42.5 (Overland Park, United States)

ASN53866 (QTS-AS, US)
PTR: cdn.omeda.com

cdn.omeda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hostedcontent.dragonforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 98.98.134.242 (United States)

ASN21859 (ZEN-ECN, US)

pixel.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:41::159 (Vienna, Austria)

ASN54113 (FASTLY, US)

pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:211a:2000:19:d5e0:9640:93a1 (United States)

ASN16509 (AMAZON-02, US)

conversation.feathr.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 204.180.130.159 (Lincolnshire, United States)

ASN53866 (QTS-AS, US)
PTR: my.omedastaging.com

cdp.omeda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1e97 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.aimtell.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.227.219.86 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-86.ams54.r.cloudfront.net

analytics.aimtell.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6813:9b53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	benefitsconf.com www.benefitsconf.com	2 MB
25	dragonforms.com 2 redirects sample.dragonforms.com — Cisco Umbrella Rank: 64145 hostedcontent.dragonforms.com — Cisco Umbrella Rank: 52199 x.dragonforms.com — Cisco Umbrella Rank: 49414	194 KB
18	omeda.com olytics.omeda.com — Cisco Umbrella Rank: 20763 oqs.omeda.com — Cisco Umbrella Rank: 22274 cdn.omeda.com — Cisco Umbrella Rank: 36326 cdp.omeda.com — Cisco Umbrella Rank: 22171	259 KB
14	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4596 www.google.com — Cisco Umbrella Rank: 2 accounts.google.com — Cisco Umbrella Rank: 76	103 KB
13	gstatic.com www.gstatic.com fonts.gstatic.com	765 KB
10	feathr.co cdn.feathr.co — Cisco Umbrella Rank: 18189 polo.feathr.co — Cisco Umbrella Rank: 13227 marco.feathr.co — Cisco Umbrella Rank: 13739 conversation.feathr.co — Cisco Umbrella Rank: 209607	242 KB
9	prfct.co 6 redirects pixel-geo.prfct.co — Cisco Umbrella Rank: 14998	4 KB
5	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 77 googleads.g.doubleclick.net — Cisco Umbrella Rank: 41 cm.g.doubleclick.net — Cisco Umbrella Rank: 205	4 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 50	295 KB
4	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2191 forms.hubspot.com — Cisco Umbrella Rank: 3076	3 KB
4	google.de www.google.de — Cisco Umbrella Rank: 6232	733 B
4	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2923	11 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35	20 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 183
3	adsrvr.org 1 redirects insight.adsrvr.org — Cisco Umbrella Rank: 568 match.adsrvr.org — Cisco Umbrella Rank: 295	671 B
3	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 101
3	aimtell.io cdn.aimtell.io — Cisco Umbrella Rank: 6954	35 KB
3	aimtell.com 1 redirects signals.aimtell.com — Cisco Umbrella Rank: 4917 cdn.aimtell.com — Cisco Umbrella Rank: 6955 analytics.aimtell.com — Cisco Umbrella Rank: 16616	4 KB
3	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4008 forms-na1.hsforms.com — Cisco Umbrella Rank: 6306	4 KB
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 699	59 KB
2	sitescout.com pixel.sitescout.com — Cisco Umbrella Rank: 3568	267 B
2	adnxs.com 1 redirects secure.adnxs.com — Cisco Umbrella Rank: 385	2 KB
2	yahoo.com 1 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 273	494 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 106	239 B
2	amazonaws.com s3.amazonaws.com	14 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 149	136 KB
2	lrp.com media-cdn.lrp.com lrp-conference-tweets-cdn.lrp.com	127 KB
2	hsforms.net js.hsforms.net — Cisco Umbrella Rank: 5983	318 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 43	765 B
1	twimg.com pbs.twimg.com — Cisco Umbrella Rank: 754	2 KB
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3375	917 B
1	cloudfront.net d1eoo1tco6rr5e.cloudfront.net	661 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 316	239 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 420	273 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 617	396 B
1	choozle.com cs.choozle.com — Cisco Umbrella Rank: 7321	123 B
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3096	3 KB
1	hsleadflows.net js.hsleadflows.net — Cisco Umbrella Rank: 4202	87 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2076	21 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2081	16 KB
1	pixel.ad up.pixel.ad — Cisco Umbrella Rank: 8602	2 KB
1	snoball.it i.snoball.it — Cisco Umbrella Rank: 595954	62 KB
1	perfectaudience.com tag.perfectaudience.com — Cisco Umbrella Rank: 17471	4 KB
1	komito.net komito.net — Cisco Umbrella Rank: 105301	7 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2128	929 B
1	snaphost.com www.snaphost.com — Cisco Umbrella Rank: 895539	4 KB
1	omeclk.com 1 redirects lrp.omeclk.com — Cisco Umbrella Rank: 199887	378 B
189	47

	Domain	Requested by
33	www.benefitsconf.com	www.benefitsconf.com
15	sample.dragonforms.com	2 redirects www.benefitsconf.com sample.dragonforms.com code.jquery.com
11	www.google.com	www.benefitsconf.com js.hsforms.net www.gstatic.com www.google.com
10	www.gstatic.com	www.google.com www.gstatic.com
9	pixel-geo.prfct.co	6 redirects www.benefitsconf.com
6	x.dragonforms.com	sample.dragonforms.com
6	cdp.omeda.com	olytics.omeda.com
6	polo.feathr.co	cdn.feathr.co conversation.feathr.co
5	www.googletagmanager.com	www.benefitsconf.com www.googletagmanager.com js.hsadspixel.net
4	hostedcontent.dragonforms.com	sample.dragonforms.com
4	cdn.omeda.com	sample.dragonforms.com
4	oqs.omeda.com	olytics.omeda.com
4	www.google.de	www.benefitsconf.com
4	nexus.ensighten.com	www.googletagmanager.com nexus.ensighten.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.benefitsconf.com
4	olytics.omeda.com	www.benefitsconf.com sample.dragonforms.com
3	track.hubspot.com
3	fonts.gstatic.com	www.benefitsconf.com
3	www.googletagservices.com	olytics.omeda.com
3	pagead2.googlesyndication.com	olytics.omeda.com
3	cdn.aimtell.io	s3.amazonaws.com www.benefitsconf.com
2	code.jquery.com	sample.dragonforms.com
2	conversation.feathr.co	polo.feathr.co conversation.feathr.co
2	pixel.sitescout.com	www.benefitsconf.com
2	insight.adsrvr.org	1 redirects d1eoo1tco6rr5e.cloudfront.net
2	secure.adnxs.com	1 redirects www.benefitsconf.com
2	ups.analytics.yahoo.com	1 redirects www.benefitsconf.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	www.facebook.com	www.benefitsconf.com
2	forms.hsforms.com	js.hsforms.net www.benefitsconf.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	region1.analytics.google.com	www.googletagmanager.com
2	s3.amazonaws.com	www.benefitsconf.com
2	connect.facebook.net	www.benefitsconf.com connect.facebook.net
2	js.hsforms.net	www.benefitsconf.com js.hsforms.net
1	forms.hubspot.com	js.hsleadflows.net
1	analytics.aimtell.com	1 redirects
1	cdn.aimtell.com	s3.amazonaws.com
1	fonts.googleapis.com	conversation.feathr.co
1	match.adsrvr.org	www.benefitsconf.com
1	pbs.twimg.com	www.benefitsconf.com
1	api.hubapi.com	js.hsadspixel.net
1	d1eoo1tco6rr5e.cloudfront.net	nexus.ensighten.com
1	forms-na1.hsforms.com	www.benefitsconf.com
1	cm.g.doubleclick.net	1 redirects
1	pixel.rubiconproject.com	www.benefitsconf.com
1	us-u.openx.net	www.benefitsconf.com
1	analytics.twitter.com	www.benefitsconf.com
1	cs.choozle.com	www.benefitsconf.com
1	accounts.google.com	www.benefitsconf.com
1	lrp-conference-tweets-cdn.lrp.com	media-cdn.lrp.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hsleadflows.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hs-banner.com	js.hs-scripts.com
1	signals.aimtell.com	s3.amazonaws.com
1	marco.feathr.co	www.benefitsconf.com
1	up.pixel.ad	www.googletagmanager.com
1	i.snoball.it	www.googletagmanager.com
1	tag.perfectaudience.com	www.benefitsconf.com
1	komito.net	www.googletagmanager.com
1	js.hs-scripts.com	www.googletagmanager.com
1	cdn.feathr.co	www.benefitsconf.com
1	media-cdn.lrp.com	www.benefitsconf.com
1	www.snaphost.com	www.benefitsconf.com
1	lrp.omeclk.com	1 redirects
189	66

This site contains links to these domains. Also see Links.

Domain
www.xpressreg.net
hrexecutive.com
s23.a2zinc.net
www.snaphost.com
www.thehartford.com
www.color.com
www.vsp.com
www.hsabank.com
www.abbott.com
www.thenationalcouncil.org
twitter.com
t.co
www.linkedin.com
facebook.com
www.instagram.com
www.youtube.com
www.lrp.com
support.google.com
aimtell.com

Subject Issuer	Validity	Valid
benefitsconf.com Amazon	`2022-05-02` - `2023-05-31`	a year	crt.sh
*.omeda.com SSL.com RSA SSL subCA	`2022-06-24` - `2023-06-24`	a year	crt.sh
snaphost.com Sectigo RSA Domain Validation Secure Server CA	`2023-01-22` - `2024-01-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-15` - `2023-06-15`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
media-cdn.lrp.com Amazon	`2022-09-28` - `2023-10-26`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-12-01` - `2023-03-01`	3 months	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2022-12-06` - `2023-12-05`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh
*.perfectaudience.com GlobalSign Atlas R3 DV TLS CA 2022 Q3	`2022-10-09` - `2023-11-10`	a year	crt.sh
i.snoball.it GTS CA 1D4	`2023-01-12` - `2023-04-12`	3 months	crt.sh
*.pixel.ad GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2023-01-24` - `2024-02-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
polo.feathr.co R3	`2023-01-14` - `2023-04-14`	3 months	crt.sh
marco.feathr.co Amazon	`2022-08-22` - `2023-09-20`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
aimtell.com Cloudflare Inc ECC CA-3	`2022-05-09` - `2023-05-08`	a year	crt.sh
lrp.com Amazon	`2022-09-29` - `2023-10-27`	a year	crt.sh
accounts.google.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
*.choozle.com Amazon	`2022-05-18` - `2023-06-16`	a year	crt.sh
*.prfct.co GlobalSign RSA OV SSL CA 2018	`2022-10-28` - `2023-11-29`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2022-05-07` - `2023-05-07`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
*.sitescout.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2023-01-09` - `2024-02-02`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.feathr.co Amazon RSA 2048 M01	`2023-01-30` - `2024-02-28`	a year	crt.sh
*.google.de GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-02-01` - `2023-04-26`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 10 frames:

Primary Page: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Frame ID: 6B6171B2028937E5D49334D0DAE25429
Requests: 134 HTTP requests in this frame

Frame: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
Frame ID: 6BBCD49C1C8BED8B96376CB8C4E23B36
Requests: 18 HTTP requests in this frame

Frame: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
Frame ID: A745A7972E6AB75653C785D91052A13A
Requests: 18 HTTP requests in this frame

Frame: https://js.hsforms.net/forms/v2.js
Frame ID: FAB3E38DD3F009CD8D01F410991F5FF8
Requests: 1 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/ic6ljo0/hs1qnbi/iframe
Frame ID: B907C60DCF2A18A44B74D61B0013CE20
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cuYmVuZWZpdHNjb25mLmNvbTo0NDM.&hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&size=invisible&badge=inline&cb=9kubtbko5y8p
Frame ID: 2F53C5E7AB29D2B3BCACA170DBDBD8E3
Requests: 4 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cuYmVuZWZpdHNjb25mLmNvbTo0NDM.&hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&size=invisible&badge=inline&cb=9kubtbko5y8p
Frame ID: 5EB3AAACCA19D145C5C7B15FCF78398B
Requests: 4 HTTP requests in this frame

Frame: https://pixel.sitescout.com/dmp/asyncPixelSync
Frame ID: E0A8BC6D3B0C41448C8E2473B75E7B89
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
Frame ID: 6660CEA92B4E3B19B79941896F4836F9
Requests: 11 HTTP requests in this frame

Frame: https://conversation.feathr.co/45ca9e2/main.js
Frame ID: 037034053E73481C98D92DF3C8D4C59D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

HRE'S Health & Benefits Leadership Conference 2023

Page URL History Show full URLs

https://lrp.omeclk.com/portal/wts/ugmcncmcfx%7Cba8mxaRqFehqPsD0qg89rv-mzGr9ya HTTP 302
https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=ba... Page URL

Detected technologies

DreamWeaver (Editors) Expand

Overall confidence: 100%
Detected patterns

<!--[^>]*(?:InstanceBeginEditable|Dreamweaver([^>]+)target|DWLayoutDefaultTable)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Aimtell (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.aimtell\.\w+/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

<(?:iframe|img)[^>]+adnxs\.(?:net|com)
adnxs\.(?:net|com)

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

189
Requests

96 %
HTTPS

60 %
IPv6

47
Domains

66
Subdomains

61
IPs

6
Countries

4652 kB
Transfer

20728 kB
Size

32
Cookies

49 Outgoing links

These are links going to different origins than the main page.

URL: https://www.xpressreg.net/register/bene0523/xpresstoolkit/login.asp
Title: ATTENDEE RESOURCE CENTER

Search URL Search Domain Scan URL

URL: https://hrexecutive.com/category/benefitsandcompensation/health-benefits-leadership-conference-news/?utm_source=hblc&utm_medium=website&utm_campaign=bn22_website
Title: HBLC NEWS

Search URL Search Domain Scan URL

URL: https://s23.a2zinc.net/clients/LRP/BN23/Public/eventmap.aspx
Title: EXPO HALL FLOOR PLAN

Search URL Search Domain Scan URL

URL: https://s23.a2zinc.net/clients/LRP/BN23/Public/exhibitors.aspx
Title: EXHIBITOR LIST

Search URL Search Domain Scan URL

URL: https://s23.a2zinc.net/clients/LRP/BN23/Public/e_ExhibitorConsole.aspx
Title: EXHIBITOR PORTAL

Search URL Search Domain Scan URL

URL: https://www.snaphost.com/

Search URL Search Domain Scan URL

URL: https://www.thehartford.com/

Search URL Search Domain Scan URL

URL: https://www.color.com/

Search URL Search Domain Scan URL

URL: https://www.vsp.com/

Search URL Search Domain Scan URL

URL: http://www.hsabank.com/hsabank/homepage

Search URL Search Domain Scan URL

URL: https://www.abbott.com/

Search URL Search Domain Scan URL

URL: https://www.thenationalcouncil.org/

Search URL Search Domain Scan URL

URL: https://twitter.com/BenefitsConf
Title: @BenefitsConf

Search URL Search Domain Scan URL

URL: https://twitter.com/hashtag/BenefitsConf
Title: #BenefitsConf

Search URL Search Domain Scan URL

URL: https://twitter.com/HRExecMag
Title: @HRExecMag

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/search?q=%23InsightsfromaCHRO
Title: #InsightsfromaCHRO

Search URL Search Domain Scan URL

URL: https://twitter.com/Heineken_US
Title: @Heineken_US

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/search?q=%23BenefitsConf
Title: #BenefitsConf

Search URL Search Domain Scan URL

URL: https://t.co/RfWouP7NjD
Title: https://t.co/RfWouP7NjD

Search URL Search Domain Scan URL

URL: https://t.co/koiqCW4YXv
Title: https://t.co/koiqCW4YXv

Search URL Search Domain Scan URL

URL: https://t.co/B75g7zychK
Title: https://t.co/B75g7zychK

Search URL Search Domain Scan URL

URL: https://t.co/L9e2ma6zuo
Title: https://t.co/L9e2ma6zuo

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/search?q=%23benefits
Title: #benefits

Search URL Search Domain Scan URL

URL: https://t.co/k6AtKTwoju
Title: https://t.co/k6AtKTwoju

Search URL Search Domain Scan URL

URL: https://t.co/l4c1suX2k4
Title: https://t.co/l4c1suX2k4

Search URL Search Domain Scan URL

URL: https://t.co/GPFU26qAGA
Title: https://t.co/GPFU26qAGA

Search URL Search Domain Scan URL

URL: https://t.co/WhFWz263sY
Title: https://t.co/WhFWz263sY

Search URL Search Domain Scan URL

URL: https://t.co/1VMq06TziJ
Title: https://t.co/1VMq06TziJ

Search URL Search Domain Scan URL

URL: https://t.co/ZP3BIheZQr
Title: https://t.co/ZP3BIheZQr

Search URL Search Domain Scan URL

URL: https://t.co/YEmHbaNdUE
Title: https://t.co/YEmHbaNdUE

Search URL Search Domain Scan URL

URL: https://twitter.com/#!/search?q=%23HR
Title: #HR

Search URL Search Domain Scan URL

URL: https://t.co/pRG1LcTru0
Title: https://t.co/pRG1LcTru0

Search URL Search Domain Scan URL

URL: https://t.co/lOlD2MIp7s
Title: https://t.co/lOlD2MIp7s

Search URL Search Domain Scan URL

URL: https://t.co/pOPafvoHnN
Title: https://t.co/pOPafvoHnN

Search URL Search Domain Scan URL

URL: https://t.co/HH3NszH34l
Title: https://t.co/HH3NszH34l

Search URL Search Domain Scan URL

URL: https://t.co/zaNX97xRvu
Title: https://t.co/zaNX97xRvu

Search URL Search Domain Scan URL

URL: https://t.co/ST3P01tEQp
Title: https://t.co/ST3P01tEQp

Search URL Search Domain Scan URL

URL: https://t.co/boF9TjXcx1
Title: https://t.co/boF9TjXcx1

Search URL Search Domain Scan URL

URL: https://t.co/jeRhVKBT32
Title: https://t.co/jeRhVKBT32

Search URL Search Domain Scan URL

URL: https://t.co/A3hda4AVCr
Title: https://t.co/A3hda4AVCr

Search URL Search Domain Scan URL

URL: https://t.co/fluDJanzs4
Title: https://t.co/fluDJanzs4

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=%23BenefitsConf%20%40BenefitsConf
Title: Tweet #BenefitsConf @BenefitsConf

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/groups/4433176/profile

Search URL Search Domain Scan URL

URL: https://facebook.com/groups/579294169261414/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/benefitsconf/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJpLvLx5Hz6J5xwc_Ah2xbQ

Search URL Search Domain Scan URL

URL: http://www.lrp.com/?__hstc=101894535.63400161ffe975683cd51267dbe7ce38.1676998240192.1676998240192.1676998240192.1&__hssc=101894535.1.1676998240193&__hsfp=1878800189
Title: OTHER EVENTS

Search URL Search Domain Scan URL

URL: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=en
Title: changing your settings

Search URL Search Domain Scan URL

URL: https://aimtell.com/liked-our-push-notification-widget?domain=www.benefitsconf.com/&utm_source=aimtell&utm_medium=prompt&utm_campaign=17458&utm_content=type-3
Title: by Aimtell

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lrp.omeclk.com/portal/wts/ugmcncmcfx%7Cba8mxaRqFehqPsD0qg89rv-mzGr9ya HTTP 302
https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 40

https://sample.dragonforms.com/HBLCSignup_December2022?dragoniframe=true HTTP 302
https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Request Chain 41

https://sample.dragonforms.com/HBLCSignup_December2022?dragoniframe=true HTTP 302
https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Request Chain 73

https://pixel-geo.prfct.co/tagjs?a_id=172159&source=js_tag HTTP 302
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=172159&source=js_tag

Request Chain 95

https://pixel-geo.prfct.co/cs/?partnerId=twtr HTTP 302
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_roUVmyUA4loMJCicE

Request Chain 96

https://pixel-geo.prfct.co/cs/?partnerId=yah HTTP 302
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_roUVmyUA4loMJCicE&_origin=1 HTTP 302
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_roUVmyUA4loMJCicE&_origin=1&verify=true

Request Chain 97

https://pixel-geo.prfct.co/cs/?partnerId=opx HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_roUVmyUA4loMJCicE

Request Chain 98

https://pixel-geo.prfct.co/cs/?partnerId=rbcn HTTP 302
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_roUVmyUA4loMJCicE

Request Chain 99

https://pixel-geo.prfct.co/cs/?partnerId=goo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfcm9VVm15VUE0bG9NSkNpY0U HTTP 302
https://pixel-geo.prfct.co/cb?partnerId=goo

Request Chain 101

https://secure.adnxs.com/seg?t=2&add=29225097 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D29225097

Request Chain 110

https://insight.adsrvr.org/tags/ic6ljo0/hs1qnbi/iframe HTTP 303
https://d1eoo1tco6rr5e.cloudfront.net/ic6ljo0/hs1qnbi/iframe

Request Chain 177

https://analytics.aimtell.com/prompt-view?id_site=17458&prompt_type=3&prompt_id=4040 HTTP 302
https://s3.amazonaws.com/cdn.aimtell.com/prompt/pixel.jpg

189 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.benefitsconf.com/
Redirect Chain

https://lrp.omeclk.com/portal/wts/ugmcncmcfx%7Cba8mxaRqFehqPsD0qg89rv-mzGr9ya
https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

49 KB
12 KB

926ms
110ms

Document
text/html

3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 552dc1f313637549ce29efbc8ae81958a805e171b3447967f68f29362ca3f4b0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=2592000
content-encoding: gzip
content-length: 12039
content-type: text/html; charset=UTF-8
date: Tue, 21 Feb 2023 16:50:36 GMT
etag: "c40d-5f4c142527cbd-gzip"
expires: Thu, 23 Mar 2023 16:50:36 GMT
last-modified: Wed, 15 Feb 2023 18:29:22 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 21 Feb 2023 16:50:35 GMT
Keep-Alive: timeout=5
Location: https://www.benefitsconf.com?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Server: Apache
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

GET
H2 200 style.css
www.benefitsconf.com/ 11 KB
2 KB 113ms
112ms Stylesheet
text/css 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitsconf.com/style.css
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 690a73d63e9c4a96ce46d5753fb08c416ad9f30af239cf4a580a75317705ec35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
content-encoding: gzip
last-modified: Wed, 19 Oct 2022 15:34:04 GMT
server: Apache
etag: "2ba1-5eb64f04c56d2-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1997
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 olytics.css
olytics.omeda.com/olytics/css/v3/p/ 28 KB
3 KB 141ms
11ms Stylesheet
text/css 2600:9000:20eb:2200:1e:5cef:3780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/css/v3/p/olytics.css

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:2200:1e:5cef:3780:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

78057ff881c7ceb369c163fee7ab0d93ae4754f3a7503d5dbfd4a0b80e203a79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:33:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 1036
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 27 Aug 2021 04:05:28 GMT
server: Apache
etag: W/"28820-1630037128000"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=21600
accept-ranges: bytes
x-amz-cf-id: DPPufRgFcIzeC060dHInGaoz-D35qzG633dvuOClERnOGRw3NF3Puw==
expires: Sun, 19 Feb 2023 10:33:18 GMT

GET
H2 200 bootstrap.css
www.benefitsconf.com/css/ 203 KB
26 KB 219ms
218ms Stylesheet
text/css 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitsconf.com/css/bootstrap.css
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 6ac3cfaae4ec74e7e74d180ef0154743b47feaf8b41f8ad2e71c884e854eab6c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
content-encoding: gzip
last-modified: Thu, 30 Jan 2020 20:37:30 GMT
server: Apache
etag: "32a21-59d616d053680-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 26312
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 bootstrap.min.css
www.benefitsconf.com/css/ 157 KB
24 KB 216ms
215ms Stylesheet
text/css 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitsconf.com/css/bootstrap.min.css
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
content-encoding: gzip
last-modified: Wed, 17 Jun 2020 19:31:39 GMT
server: Apache
etag: "27293-5a84cb579885b-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 23845
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 bootstrap-grid.css
www.benefitsconf.com/css/ 66 KB
7 KB 111ms
110ms Stylesheet
text/css 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitsconf.com/css/bootstrap-grid.css
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 3cce063b8d8aa0c8eac285f21bd28ded1ebccb155d38bb056d36d5e93f7bd3e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
content-encoding: gzip
last-modified: Wed, 17 Jun 2020 19:31:35 GMT
server: Apache
etag: "10977-5a84cb53fdef0-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7118
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 bootstrap-reboot.css
www.benefitsconf.com/css/ 5 KB
2 KB 112ms
111ms Stylesheet
text/css 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitsconf.com/css/bootstrap-reboot.css
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e7542b0152212d7b7e4a83b159e557375a6bc566a6c1a9bfc688ce899f6457d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
content-encoding: gzip
last-modified: Wed, 17 Jun 2020 19:31:36 GMT
server: Apache
etag: "1284-5a84cb550ba90-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1699
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 CaptchaImage.aspx
www.snaphost.com/captcha/ 4 KB
4 KB 779ms
134ms Image
image/gif 18.220.241.194
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.snaphost.com/captcha/CaptchaImage.aspx?id=W66242YQXW8F
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.220.241.194 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: captcha.snaphost.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 47e2635ae2223f06b3d3269ec2fc9cb28626a3d2d9dcd8d467726677b36f7df1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
cache-control: private
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-length: 4221
content-type: image/gif; charset=utf-8

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ 509 KB
159 KB 84ms
39ms Script
application/javascript 2606:4700::6811:ba49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:ba49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5e470d918babacc4ffc6001009227fc3b3d6303f5e2738aed7a02c2e23628f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
x-amz-version-id: dZvLdX9P7w4t9flGoGjs6YWXCETUwiH4
via: 1.1 dfc1931cc62ecd4133c2b9bdae1bb476.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
age: 4
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2715/bundles/project-v2.js&cfRay=79d0fb4baa662c4b-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding: br
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 17 Feb 2023 05:17:00 UTC
server: cloudflare
etag: W/"d2b69dd4f64d2c0ab2d305cd7f4999b5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BLv79eFXOGQGpwPbPcKIhAhpRVdFXMXynoWHpdtJWhHkGGsWfTy%2BnDiPhcRsTeDgCT4olZPNiWnhX6BADEBd9lGQg4jKKm3IASXTURhmk7Xl%2Bi1CA0FFy%2FLbStVNQCc462iuDroXQBY3uPVe"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
cf-ray: 79d0fb6528442c2f-FRA
x-amz-cf-id: swD-sDIE3WAsvvunyuBz89lNJVNPGsGF1bLdiIr3S5i2hTudZ_DVmA==
x-hs-target-asset: forms-embed/static-1.2715/bundles/project-v2.js

GET
H2 200 bn23_carousel_secureyourpass.webp
www.benefitsconf.com/images/ 190 KB
190 KB 246ms
243ms Image
image/webp 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_carousel_secureyourpass.webp
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: b017b4f9fc315b4d2ee511bfd8e9031acb2baf1fa772bb5e04e90be3c759a826

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
last-modified: Mon, 13 Feb 2023 15:37:20 GMT
server: Apache
etag: "2f64e-5f4969f6cc1c7"
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 194126
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 bn23_carousel_gotyoucovered.webp
www.benefitsconf.com/images/ 193 KB
193 KB 245ms
242ms Image
image/webp 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_carousel_gotyoucovered.webp
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 14a5246760b47c071f0cc864d329b2d5785396992e89840d394c7c9ba3cd765a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
last-modified: Mon, 13 Feb 2023 15:37:50 GMT
server: Apache
etag: "30382-5f496a12fcf41"
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 197506
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 bn23_carousel_openingkeynote.webp
www.benefitsconf.com/images/ 137 KB
138 KB 245ms
243ms Image
image/webp 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_carousel_openingkeynote.webp
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 22f03a715af554edf5134e43b7a065bc7824c89a8958324c633e99b243c2e18d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
last-modified: Tue, 03 Jan 2023 19:23:24 GMT
server: Apache
etag: "224d2-5f16100666fb2"
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 140498
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 bn23_carousel_helpgettingapproval.webp
www.benefitsconf.com/images/ 186 KB
187 KB 245ms
243ms Image
image/webp 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_carousel_helpgettingapproval.webp
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: d0450eb893bf8d8eb93408cbe1a16a1d0ba2b6018a25dfdd4133168139d6f595

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:36 GMT
last-modified: Tue, 03 Jan 2023 19:23:42 GMT
server: Apache
etag: "2e8d4-5f161017fb4ab"
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 190676
expires: Thu, 23 Mar 2023 16:50:36 GMT

GET
H2 200 bn23_index_quotes_4.jpg
www.benefitsconf.com/images/ 163 KB
163 KB 306ms
304ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_index_quotes_4.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 152c2e4c0a662dd6ae6a1ca2cce86c993e9d74ca439cfc2f24d9dd8122c80f8a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Wed, 20 Apr 2022 16:44:22 GMT
server: Apache
etag: "28bb6-5dd18b499820e"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 166838
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bn23_index_quotes_5.jpg
www.benefitsconf.com/images/ 81 KB
82 KB 306ms
305ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_index_quotes_5.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: f6045b760a2df824771f9f73618ceea27b06198b603f6af2949a088c4ce5a4aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Mon, 09 May 2022 13:57:47 GMT
server: Apache
etag: "1458a-5de9497d2f7ce"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 83338
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 152 KB
56 KB 74ms
32ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

266aff3fc7e6ecb0744c9298682c8367d834de8820bc2068b31319935b474394

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56579
x-xss-protection: 0
last-modified: Tue, 21 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 21 Feb 2023 16:50:37 GMT

GET
H2 200 bn23_index_quotes_1.jpg
www.benefitsconf.com/images/ 161 KB
162 KB 226ms
221ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_index_quotes_1.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 54b0375303af2aaf27f66ad711ae7fafe8450c9c13f0bee02ea57fbc3179d64a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Mon, 03 Oct 2022 15:29:10 GMT
server: Apache
etag: "285dc-5ea2301585e75"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 165340
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bn23_index_quotes_3.jpg
www.benefitsconf.com/images/ 140 KB
140 KB 224ms
220ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_index_quotes_3.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: af16618be7ba8a002bf2025feb8e118fce2c600a9b11f26f6ef1adb6dc262bd4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Mon, 03 Oct 2022 15:28:48 GMT
server: Apache
etag: "22f77-5ea22fffe0026"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 143223
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bn23_index_quotes_6.jpg
www.benefitsconf.com/images/ 167 KB
167 KB 224ms
221ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_index_quotes_6.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: d42163676c92b69e2ee333240a22a1177407d468d203b2a36f9c33e0249194c9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Mon, 09 May 2022 14:13:28 GMT
server: Apache
etag: "29ae8-5de94cff1e8a9"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 170728
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bundle-b4-58b9106800.js Show response
media-cdn.lrp.com/ 435 KB
124 KB 509ms
43ms Script
application/javascript 2600:9000:2304:be00:19:16e8:6c00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://media-cdn.lrp.com/bundle-b4-58b9106800.js
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2304:be00:19:16e8:6c00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 459e1227107ccdcd4673ad029766cc0580b9ce4f009aada727b34f79ff0e429d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: gzip
via: 1.1 353b8eaf90b8d7986000f2da151952bc.cloudfront.net (CloudFront)
last-modified: Thu, 13 Aug 2020 18:27:32 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 27825
etag: W/"58b91068007fe2c9431bcd6cb48ec402"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: VDQf8RUG5-wIhu0mo4lc8y40KHvuFfsup-8Rzk1j9YjgICG_pNqGEw==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 62ms
18ms Script
text/javascript 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 21 Feb 2023 16:14:50 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 2147
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Tue, 21 Feb 2023 18:14:50 GMT

GET
H2 200 boomerang.min.js Show response
cdn.feathr.co/js/ 177 KB
53 KB 69ms
23ms Script
text/javascript 2606:4700:3031::ac43:9f5c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.feathr.co/js/boomerang.min.js
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:9f5c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbf923b4f029a2af65cfc2da7222670f6b4fd78c4b8888118fed5b11ee765960

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
x-amz-version-id: Zr93uu74l0PMqqqVrsHYWd9wSbolPgQw
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: SEMVPMT1NAY4NBAT
age: 5870
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: fYBov+FfEfFPC6nyDtoPn2u9JK3OfuR3/9WCMPykYwvXXakh/kYOuSrw/ax/AfT6QTtFhdQ9HxA=
last-modified: Wed, 07 Dec 2022 16:15:56 GMT
server: cloudflare
etag: W/"51d5b76c27d7ab6f3bb2e545bf73b2bf"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zw3%2F%2B3r6q5uHlHKP58btjomWYelo9%2BHW8zqiO7wBg7qjc2PdXqhTIIxSWYrNZeyfeTM3yOGU9W7LM2jfu%2FIoFaDtFMSwP96vQGGvfDkB71XvraKffMv3%2BQjwb8WJW9eti5HeEfKa3EzOBR1d"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 79d0fb65f8a45b2c-FRA

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 106 KB
28 KB 54ms
13ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

dca9b6afcb6c37d6a32456973fe5f2986a348a70d11774e102de6fc420992a19

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 21 Feb 2023 16:50:37 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27843
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: DaqtCeBN452Zq/xyaM8yHfu8B++b4eTdOuBbzz4hdm9tFwBxDSyVHqSfYZFEUDvNkCp48VqjJRFXGDIuTk9zkQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 4487427.js Show response
js.hs-scripts.com/ 2 KB
929 B 402ms
376ms Script
application/javascript 2606:4700::6811:d4cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-scripts.com/4487427.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d932ae11206d9a743fe498f92698840424c976675581b4ebea9e10d4f9a0f3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 21 Feb 2023 14:31:03 GMT
server: cloudflare
x-hubspot-correlation-id: a3a07899-9c94-4696-a673-0d1913f6af5e
x-trace: 2B222E783C1823B3647F34807F790D6895E1CBCC47000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.benefitsconf.com
cache-control: public, max-age=60
access-control-allow-credentials: true
cf-ray: 79d0fb65d91a2c36-FRA
expires: Tue, 21 Feb 2023 16:51:37 GMT

GET
H/1.1 200
OK trackpush.min.js Show response
s3.amazonaws.com/cdn.aimtell.com/trackpush/ 47 KB
13 KB 347ms
116ms Script
text/javascript 52.216.43.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/cdn.aimtell.com/trackpush/trackpush.min.js
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.43.24 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 06fd2a61dce61487dc324f208fdf13c255b8b1d2c6969c27609bde27488f0fa3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
Content-Encoding: gzip
Last-Modified: Fri, 04 Nov 2022 16:52:26 GMT
Server: AmazonS3
x-amz-request-id: TEFV8KEFKKJQCHZY
ETag: "863356224a730b55b977b4f902cbcd90"
Content-Type: text/javascript
Cache-Control: max-age=86400
Accept-Ranges: bytes
Content-Length: 13250
x-amz-id-2: cXYU4vLXlInJYQ+71kAd60g9EyvCin4NDK7hvPiGLteiYxL238jvWpo7IwA5QS/x3U21o9mcWfU=

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/choozle/9993/ 29 KB
9 KB 158ms
43ms Script
application/javascript 13.32.110.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/9993/Bootstrap.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.110.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-110-88.vie50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 960aec98eaab90479ff50f96fb18e031fc8f255c62ee2846f52aa8daf00052c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Sun, 19 Feb 2023 08:47:31 GMT
x-amz-version-id: OGoZI_GdUmOBVTtj9gKQjALo6AvlqxkE
content-encoding: br
via: 1.1 f886f6227d3373aee9b545641306fb68.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C2
age: 201787
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 Jan 2022 18:34:19 GMT
server: CloudFront
etag: W/"f1baf1b6ced9e2bab941c36b542f508b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: rToB5ZERuDciK-z_UsKNboFlc5bXab5A5ziZzAGc4mH6yI4AAwoVZA==

GET
H2 200 komito.js Show response
komito.net/ 14 KB
7 KB 65ms
19ms Script
application/javascript 2606:4700:3030::ac43:b641
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://komito.net/komito.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::ac43:b641 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ea75c374d24a7fdfe32bfcbde6ce6f6a72a60ef575f6b173a2b18eb616b2d46

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-fastly-request-id: 2f4d21de4ab466f77c475a68ba8c21f1c3821bd0
date: Tue, 21 Feb 2023 16:50:37 GMT
via: 1.1 varnish
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15552000
age: 176
cf-polished: origSize=13993
x-cache: HIT
x-proxy-cache: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230038-FRA
x-cache-hits: 1
cf-bgj: minify
last-modified: Sat, 10 Dec 2022 02:19:55 GMT
x-github-request-id: 8A7A:5A03:407379:42DB96:6393ED9A
x-timer: S1670639206.719047,VS0,VE1
server: cloudflare
etag: W/"6393eccb-36a9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6%2F0KChf8gF6DYgIAeo2zoW5hsBqHRW8QGRi7bMTWrEkuDtsMDPDKanhtEunupMX6VUw646%2BaF6rcLZgBNhps08LeS%2BW0uMFNDUehYv3mmiEiIhQeyeosHf3n8QEOwiYHx4ArTNnRUZ%2Bd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=16070400
cf-ray: 79d0fb65ff8f92a5-FRA
expires: Tue, 14 Feb 2023 16:14:32 GMT

GET
H2 200 61df244d4398d1ba87000004.js Show response
tag.perfectaudience.com/serve/ 12 KB
4 KB 269ms
199ms Script
text/javascript 151.101.66.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.perfectaudience.com/serve/61df244d4398d1ba87000004.js

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.217 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cowboy /

Resource Hash

d34132b3fdfafe992af8fa6145900bad175f808cabb024b27095fc496cae7aa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-served-by: cache-fra-eddf8230058-FRA
date: Tue, 21 Feb 2023 16:50:37 GMT
via: 1.1 vegur, 1.1 varnish
x-content-type-options: nosniff
content-encoding: gzip
server: Cowboy
age: 0
x-timer: S1676998237.141913,VS0,VE190
vary: Accept-Encoding
x-cache: MISS
content-type: text/javascript
cache-control: max-age=1800
accept-ranges: bytes
content-length: 3936
x-cache-hits: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 173 KB
64 KB 32ms
31ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-731813574

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8d546d353586e8d87a7069e85e13d684c2b1eaff4dc584d3adeaf5caf4341bd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65021
x-xss-protection: 0
last-modified: Tue, 21 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 21 Feb 2023 16:50:37 GMT

GET
H2 200 widget.js Show response
i.snoball.it/share/file/p/DmBw/ 308 KB
62 KB 418ms
253ms Script
application/javascript 2a00:1450:400d:806::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://i.snoball.it/share/file/p/DmBw/widget.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2013 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

6b27680030fe8b77e821e00c77eda750ec8caa8c03fd5b2c0b87158f0369326e

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
content-security-policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
referrer-policy: origin-when-cross-origin
content-encoding: gzip
via: 1.1 google
serversidecached: true
etag: W/"f3a5-MOVR1pjsMQr8v4sZim1twCrsUMk"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 62373
expires: -1

GET
H2 200 up.js Show response
up.pixel.ad/assets/ 3 KB
2 KB 209ms
32ms Script
application/javascript 178.79.227.76
LLNW

General

Check archive.org

Show headers Download Go to

Full URL: https://up.pixel.ad/assets/up.js?um=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 178.79.227.76 Vienna, Austria, ASN22822 (LLNW, US),
Reverse DNS: https-178-79-227-76.vie.llnw.net
Software: AC1.1 /
Resource Hash: 25b33a7a853f39e447b14be3e6662ccbb0fbce73620bf7778d194cb3fef1d3ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: gzip
last-modified: Wed, 16 Mar 2022 16:22:21 GMT
server: AC1.1
age: 376951
vary: accept-encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1550
x-llid: 41ae64b68266a75dee714d0e121fd96f

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 218 KB
76 KB 50ms
50ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N5EDPXH1HG&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c86e69b9f8bd413c9606bea919a815723749510a52a1d78acf674d6c1887526c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 77893
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Feb 2023 16:50:37 GMT

GET
H2 200 373302336383956 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 71ms
70ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/373302336383956?v=2.9.96&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

564c234dd0dafe8c491cbf815082fc3e2e9f567b89d5c25b1009b1aaf6621476

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 21 Feb 2023 16:50:37 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: kZC/ssFbZpKcmAO3XOUrTdtVts62QRqOzvwsl/C5mbJbzD/pDNC9Uy1/7X8fx8QNDUyi170bK8n9+CD//FnkwQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 917726464
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
248 B 84ms
25ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-N5EDPXH1HG&gtm=45je32f0&_p=1258445836&_gaz=1&cid=1929351510.1676998237&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1676998237&sct=1&seg=0&dl=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&dt=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N5EDPXH1HG&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitsconf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
248 B 69ms
23ms Ping
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-N5EDPXH1HG&cid=1929351510.1676998237&gtm=45je32f0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N5EDPXH1HG&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitsconf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 108ms
40ms Image
image/gif 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-N5EDPXH1HG&cid=1929351510.1676998237&gtm=45je32f0&aip=1&z=1587812814

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 28ms
28ms XHR
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1258445836&t=pageview&_s=1&dl=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&ul=en-us&de=UTF-8&dt=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAACAAI~&jid=450852298&gjid=117065081&cid=1929351510.1676998237&tid=UA-34066983-7&_gid=749355463.1676998237&_r=1&_slc=1&gtm=45He32f0n81NBRDPRC&z=1365087087

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsconf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitsconf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrations Show response
polo.feathr.co/v1/accounts/579f8dd88e80274b4089ec04/ 31 B
363 B 581ms
243ms XHR
application/json 54.204.247.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://polo.feathr.co/v1/accounts/579f8dd88e80274b4089ec04/integrations

Requested by

Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.247.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-247-164.compute-1.amazonaws.com

Software

nginx/1.17.8 /

Resource Hash

559382b44a7cb0b397c474fe76532f50b622824e15440784425d1f4a42a991de

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
strict-transport-security: max-age=15724800; includeSubDomains
server: nginx/1.17.8
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length: 31

GET
H2 200 refresh
marco.feathr.co/v1/ 43 B
594 B 470ms
360ms Image
image/gif 18.66.15.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://marco.feathr.co/v1/refresh
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-8.vie50.r.cloudfront.net
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
via: 1.1 1c6954b6a2b349a78fb0daa669c3e984.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-P1
x-amzn-requestid: c723308d-85eb-41de-b602-9b2914cced72
x-amzn-trace-id: Root=1-63f4f65d-1e07ec0439744fcc1d45209a;Sampled=0
access-control-allow-methods: *
content-type: image/gif
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-apigw-id: AsturHlmIAMFx4Q=
content-length: 43
x-amz-cf-id: rsATnjmRHeID1mjfa9fVq_Mlpoy4q2VPM5C2Ee4NG3jm5q-SGDnIHQ==
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 22ms
22ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-34066983-7&cid=1929351510.1676998237&jid=450852298&gjid=117065081&_gid=749355463.1676998237&_u=YCDACEAABAAAACAAI~&z=731627631

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitsconf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 21 Feb 2023 16:50:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitsconf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 app_icon.png
www.benefitsconf.com/images/ 3 KB
3 KB 311ms
310ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/app_icon.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 56e9751d017d12d694283b84dd62c4c85f3dace7036a8b67ce5d3dcf43965214

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 19 Jan 2021 14:29:57 GMT
server: Apache
etag: "b94-5b941ac462a03"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2964
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H/1.1

200

init.do Show response
sample.dragonforms.com/ Frame 6BBC
Redirect Chain

https://sample.dragonforms.com/HBLCSignup_December2022?dragoniframe=true
https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

302 B
688 B

113ms
113ms

Document
text/html

204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

394dce01889c9cb296e4a034a7e5b9aa0ad75ee76e5c46feb5fadde1a98fc16d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitsconf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 21 Feb 2023 16:50:40 GMT
Keep-Alive: timeout=5
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 21 Feb 2023 16:50:39 GMT
Keep-Alive: timeout=5
Location: init.do?dragoniframe=true&omedasite=HBLCSignup_December2022
Server: Apache

GET
H/1.1

200

init.do Show response
sample.dragonforms.com/ Frame A745
Redirect Chain

https://sample.dragonforms.com/HBLCSignup_December2022?dragoniframe=true
https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

302 B
688 B

121ms
121ms

Document
text/html

204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

394dce01889c9cb296e4a034a7e5b9aa0ad75ee76e5c46feb5fadde1a98fc16d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitsconf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 21 Feb 2023 16:50:40 GMT
Keep-Alive: timeout=5
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 21 Feb 2023 16:50:39 GMT
Keep-Alive: timeout=5
Location: init.do?dragoniframe=true&omedasite=HBLCSignup_December2022
Server: Apache

GET
H2 200 json Show response
forms.hsforms.com/embed/v3/form/4487427/b7be973f-779b-4e48-a66f-eb18baeefdee/ 16 KB
4 KB 194ms
152ms XHR
application/json 2606:4700::6810:5805
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/4487427/b7be973f-779b-4e48-a66f-eb18baeefdee/json?hs_static_app=forms-embed&hs_static_app_version=1.2715&X-HubSpot-Static-App-Info=forms-embed-1.2715

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5805 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

309fde87f27e8c8978bc54746aa94680a719ae9117360b7e5bdf22a4360b9dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.benefitsconf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-origin-hublet: na1
date: Tue, 21 Feb 2023 16:50:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-hubspot-correlation-id: f2ced411-5758-42e8-901c-d615cb80fbe9
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2B54055C844F83ECE1275782A6E860E17BCC6C90E1000000000000000000
vary: origin
access-control-allow-methods: OPTIONS, GET
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.benefitsconf.com
access-control-expose-headers: X-Origin-Hublet
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 79d0fb6759619b28-FRA

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 47ms
11ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=373302336383956&ev=PageView&dl=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&rl=&if=false&ts=1676998237302&sw=1600&sh=1200&v=2.9.96&r=stable&a=tmgoogletagmanager&ec=0&o=30&cs_est=true&fbp=fb.1.1676998237301.977002901&it=1676998237142&coo=false&rqm=GET

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 21 Feb 2023 16:50:37 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 221ms
68ms Image
image/gif 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-34066983-7&cid=1929351510.1676998237&jid=450852298&_u=YCDACEAABAAAACAAI~&z=1627622040

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 45ms
45ms Image
image/gif 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-34066983-7&cid=1929351510.1676998237&jid=450852298&_u=YCDACEAABAAAACAAI~&z=1627622040

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bn23_backtotop_100x100.png
www.benefitsconf.com/images/ 4 KB
4 KB 252ms
250ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_backtotop_100x100.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 4e3959637a13b1ff669c23109a2b48dab946977b7471687e74891c6cae784f1f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 29 Mar 2022 16:04:02 GMT
server: Apache
etag: "fd9-5db5d93dccf5c"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 4057
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 benefits_header.jpg
www.benefitsconf.com/images/ 90 KB
90 KB 251ms
250ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/benefits_header.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 0e2f9a557b3441ebae77ecc26c6e3d39342098eaf6172f90251f92fb94fe2afa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 29 Mar 2022 17:01:36 GMT
server: Apache
etag: "1668d-5db5e61c04a80"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 91789
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H/1.1 200 getEmbeddedClientScript.do Show response
sample.dragonforms.com/ 1 KB
965 B 609ms
128ms Script
text/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/getEmbeddedClientScript.do?embeddedsite=HBLCSignup_December2022

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

ea28e1928c43f3fdb0a9b057537612211b1a9687d16959c502263d06bbe81b73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
DATA 200
OK truncated
/ 156 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9701ff96675266ed2a8c5c2086ca44d6a0338dc114fe66a58dbdea9f4182e71

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 157 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d0055e6d8cfd78504ea3bfeb93b24bafd670e051503e4f69c2bd26c72148a7a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 380 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 bn23_index_aboutimage.jpg
www.benefitsconf.com/images/ 149 KB
149 KB 417ms
413ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_index_aboutimage.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 8e3abeb136da6e17be3cb1b00438b73e67d2b5c3c7724adf2f53e1f438bca9d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Fri, 01 Apr 2022 13:58:01 GMT
server: Apache
etag: "2544e-5db982ab45b41"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 152654
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 credits.png
www.benefitsconf.com/images/ 34 KB
34 KB 417ms
412ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/credits.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 6b5b98f041b118d2d88fa5647ee05cd05cfebaddadfb1608da5b97f33b5c268c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Thu, 24 Feb 2022 20:45:46 GMT
server: Apache
etag: "8749-5d8c9aaabc4a7"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 34633
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 sponsor_thehartford.png
www.benefitsconf.com/images/ 5 KB
6 KB 417ms
413ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/sponsor_thehartford.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 63009d0b82c390e3a912d34faed89930393f2a1c27474755f7be915617c31994

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Fri, 26 Mar 2021 19:10:47 GMT
server: Apache
etag: "1548-5be754a1f3536"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5448
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 sponsor_color.png
www.benefitsconf.com/images/ 3 KB
3 KB 418ms
413ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/sponsor_color.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: d461e6ce7cd69b96985e81ab947d7f1f004288d09d2b64c19b0ab14ba9d9b6f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 17 Jan 2023 17:21:25 GMT
server: Apache
etag: "c9c-5f278edf20ba3"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 3228
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 sponsor_ba_thehartford.jpg
www.benefitsconf.com/images/ 29 KB
30 KB 418ms
414ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/sponsor_ba_thehartford.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 864c41950c0f38f03a90ab5da0f650afa1088d0f7c201f49d28fb06b06a02552

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 17 Jan 2023 16:55:02 GMT
server: Apache
etag: "753f-5f2788f9700d3"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 30015
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 sponsor_vsp.png
www.benefitsconf.com/images/ 5 KB
6 KB 417ms
413ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/sponsor_vsp.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 2da884cb570bb3fee3c04a1a34c97c269c4293576c38e93769db1a21b85e3a99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Mon, 12 Sep 2022 15:52:45 GMT
server: Apache
etag: "154d-5e87ce2f83b10"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5453
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 sponsor_hsabank.png
www.benefitsconf.com/images/ 7 KB
7 KB 418ms
414ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/sponsor_hsabank.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 91079c2ee02663f599e944ea27e1d58ae1c116be7f36d4fee438692646a4cfd0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Wed, 11 Jan 2023 18:31:35 GMT
server: Apache
etag: "1a09-5f20135d556f3"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 6665
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 sponsor_abbott.jpg
www.benefitsconf.com/images/ 6 KB
6 KB 417ms
414ms Image
image/jpeg 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/sponsor_abbott.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ac8a10adb86d0c585d8c1cc92f2324a769092ef1d22bb6ec6a63b67dc461881f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Mon, 14 Nov 2022 17:23:44 GMT
server: Apache
etag: "1604-5ed71805f3c07"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5636
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 sponsor_nationalcouncilmentalwellbeing.png
www.benefitsconf.com/images/ 7 KB
7 KB 419ms
415ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/sponsor_nationalcouncilmentalwellbeing.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 034d23d374bb4f4c64a5dcbc2a46d65b457a5f1b17bf6408649fce4053bbb667

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Wed, 01 Feb 2023 15:47:31 GMT
server: Apache
etag: "1b37-5f3a55dc486d4"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 6967
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bn23_in.png
www.benefitsconf.com/images/ 1022 B
1 KB 418ms
414ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_in.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ee22fe31160b06703e1e38b7b8009a3cd8dbe67df9d0ae213d1d26624f3d8b76

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 29 Mar 2022 15:21:59 GMT
server: Apache
etag: "3fe-5db5cfd7e8060"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1022
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bn23_t.png
www.benefitsconf.com/images/ 1 KB
1 KB 418ms
415ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_t.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 867d36d854855408cd9a4409f7c5264928aebc1ff05b8d236e934ca78c4a5a48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 29 Mar 2022 15:22:15 GMT
server: Apache
etag: "4f6-5db5cfe6f4dde"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1270
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bn23_f.png
www.benefitsconf.com/images/ 817 B
1021 B 417ms
415ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_f.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 856e3ebee940abce3b43654f70d07b8ccdcd94e703f0acc679a3af14475c6bf3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 29 Mar 2022 15:22:06 GMT
server: Apache
etag: "331-5db5cfde8d60a"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 817
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bn23_gram.png
www.benefitsconf.com/images/ 2 KB
2 KB 418ms
416ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_gram.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 00fea3cb5f6e82dbf5f065152e88e91e54441b7ca0e66d26622abd50f46485bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Tue, 29 Mar 2022 15:22:24 GMT
server: Apache
etag: "779-5db5cfeed6d77"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1913
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 200 bn23_yt.png
www.benefitsconf.com/images/ 1 KB
1 KB 417ms
415ms Image
image/png 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitsconf.com/images/bn23_yt.png
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ee41d2ee145923ab2f6b06766855f253ce915c9aba44026073c41006442ed093

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Thu, 29 Dec 2022 15:16:53 GMT
server: Apache
etag: "421-5f0f8f99df444"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1057
expires: Wed, 21 Feb 2024 16:50:37 GMT

GET
H2 206 index_agendalive.mp4
www.benefitsconf.com/downloads/ 10 MB
0 414ms
414ms Media
video/mp4 3.212.8.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitsconf.com/downloads/index_agendalive.mp4
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.8.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-8-231.compute-1.amazonaws.com
Software: Apache /
Resource Hash

Request headers

Referer: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
last-modified: Mon, 28 Nov 2022 23:17:46 GMT
server: Apache
etag: "3f2c860-5ee90144e1c74"
content-type: video/mp4
Content-Range: bytes 0-66242655/66242656
cache-control: max-age=2592000
accept-ranges: bytes
Content-Length: 66242656
expires: Thu, 23 Mar 2023 16:50:37 GMT

GET
DATA 200
OK truncated
/ 547 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 552 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 177 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 515 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 11ec04e3948e25a0d78d2f77c04940b8e38a086624ec36fa4605a2a69b133e94

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 242 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1

200
OK

tagjs Show response
pixel-geo.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/tagjs?a_id=172159&source=js_tag
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=172159&source=js_tag

125 B
454 B

40ms
40ms

Script
text/javascript

52.51.88.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=172159&source=js_tag
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: HTTP/1.1
Server: 52.51.88.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-88-84.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 4abf8351a6089c18d18736af30f4834064af88ee0f69f3628c71d30ded501eb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 125
Content-Type: text/javascript

Redirect headers

Location: https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=172159&source=js_tag
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

POST
H2 200 pageview Show response
signals.aimtell.com/ 43 B
387 B 104ms
22ms XHR
image/gif 2606:4700::6812:1f97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://signals.aimtell.com/pageview?id_site=17458&v=3.975&support=1&state=default&wl=0&ref=aHR0cHM6Ly93d3cuYmVuZWZpdHNjb25mLmNvbS8/dXRtX3NvdXJjZT1ocmUmdXRtX21lZGl1bT1lbWFpbCZ1dG1fY2FtcGFpZ249Ym4yM19ocmVfMDIyMTIzJnV0bV9jb250ZW50PWJhbm5lciZvbHlfZW5jX2lkPTA5MTdINDUzMjA4OUg3Tw==
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/cdn.aimtell.com/trackpush/trackpush.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1f97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
aimtell-hash-exists: 0
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: image/gif
access-control-allow-origin: https://www.benefitsconf.com
aimtell-traverse: 0
access-control-expose-headers: Aimtell-Hash-Exists, Aimtell-Traverse, Aimtell-Signal
access-control-allow-credentials: true
aimtell-signal: 0
cf-ray: 79d0fb686c52bb49-FRA
access-control-allow-headers: Content-Type, *
content-length: 43

GET
H2 200 17458-56928242cf92.json Show response
cdn.aimtell.io/config/optin/ 418 B
789 B 617ms
545ms XHR
application/json 2606:4700:10::ac43:1ee1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aimtell.io/config/optin/17458-56928242cf92.json
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/cdn.aimtell.com/trackpush/trackpush.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1ee1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59332ddb4c5cefa0042a4d50f2bbd9e9434e858c747a7188aa8348905f55874f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: gzip
via: 1.1 6c183700546a331def0de99cb43d1574.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
x-amz-cf-pop: HEL50-C2
x-cache: Miss from cloudfront
content-length: 316
last-modified: Fri, 05 Feb 2021 19:03:34 GMT
server: cloudflare
etag: "fa51fea0c33a180575fa994cf1b43c7b"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=86400
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
cf-ray: 79d0fb685eeb9b55-FRA
x-amz-cf-id: vr5PyXVDQNmdwzCv8eB1nIVz16DRY7Aufl_AHO9Qys9mLiHEJ-fsmg==

GET
H2 200 4487427.js Show response
js.hs-banner.com/ 62 KB
16 KB 462ms
411ms Script
text/javascript 2606:4700:4400::ac40:9a55
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/4487427.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/4487427.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9a55 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6abf43ebb05d483cf3fca737307acad1eab1485b405b8171362384e35831716

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
x-amz-version-id: bZcQ7Z44iWLQuqvic8GiE9bXDnedywyI
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: 5JPP0A284JG3MVHV
x-amz-server-side-encryption: AES256
x-amz-id-2: z46U6uyRro2cpyKpx1YlW1ZSDmZRsU/+Aftxjsev6P+FEc0lTbgoFmv+28jzDJ9lNP4NpTqcaz0=
last-modified: Tue, 25 Oct 2022 20:24:31 GMT
server: cloudflare
etag: W/"71bb1ca0a33a8bb0bca726c6e7f47f88"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.benefitsconf.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300, public
access-control-allow-credentials: true
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 79d0fb688c9e9b5e-FRA
expires: Tue, 21 Feb 2023 16:55:37 GMT

GET
H2 200 4487427.js Show response
js.hs-analytics.net/analytics/1676998200000/ 66 KB
21 KB 173ms
130ms Script
text/javascript 2606:4700::6811:46b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1676998200000/4487427.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/4487427.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:46b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7462983fe13daa96e5880b250aac03f65144d07aa6695205b9fdefee9d9d0149

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: TEFWEPWQ7PZMHETZ
x-amz-server-side-encryption: AES256
x-amz-id-2: dxEu//t1ITuPKupRFhkcT0cH5CHjRRCE2KEcsw/YoZ7UMUad9Rb7cZu2pa16yZqafAAFYK1i5Ws=
last-modified: Wed, 18 Jan 2023 20:05:14 GMT
server: cloudflare
etag: W/"f9bc328f230bb85ba42dc8d4824c621d"
vary: origin, Accept-Encoding
content-type: text/javascript
cache-control: max-age=300, public
access-control-allow-credentials: false
cf-ray: 79d0fb68787f91f5-FRA
expires: Tue, 21 Feb 2023 16:55:37 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 545 KB
87 KB 206ms
156ms Script
application/javascript 2606:4700::6811:e8cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/4487427.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:e8cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5cd1db1cde09b8c1436abaafe15c9c219d3ea69ab3987ab3e38ca61e92278c4

Request headers

Referer: https://www.benefitsconf.com/
Origin: https://www.benefitsconf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
x-amz-version-id: Mvk11AG5ZDldgidyoVDtBLUv1vFHpW3a
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
cf-cache-status: MISS
content-encoding: br
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1149/bundle/main/lead-flows-release.js&cfRay=79d0fb6888929b5d-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
x-amz-replication-status: COMPLETED
last-modified: Mon, 20 Feb 2023 11:24:51 UTC
server: cloudflare
etag: W/"58f0c319dc2622b8548c15544520940c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-hs-cache-status: MISS
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
cache-control: s-maxage=86400, max-age=0
cf-ray: 79d0fb6888929b5d-FRA
x-amz-cf-id: SXTRzP_3hXKPGSD-PFfNH4g_hu3bZlXoQu6TmrVhKeWiPf5cz_ODAw==
x-hs-target-asset: lead-flows-js/static-1.1149/bundle/main/lead-flows-release.js

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
3 KB 66ms
16ms Script
application/javascript 2606:4700::6811:73b0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/4487427.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:73b0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 552da695674e5ff5a53e685eac5440a231023675c5098e54c1516e73ec99f35a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
x-amz-version-id: 1ZaYK3sC7unZOzTPEqwB36un4rYvqT1Y
via: 1.1 c5f8f8068a88ebb73e505f5e51b5262e.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-cf-pop: IAD12-P3
age: 336
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.327/bundles/pixels-release.js&cfRay=79d0f33149c79295-FRA
x-cache: Hit from cloudfront
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
x-amz-replication-status: COMPLETED
last-modified: Tue, 21 Feb 2023 03:24:48 UTC
server: cloudflare
etag: W/"c5fb4d0d970e121f5c6f72a277677133"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
cache-control: max-age=600
cf-ray: 79d0fb688ac6927d-FRA
x-amz-cf-id: KVyHcW8IjHBcgEMAEraU3D9xWpWVMGGcwI8aWLLL8FIpGDkA4WyVIA==
x-hs-target-asset: adsscriptloaderstatic/static-1.327/bundles/pixels-release.js

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/731813574/ 2 KB
1 KB 176ms
89ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/731813574/?random=1676998237488&cv=11&fst=1676998237488&bg=ffffff&guid=ON&async=1&gtm=45be32f0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&tiba=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&auid=1743640015.1676998237&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-731813574

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b8bdac9a46a9aaabbab5baba1c8486810dab679ebb9f4120b9946a7aee3febb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 993
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/9993/ 407 B
715 B 66ms
65ms Script
text/javascript 13.32.110.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/9993/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/9993/code/&publishedOn=Wed%20Jan%2005%2018:34:12%20GMT%202022&ClientID=923&PageID=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/9993/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.110.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-110-88.vie50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 0c2edd9c060959f3a4ce693a92b02aff014128f480c5448ea1d175bad387de89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
via: 1.1 f886f6227d3373aee9b545641306fb68.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: VIE50-C2
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
content-length: 407
x-amz-cf-id: 8gG-5nR5XM9VpHbowgoV1GFoRGwvNjMfEfWqnCD1rv1K8LzBzpauoA==
expires: Tue, 21 Feb 2023 16:50:36 GMT

GET
H2 200 c5522bd15156555d21f6442611c3ac8a.js Show response
nexus.ensighten.com/choozle/9993/code/ 1 KB
1 KB 44ms
43ms Script
application/javascript 13.32.110.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/9993/code/c5522bd15156555d21f6442611c3ac8a.js?conditionId0=4869594&conditionId1=4869588
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/9993/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.110.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-110-88.vie50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 2a4bad82232cf44040fea652139262d374f7486fda6b57b0fb71506031e23b02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Sun, 19 Feb 2023 08:47:32 GMT
x-amz-version-id: omXOINLN2sB4gun1fcJEVjAv8SsNicij
content-encoding: br
via: 1.1 f886f6227d3373aee9b545641306fb68.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C2
age: 201786
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 13 Aug 2021 01:10:24 GMT
server: CloudFront
etag: W/"324a25c9bcf9d0b420564eb9c8bd536b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 888GTqcstwfXiZOdhTOSGEE2FOjDjDL3Trxxt-11Zbe1o8SbsKY9uw==

GET
H2 200 466b2d4ceb824c81ab82a48da410acc4.js Show response
nexus.ensighten.com/choozle/9993/code/ 2 KB
768 B 43ms
42ms Script
application/javascript 13.32.110.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/9993/code/466b2d4ceb824c81ab82a48da410acc4.js?conditionId0=421905
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/9993/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.110.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-110-88.vie50.r.cloudfront.net
Software: CloudFront /
Resource Hash: ef53ca1ed9fc4233f8d49c44a602df622b9c933eb0d0fc954ed96d5436fec751

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Mon, 20 Feb 2023 05:40:58 GMT
x-amz-version-id: 0HZ_498XUliz1MU81D9ieG5gBpp4IhRa
content-encoding: br
via: 1.1 f886f6227d3373aee9b545641306fb68.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C2
age: 126580
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 05 Jan 2022 18:11:52 GMT
server: CloudFront
etag: W/"133d195885a0343cbd8e892c54f86d1f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: CpvvRzW0JruOGrMq12Xk0xGbJfCerd8qHH1yEvegHurBr1Z0e9mABQ==

GET
H2 200 hblc.json Show response
lrp-conference-tweets-cdn.lrp.com/ 10 KB
2 KB 593ms
440ms XHR
application/json 2600:9000:2304:ae00:1f:1336:9b40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lrp-conference-tweets-cdn.lrp.com/hblc.json
Requested by: Host: media-cdn.lrp.com
URL: https://media-cdn.lrp.com/bundle-b4-58b9106800.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2304:ae00:1f:1336:9b40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 693f67332d3b3d2e74b4803a895cc41e7822c7cc518e067804916c0fcd41d7e2

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.benefitsconf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
content-encoding: gzip
via: 1.1 62f2a061e41be90ceddd231b5157117c.cloudfront.net (CloudFront)
last-modified: Tue, 21 Feb 2023 16:50:34 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
etag: W/"5a817193d4179647d577aa32a0cd112c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json;charset=utf-8
access-control-allow-origin: *
x-cache: Miss from cloudfront
cache-control: max-age=120
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-amz-cf-id: hPO99L7fNIIA1mWUPUqXhG0NXhkI1tzp8Fkr2r_KquD-VCwXR_fkdg==

GET
H2 200 olytics.min.js Show response
olytics.omeda.com/olytics/js/v3/p/ 263 KB
72 KB 12ms
12ms Script
application/javascript 2600:9000:20eb:2200:1e:5cef:3780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:2200:1e:5cef:3780:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

6bd8a3d8dce116787274c58b9b0ed3d4284191a80cb1249d49c60ef96ade5d87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 11:45:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 18301
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 12 Oct 2022 19:43:20 GMT
server: Apache
etag: W/"269579-1665603800000"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=21600
accept-ranges: bytes
x-amz-cf-id: vPghqORrr1kR8xgFcv5ntOoVVk5TcSePYyJGUxL38If-LmMELgs5Jw==
expires: Thu, 16 Feb 2023 11:45:34 GMT

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ Frame FAB3 509 KB
159 KB 33ms
32ms Script
application/javascript 2606:4700::6811:ba49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:ba49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5e470d918babacc4ffc6001009227fc3b3d6303f5e2738aed7a02c2e23628f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
x-amz-version-id: dZvLdX9P7w4t9flGoGjs6YWXCETUwiH4
via: 1.1 dfc1931cc62ecd4133c2b9bdae1bb476.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
age: 4
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=forms-embed/static-1.2715/bundles/project-v2.js&cfRay=79d0fb4baa662c4b-IAD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
content-encoding: br
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 17 Feb 2023 05:17:00 UTC
server: cloudflare
etag: W/"d2b69dd4f64d2c0ab2d305cd7f4999b5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6rh5Xk8JxJNK3l0feUqj6bOYEdG1RCpwTyLsyhrMDC%2BQbKxUKeilogmTVmOdhXHW5jHeF3IoyWrbAi1j2gSnYrajtNLc44ai5FAomhsTmlfuIkUTTN98Qyl6QbPd6EgZZ4sZDIGDwKcGQGy%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
cf-ray: 79d0fb695eeb2c2f-FRA
x-amz-cf-id: swD-sDIE3WAsvvunyuBz89lNJVNPGsGF1bLdiIr3S5i2hTudZ_DVmA==
x-hs-target-asset: forms-embed/static-1.2715/bundles/project-v2.js

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 20ms
18ms Image
image/gif 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1258445836&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&ul=en-us&de=UTF-8&dt=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=color-scheme&ea=light&_u=YDDACEABBAAAACAAI~&jid=&gjid=&cid=1929351510.1676998237&tid=UA-34066983-7&_gid=749355463.1676998237&gtm=45He32f0n81NBRDPRC&z=1764986236

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Feb 2023 18:06:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 81840
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 400 CheckCookie
accounts.google.com/ 0
0 170ms
62ms Image
text/html 2a00:1450:400d:807::200d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400d:807::200d , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

GET
H/1.1 200
OK 16760
cs.choozle.com/dp/chz/ 35 B
123 B 510ms
110ms Image
image/gif 3.212.38.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.choozle.com/dp/chz/16760?d=www.benefitsconf.com&cb=8079990161
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.38.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-38-84.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

OPTIONS
H/1.1 200 olytics
oqs.omeda.com/oqs/rest/ Frame 0
0 542ms
122ms Preflight
text/plain 204.180.130.165
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://oqs.omeda.com/oqs/rest/olytics

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.165 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.benefitsconf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Headers: Access-Control-Request-Headers, Content-Type, Origin, Accept, Accept-Encoding, Accept-Language, HOST, User-Agent, Access-Control-Request-Method, Access-Control-Max-Age
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Connection: keep-alive
Content-Length: 0
Content-Type: text/plain
Date: Tue, 21 Feb 2023 16:50:38 GMT
Keep-Alive: timeout=5
Server: Apache
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

POST
H/1.1 200 olytics Show response
oqs.omeda.com/oqs/rest/ 15 B
354 B 135ms
134ms XHR
application/json 204.180.130.165
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://oqs.omeda.com/oqs/rest/olytics

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.165 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

68330f6767efe4ea90f23cb4bb722810d19758395bc24f59c7c893c0d4ae69ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitsconf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type: application/json

Response headers

Date: Tue, 21 Feb 2023 16:50:37 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

HEAD
H2 200 adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 0
0 202ms
106ms Fetch
text/javascript 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49379
x-xss-protection: 0
server: cafe
etag: 13500983185920835461
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 21 Feb 2023 16:50:37 GMT

POST
H/1.1 200 olytics Show response
oqs.omeda.com/oqs/rest/ 15 B
354 B 131ms
130ms XHR
application/json 204.180.130.165
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://oqs.omeda.com/oqs/rest/olytics

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.165 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

8fed0359a978607741335672c13815cef49036c52f9d3c3173d365840a967ccb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitsconf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type: application/json

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

OPTIONS
H/1.1 200 olytics
oqs.omeda.com/oqs/rest/ Frame 0
0 532ms
119ms Preflight
text/plain 204.180.130.165
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://oqs.omeda.com/oqs/rest/olytics

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.165 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.benefitsconf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Headers: Access-Control-Request-Headers, Content-Type, Origin, Accept, Accept-Encoding, Accept-Language, HOST, User-Agent, Access-Control-Request-Method, Access-Control-Max-Age
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Connection: keep-alive
Content-Length: 0
Content-Type: text/plain
Date: Tue, 21 Feb 2023 16:50:38 GMT
Keep-Alive: timeout=5
Server: Apache
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

GET
H2

200

adsct
analytics.twitter.com/i/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=twtr
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_roUVmyUA4loMJCicE

43 B
396 B

427ms
196ms

Image
image/gif

104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_roUVmyUA4loMJCicE

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-response-time: 179
date: Tue, 21 Feb 2023 16:50:37 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: f997c6e450772715
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 3a2f07097890c91ccab7683a816caaf63759d80304060340f2515e1f4b6b298f
content-length: 43

Redirect headers

Location: https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_roUVmyUA4loMJCicE
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2

204

sync
ups.analytics.yahoo.com/ups/58288/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=yah
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_roUVmyUA4loMJCicE&_origin=1
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_roUVmyUA4loMJCicE&_origin=1&verify=true

0
123 B

18ms
17ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_roUVmyUA4loMJCicE&_origin=1&verify=true

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 2
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_roUVmyUA4loMJCicE&_origin=1&verify=true
date: Tue, 21 Feb 2023 16:50:37 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=opx
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_roUVmyUA4loMJCicE

43 B
273 B

94ms
24ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_roUVmyUA4loMJCicE
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_roUVmyUA4loMJCicE
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=rbcn
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_roUVmyUA4loMJCicE

0
239 B

54ms
9ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_roUVmyUA4loMJCicE
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: e06182bf224d96e6550f4595601cdb0b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_roUVmyUA4loMJCicE
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

cb
pixel-geo.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=goo
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfcm9VVm15VUE0bG9NSkNpY0U
https://pixel-geo.prfct.co/cb?partnerId=goo

43 B
365 B

38ms
37ms

Image
image/gif

52.51.88.84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/cb?partnerId=goo
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: HTTP/1.1
Server: 52.51.88.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-88-84.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel-geo.prfct.co/cb?partnerId=goo
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 240
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
pixel-geo.prfct.co/seg/ 43 B
365 B 189ms
114ms Image
image/gif 52.51.88.84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/seg/?add=29225097&source=js_tag&a_id=172159
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.88.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-51-88-84.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?t=2&add=29225097
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D29225097

43 B
1 KB

15ms
15ms

Image
image/gif

185.89.210.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D29225097

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

HTTP/1.1

Server

185.89.210.90 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Feb 2023 16:50:37 GMT
AN-X-Request-Uuid: efb480c1-8e55-450d-99ad-8fa85bc873cf
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 178.162.209.138; 178.162.209.138; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Date: Tue, 21 Feb 2023 16:50:37 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.138; 178.162.209.138; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e8fa6d8c-57b1-44b3-b517-6bf190044db5
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D29225097
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/731813574/ 42 B
154 B 62ms
58ms Image
image/gif 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/731813574/?random=1676998237488&cv=11&fst=1676995200000&bg=ffffff&guid=ON&async=1&gtm=45be32f0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&tiba=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2157544563&rmt_tld=0&ipr=y

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/731813574/ 42 B
154 B 33ms
30ms Image
image/gif 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/731813574/?random=1676998237488&cv=11&fst=1676995200000&bg=ffffff&guid=ON&async=1&gtm=45be32f0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&tiba=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2157544563&rmt_tld=1&ipr=y

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
393 B 142ms
129ms Image
image/gif 2606:4700::6810:5805
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5805 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: ad28ca0b-978d-4048-979b-162b1e782ba6
x-trace: 2BE8E3F361A1430465FA3D58BD676F4AAC52951BCF000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 79d0fb6a5f7a39e5-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 1 KB
833 B 56ms
55ms Script
text/javascript 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?&onload=hsRecaptchaLoaded_3d35399d_e72a_4549_a159_581617319d40&render=explicit&hl=en

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b1eb5f27fd29dfe8c70362c031acd33b08d0eecd6779b27d641e3bd6a22b8527

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 641
x-xss-protection: 1; mode=block
expires: Tue, 21 Feb 2023 16:50:37 GMT

GET
H2 200 counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
438 B 194ms
139ms Image
image/gif 2606:4700::6810:5905
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5905 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
x-hubspot-correlation-id: f3a73ff3-4de2-434c-9aa6-37f23992e09a
x-trace: 2BF7B5345C4D0287AD0BA1575F1815CFC3AC55CCBB000000000000000000
vary: origin
content-type: image/gif
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 79d0fb6b69a12c23-FRA
content-length: 35
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 script.js Show response
polo.feathr.co/v1/analytics/match/ 290 B
568 B 331ms
114ms Script
text/javascript 54.204.247.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://polo.feathr.co/v1/analytics/match/script.js?pk=feathr&cb=1676998237855

Requested by

Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.247.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-247-164.compute-1.amazonaws.com

Software

nginx/1.17.8 /

Resource Hash

be8fae77cf0adacc0ebc6022588745b2e490caf613b3a6b8dc64f4f145db06f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
server: nginx/1.17.8
etag: W/"63f4f65d78923c000869019e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
cache-control: no-cache, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization

GET
H2 200 pixel.js Show response
polo.feathr.co/v1/accounts/579f8dd88e80274b4089ec04/ 318 B
604 B 338ms
122ms Script
text/javascript 54.204.247.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://polo.feathr.co/v1/accounts/579f8dd88e80274b4089ec04/pixel.js?pk=feathr

Requested by

Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.247.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-247-164.compute-1.amazonaws.com

Software

nginx/1.17.8 /

Resource Hash

b5ad65df4bc15d1bcf9c808f304e03377b91b446d5645b80d7f4347496dbdf4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
server: nginx/1.17.8
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
cache-control: must-revalidate, max-age=14400
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/ 405 KB
162 KB 64ms
19ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?&onload=hsRecaptchaLoaded_3d35399d_e72a_4549_a159_581617319d40&render=explicit&hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ea3ffab2197a506f50340ec177c79ce2c6ebc5d52d683d3b9147be4c3b7252f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitsconf.com/
Origin: https://www.benefitsconf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 12:50:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14404
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164853
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 05:01:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 21 Feb 2024 12:50:33 GMT

GET
H/1.1

200
OK

iframe Show response
d1eoo1tco6rr5e.cloudfront.net/ic6ljo0/hs1qnbi/ Frame B907
Redirect Chain

https://insight.adsrvr.org/tags/ic6ljo0/hs1qnbi/iframe
https://d1eoo1tco6rr5e.cloudfront.net/ic6ljo0/hs1qnbi/iframe

132 B
661 B

122ms
14ms

Document
text/html

18.66.123.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1eoo1tco6rr5e.cloudfront.net/ic6ljo0/hs1qnbi/iframe
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/9993/code/c5522bd15156555d21f6442611c3ac8a.js?conditionId0=4869594&conditionId1=4869588
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.123.144 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-123-144.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9a89eec5c1b5d924e6ddd19df46671850203320564438840f7eb786b9db04347

Request headers

Referer: https://www.benefitsconf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Age: 9555
Cache-Control: max-age=86400
Connection: keep-alive
Content-Length: 132
Content-Type: text/html
Date: Tue, 21 Feb 2023 16:50:38 GMT
ETag: "4fddceac394f67c733f9586337f2c2e7"
Last-Modified: Fri, 01 Oct 2021 23:42:58 GMT
Server: AmazonS3
Via: 1.1 935770605c74a80712059ba5b24d4162.cloudfront.net (CloudFront)
X-Amz-Cf-Id: hPaweem0OzALcfTitYDftFVVcTe_W-MNWUUW0q33pwSitvWOOUQ34g==
X-Amz-Cf-Pop: FRA60-P2
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256

Redirect headers

content-length: 183
content-type: text/html; charset=UTF-8
date: Tue, 21 Feb 2023 16:50:38 GMT
location: https://d1eoo1tco6rr5e.cloudfront.net/ic6ljo0/hs1qnbi/iframe
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 188 B
917 B 170ms
131ms XHR
application/json 2606:4700::6811:cccc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=4487427

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:cccc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a0bfa4680852481bf6f9de4382bb32fdd80988337a69f414f19791a9fdd882e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 59497767-768c-4bdd-b829-4392bbfa82d5
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
x-trace: 2BED36272DA0E2E06DD7F915FD631A1B1250AE4CED000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.benefitsconf.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wU%2F4vfEagbIxOw38Fh1F0DB5h6JYGDZMS4vd%2FvpMdO7irZRpxzoSQdZoynOe2orRb5T1MXvPTfI%2FGuoN5wA164UNs%2F%2B3PJ%2BK58eALoK6xg2H%2B99HHb21U9Iql0RT7LcOVrTeKNSclxgnRMvN"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 180
access-control-allow-credentials: false
cf-ray: 79d0fb6b6e792bdd-FRA
access-control-allow-headers: *

HEAD
H2 200 gpt.js
www.googletagservices.com/tag/js/ 0
0 189ms
65ms Fetch
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1489 / 332 of 1000 / last-modified: 1676981271"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 21 Feb 2023 16:50:38 GMT

GET
H/1.1 200 spinner.gif
cdn.omeda.com/hosted/images/dragon/generic/ Frame 6BBC 9 KB
9 KB 641ms
116ms Image
image/gif 205.162.42.5
QTS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.omeda.com/hosted/images/dragon/generic/spinner.gif

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.162.42.5 Overland Park, United States, ASN53866 (QTS-AS, US),

Reverse DNS

cdn.omeda.com

Software

Apache /

Resource Hash

056dd44aece96c67e45ba421d734f125e1497bbdb3b70194b7aadb8a68d10085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 20:45:02 GMT
Server: Apache
ETag: W/"8851-1476132302920"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 spinner.gif
cdn.omeda.com/hosted/images/dragon/generic/ Frame A745 9 KB
9 KB 617ms
114ms Image
image/gif 205.162.42.5
QTS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.omeda.com/hosted/images/dragon/generic/spinner.gif

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.162.42.5 Overland Park, United States, ASN53866 (QTS-AS, US),

Reverse DNS

cdn.omeda.com

Software

Apache /

Resource Hash

056dd44aece96c67e45ba421d734f125e1497bbdb3b70194b7aadb8a68d10085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 20:45:12 GMT
Server: Apache
ETag: W/"8851-1476132312178"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H3 200 anchor Show response
www.google.com/recaptcha/enterprise/ Frame 2F53 43 KB
22 KB 66ms
66ms Document
text/html 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cuYmVuZWZpdHNjb25mLmNvbTo0NDM.&hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&size=invisible&badge=inline&cb=9kubtbko5y8p

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b279fc53645ca027270ca5d8d20096b3ce3249d20e73ec121d1e0d73e8732d69

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vzNibsKrhBD2lSvFJzBJDw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitsconf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 23009
content-security-policy: script-src 'report-sample' 'nonce-vzNibsKrhBD2lSvFJzBJDw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Feb 2023 16:50:38 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 anchor Show response
www.google.com/recaptcha/enterprise/ Frame 5EB3 47 KB
26 KB 76ms
76ms Document
text/html 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1293e3506982748302639480f0f48632d08373e924b66490fb81b80351ec0adc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-eonNbkx5Z6KWtpAQJC9CUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 26109
content-security-policy: script-src 'report-sample' 'nonce-eonNbkx5Z6KWtpAQJC9CUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Feb 2023 16:50:38 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 129 KB
50 KB 33ms
32ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-712637918

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a60e0211e2734fcc57c9a1ce629c37243e3dcc9fa6d55810e358aec55dd82dfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50789
x-xss-protection: 0
last-modified: Tue, 21 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 21 Feb 2023 16:50:38 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 129 KB
50 KB 59ms
58ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-712637918&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NBRDPRC

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f8588c7cfd1a594bed12674d24ced00d02436abec895da63ac50913a9e8fe708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50799
x-xss-protection: 0
last-modified: Tue, 21 Feb 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 21 Feb 2023 16:50:38 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/ Frame 2F53 55 KB
24 KB 56ms
20ms Stylesheet
text/css 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cuYmVuZWZpdHNjb25mLmNvbTo0NDM.&hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&size=invisible&badge=inline&cb=9kubtbko5y8p

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Mon, 20 Feb 2023 11:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104049
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 05:01:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 20 Feb 2024 11:56:29 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/ Frame 2F53 405 KB
161 KB 76ms
40ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/recaptcha__en.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ea3ffab2197a506f50340ec177c79ce2c6ebc5d52d683d3b9147be4c3b7252f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 12:50:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14405
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164853
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 05:01:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 21 Feb 2024 12:50:33 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/ Frame 5EB3 55 KB
24 KB 47ms
26ms Stylesheet
text/css 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Mon, 20 Feb 2023 11:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104049
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 05:01:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 20 Feb 2024 11:56:29 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/ Frame 5EB3 405 KB
161 KB 37ms
17ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/recaptcha__en.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ea3ffab2197a506f50340ec177c79ce2c6ebc5d52d683d3b9147be4c3b7252f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 12:50:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14405
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164853
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 05:01:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 21 Feb 2024 12:50:33 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/712637918/ 2 KB
1 KB 132ms
131ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/712637918/?random=1676998238195&cv=11&fst=1676998238195&bg=ffffff&guid=ON&async=1&gtm=45be32f0&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&tiba=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&did=dZTQ1Zm&gdid=dZTQ1Zm&auid=1743640015.1676998237&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-712637918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610e87dba4ec17fd6bf02c806a6efda5c3f696f0b8873d32d522e7d413470274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 992
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 asyncPixelSync
pixel.sitescout.com/dmp/ Frame E0A8 0
0 107ms
19ms Document
text/plain 98.98.134.242
ZEN-ECN

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.sitescout.com/dmp/asyncPixelSync
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.242 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: AC1.1 /
Resource Hash

Request headers

Referer: https://www.benefitsconf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0,no-cache,no-store
date: Tue, 21 Feb 2023 16:50:37 GMT
expires: Tue, 11 Oct 1977 12:34:56 GMT
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
server: AC1.1

GET
H2 200 73514eea49192792
pixel.sitescout.com/up/ 43 B
267 B 112ms
19ms Image
image/gif 98.98.134.242
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sitescout.com/up/73514eea49192792?cntr_url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.242 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: AC1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:37 GMT
server: AC1.1
content-type: image/gif
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
cache-control: max-age=0,no-cache,no-store
content-length: 43
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 /
insight.adsrvr.org/track/pxl/ Frame B907 70 B
260 B 39ms
39ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/pxl/?adv=ic6ljo0&ct=0:hs1qnbi&fmt=3
Requested by: Host: d1eoo1tco6rr5e.cloudfront.net
URL: https://d1eoo1tco6rr5e.cloudfront.net/ic6ljo0/hs1qnbi/iframe
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1eoo1tco6rr5e.cloudfront.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 21 Feb 2023 16:50:38 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 -RyKxTQu_normal.jpg
pbs.twimg.com/profile_images/1512461907223003138/ 2 KB
2 KB 147ms
42ms Image
image/jpeg 2a04:4e42:41::159
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1512461907223003138/-RyKxTQu_normal.jpg

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:41::159 Vienna, Austria, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aa1071032620a94407dff14a685398807b78ff4a1b160e4306dfc6e3a4973b85

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security: max-age=631138519
date: Tue, 21 Feb 2023 16:50:38 GMT
x-content-type-options: nosniff
x-cache: HIT, HIT
server-timing: x-cache;desc=HIT, x-tw-cdn;desc=FT
content-length: 1883
x-served-by: cache-lhr7342-LHR, cache-vie6323-VIE, cache-tw-ZZZ1
last-modified: Fri, 08 Apr 2022 16:04:33 GMT
x-tw-cdn: FT
content-type: image/jpeg
access-control-allow-origin: *
x-transaction-id: 8ed4ca6e27fd0d58
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
perf: 7626143928
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
DATA 200
OK truncated
/ 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 72ms
38ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=63f4f65d78923c000869019e&gdpr=0
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 21 Feb 2023 16:50:38 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 scout.js Show response
conversation.feathr.co/ 2 KB
2 KB 579ms
458ms Script
application/javascript 2600:9000:211a:2000:19:d5e0:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://conversation.feathr.co/scout.js
Requested by: Host: polo.feathr.co
URL: https://polo.feathr.co/v1/accounts/579f8dd88e80274b4089ec04/pixel.js?pk=feathr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:2000:19:d5e0:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 388e4ddc496764c9a082b55e69a08ec605eb7342496424a71641900fe74a30c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
x-amz-version-id: r_NxzVh2200Q9ZZj6EFuLr7A20QImw9C
via: 1.1 881b12332738e10f6e80298fbdcd7e8e.cloudfront.net (CloudFront)
last-modified: Tue, 11 Aug 2020 14:45:02 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-C2
etag: "a50a00ec74289134f1a7b7a4d0d18df9"
x-cache: Miss from cloudfront
content-type: application/javascript
cache-control: no-cache
accept-ranges: bytes
content-length: 2092
x-amz-cf-id: iINIjnUivcBLwzjw5zLghu26uXpZZpzqMor4jkNBkfv9rPGoZfF-nw==

GET
H3 200 webworker.js
www.google.com/recaptcha/enterprise/ Frame 5EB3 102 B
134 B 52ms
50ms Other
text/javascript 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/webworker.js?hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

93e034978a170455e49d3c605349b1f68e0b995c9b9c4e0aac38851ba3d38fde

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cuYmVuZWZpdHNjb25mLmNvbTo0NDM.&hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&size=invisible&badge=inline&cb=9kubtbko5y8p
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112
x-xss-protection: 1; mode=block
expires: Tue, 21 Feb 2023 16:50:38 GMT

GET
H2 200 script.js Show response
polo.feathr.co/v1/analytics/match/ 290 B
567 B 112ms
112ms Script
text/javascript 54.204.247.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://polo.feathr.co/v1/analytics/match/script.js?pk=feathr&cb=1676998238390

Requested by

Host: cdn.feathr.co
URL: https://cdn.feathr.co/js/boomerang.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.247.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-247-164.compute-1.amazonaws.com

Software

nginx/1.17.8 /

Resource Hash

be8fae77cf0adacc0ebc6022588745b2e490caf613b3a6b8dc64f4f145db06f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
server: nginx/1.17.8
etag: W/"63f4f65d78923c000869019e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
cache-control: no-cache, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization

GET
H3 200 webworker.js
www.google.com/recaptcha/enterprise/ Frame 2F53 102 B
134 B 65ms
54ms Other
text/javascript 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/webworker.js?hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

93e034978a170455e49d3c605349b1f68e0b995c9b9c4e0aac38851ba3d38fde

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cuYmVuZWZpdHNjb25mLmNvbTo0NDM.&hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&size=invisible&badge=inline&cb=9kubtbko5y8p
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112
x-xss-protection: 1; mode=block
expires: Tue, 21 Feb 2023 16:50:38 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/712637918/ 42 B
64 B 54ms
53ms Image
image/gif 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/712637918/?random=1676998238195&cv=11&fst=1676995200000&bg=ffffff&guid=ON&async=1&gtm=45be32f0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&tiba=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3134052537&rmt_tld=0&ipr=y

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:38 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/712637918/ 42 B
64 B 27ms
27ms Image
image/gif 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/712637918/?random=1676998238195&cv=11&fst=1676995200000&bg=ffffff&guid=ON&async=1&gtm=45be32f0&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&tiba=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3134052537&rmt_tld=1&ipr=y

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:38 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 bframe Show response
www.google.com/recaptcha/enterprise/ Frame 6660 7 KB
1 KB 59ms
56ms Document
text/html 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

df4934a90cf4f3765ed378f063a615d45a8059411f73601648d7784dc61a9a5b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AR0Q-BCOqUyawrh2EMZ7ow' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitsconf.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-length: 1118
content-security-policy: script-src 'report-sample' 'nonce-AR0Q-BCOqUyawrh2EMZ7ow' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Feb 2023 16:50:38 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 200 loading.do Show response
sample.dragonforms.com/ Frame 6BBC 12 KB
5 KB 138ms
138ms Document
text/html 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

e79ddd6f7b2fbc9ecbec5855a9e8e76dafa2d27a0f7536a0b431d6b7feb3cf51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 21 Feb 2023 16:50:40 GMT
Keep-Alive: timeout=5
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/ Frame 6660 55 KB
24 KB 14ms
13ms Stylesheet
text/css 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Mon, 20 Feb 2023 11:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104049
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24605
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 05:01:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 20 Feb 2024 11:56:29 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/ Frame 6660 405 KB
161 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ea3ffab2197a506f50340ec177c79ce2c6ebc5d52d683d3b9147be4c3b7252f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 12:50:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14405
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164853
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 05:01:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 21 Feb 2024 12:50:33 GMT

GET
H/1.1 200 loading.do Show response
sample.dragonforms.com/ Frame A745 12 KB
5 KB 130ms
130ms Document
text/html 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

2dce87f13c6de8da14d945ca99efc71cfb9178bb8c6f76fe1a00b5ad529c9802

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sample.dragonforms.com/init.do?dragoniframe=true&omedasite=HBLCSignup_December2022
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 21 Feb 2023 16:50:40 GMT
Keep-Alive: timeout=5
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 14ms
14ms Image
image/gif 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1258445836&t=event&ni=1&_s=3&dl=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&ul=en-us&de=UTF-8&dt=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=video%3Ahtml5&ea=play&el=https%3A%2F%2Fwww.benefitsconf.com%2Fdownloads%2Findex_agendalive.mp4&_u=YDDACEABBAAAACAAI~&jid=&gjid=&cid=1929351510.1676998237&tid=UA-34066983-7&_gid=749355463.1676998237&gtm=45He32f0n81NBRDPRC&z=1967733359

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Feb 2023 18:06:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 81841
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 195 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c7260fac65e4f7ac5cf524f8ca96efd419cbb5a9b18a3e06e44c448581e9093

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H3 200 reload Show response
www.google.com/recaptcha/enterprise/ Frame 6660 39 KB
24 KB 115ms
114ms XHR
application/json 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/reload?k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8527f2e614209fdc43eeda9bc23e2401da9f7ae7903dc9a06b5d2634c4724f97

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24281
x-xss-protection: 1; mode=block
expires: Tue, 21 Feb 2023 16:50:38 GMT

POST
H/1.1 200 p Show response
cdp.omeda.com/olytics/segments/ 2 KB
2 KB 192ms
191ms XHR
application/json 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdp.omeda.com/olytics/segments/p

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.159 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

my.omedastaging.com

Software

Apache /

Resource Hash

2a1b90e46ead192efc20b4e3e953a928a34c51fc15d5f9e4dfda4822043ff761

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitsconf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

OPTIONS
H/1.1 200 p
cdp.omeda.com/olytics/segments/ Frame 0
0 602ms
122ms Preflight 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdp.omeda.com/olytics/segments/p
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.180.130.159 Lincolnshire, United States, ASN53866 (QTS-AS, US),
Reverse DNS: my.omedastaging.com
Software: Apache /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.benefitsconf.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-max-age,accept-language,origin,x-requested-with,access-control-request-headers,host,content-type,access-control-request-method,accept-encoding,accept,user-agent
Access-Control-Allow-Methods: HEAD,DELETE,POST,GET,OPTIONS,PUT
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Content-Length: 0
Date: Tue, 21 Feb 2023 16:50:39 GMT
Keep-Alive: timeout=5
Server: Apache
vary: access-control-request-method,Access-Control-Request-Headers

GET
H/1.1 200 galway_site_11b.css
hostedcontent.dragonforms.com/hosted/images/dragon/generic/11/ Frame 6BBC 31 KB
31 KB 623ms
118ms Stylesheet
text/css 205.162.42.5
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hostedcontent.dragonforms.com/hosted/images/dragon/generic/11/galway_site_11b.css

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.162.42.5 Overland Park, United States, ASN53866 (QTS-AS, US),

Reverse DNS

cdn.omeda.com

Software

Apache /

Resource Hash

29510ec67f3d99ddce408e445cb93ed5313f6cee1019ada79c2030b92398eca2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 Aug 2021 12:29:46 GMT
Server: Apache
ETag: W/"31492-1628252986223"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H2 200 jquery-2.2.4.min.js Show response
code.jquery.com/ Frame 6BBC 84 KB
29 KB 76ms
15ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer: https://sample.dragonforms.com/
Origin: https://sample.dragonforms.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
etag: W/"28feccc0-14e4a"
vary: Accept-Encoding
x-hw: 1676998238.dop154.fr8.t,1676998238.cds109.fr8.hn,1676998238.cds140.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29811

GET
H/1.1 200 conditional.js Show response
x.dragonforms.com/js/ Frame 6BBC 35 KB
35 KB 633ms
141ms Script
application/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://x.dragonforms.com/js/conditional.js?build=V23.3-20230216

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

89e0d5e92136af3c2f1d53d4bd524e308554a0ddf9e44a5bd89ab2e2bdbddd7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 29 Dec 2022 18:08:56 GMT
Server: Apache
ETag: W/"35615-1672337336000"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 dragonCampaign.js Show response
x.dragonforms.com/js/ Frame 6BBC 13 KB
13 KB 633ms
141ms Script
application/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://x.dragonforms.com/js/dragonCampaign.js?build=V23.3-20230216

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

f084eb3b60be7c6309cc5ff62056f29deba6ae55270642089f04f035d9cb3738

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 01 Nov 2022 12:59:08 GMT
Server: Apache
ETag: W/"13287-1667307548000"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 generic.css
x.dragonforms.com/style/ Frame 6BBC 2 KB
1 KB 621ms
131ms Stylesheet
text/css 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://x.dragonforms.com/style/generic.css?build=V23.3-20230216

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

a75268aabd3efca2333dda30048a44d566fca0fa0c70f87249784d6c4dbaaa50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 15:35:48 GMT
Server: Apache
ETag: W/"2478-1623339348000"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 272.css
hostedcontent.dragonforms.com/hosted/images/dragon/12312/ Frame 6BBC 1 KB
2 KB 627ms
120ms Stylesheet
text/css 205.162.42.5
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hostedcontent.dragonforms.com/hosted/images/dragon/12312/272.css

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.162.42.5 Overland Park, United States, ASN53866 (QTS-AS, US),

Reverse DNS

cdn.omeda.com

Software

Apache /

Resource Hash

e73231bc4c1c41d0f09fa0b0134da4c37e65764dad4b71890e74244d7d29d331

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 15 Dec 2022 19:25:57 GMT
Server: Apache
ETag: W/"1473-1671132357512"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 217.gif
cdn.omeda.com/hosted/images/dragon/generic/ Frame 6BBC 9 KB
9 KB 114ms
114ms Image
image/gif 205.162.42.5
QTS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.omeda.com/hosted/images/dragon/generic/217.gif

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.162.42.5 Overland Park, United States, ASN53866 (QTS-AS, US),

Reverse DNS

cdn.omeda.com

Software

Apache /

Resource Hash

056dd44aece96c67e45ba421d734f125e1497bbdb3b70194b7aadb8a68d10085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Aug 2016 18:47:04 GMT
Server: Apache
ETag: W/"8851-1472150824391"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 olyticsLinkAssistance.js Show response
sample.dragonforms.com/js/ Frame 6BBC 4 KB
4 KB 118ms
118ms Script
application/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/js/olyticsLinkAssistance.js

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

2deb0d094a307e99fcaa3dfd02f9802de8e485134d85a2f1d2d77d453dc8b934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 25 Jul 2022 13:12:48 GMT
Server: Apache
ETag: W/"4025-1658754768000"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 embeddedomedaside.js Show response
sample.dragonforms.com/js/ Frame 6BBC 904 B
1 KB 117ms
116ms Script
application/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/js/embeddedomedaside.js

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

22dc159d88c7312cbdd62f6e036cd4424f6eff270e6e6f062446275bfe515ded

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 01 Nov 2022 12:59:08 GMT
Server: Apache
ETag: W/"904-1667307548000"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 galway_site_11b.css
hostedcontent.dragonforms.com/hosted/images/dragon/generic/11/ Frame A745 31 KB
31 KB 617ms
118ms Stylesheet
text/css 205.162.42.5
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hostedcontent.dragonforms.com/hosted/images/dragon/generic/11/galway_site_11b.css

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.162.42.5 Overland Park, United States, ASN53866 (QTS-AS, US),

Reverse DNS

cdn.omeda.com

Software

Apache /

Resource Hash

29510ec67f3d99ddce408e445cb93ed5313f6cee1019ada79c2030b92398eca2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 Aug 2021 12:29:46 GMT
Server: Apache
ETag: W/"31492-1628252986223"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H2 200 jquery-2.2.4.min.js Show response
code.jquery.com/ Frame A745 84 KB
29 KB 73ms
25ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer: https://sample.dragonforms.com/
Origin: https://sample.dragonforms.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-encoding: gzip
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
etag: W/"28feccc0-14e4a"
vary: Accept-Encoding
x-hw: 1676998238.dop154.fr8.t,1676998238.cds109.fr8.hn,1676998238.cds140.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29811

GET
H/1.1 200 conditional.js Show response
x.dragonforms.com/js/ Frame A745 35 KB
35 KB 614ms
132ms Script
application/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://x.dragonforms.com/js/conditional.js?build=V23.3-20230216

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

89e0d5e92136af3c2f1d53d4bd524e308554a0ddf9e44a5bd89ab2e2bdbddd7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 29 Dec 2022 18:08:56 GMT
Server: Apache
ETag: W/"35615-1672337336000"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 dragonCampaign.js Show response
x.dragonforms.com/js/ Frame A745 13 KB
13 KB 633ms
142ms Script
application/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://x.dragonforms.com/js/dragonCampaign.js?build=V23.3-20230216

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

f084eb3b60be7c6309cc5ff62056f29deba6ae55270642089f04f035d9cb3738

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 01 Nov 2022 12:59:08 GMT
Server: Apache
ETag: W/"13287-1667307548000"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 generic.css
x.dragonforms.com/style/ Frame A745 2 KB
1 KB 622ms
144ms Stylesheet
text/css 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://x.dragonforms.com/style/generic.css?build=V23.3-20230216

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

a75268aabd3efca2333dda30048a44d566fca0fa0c70f87249784d6c4dbaaa50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Jun 2021 15:35:48 GMT
Server: Apache
ETag: W/"2478-1623339348000"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 272.css
hostedcontent.dragonforms.com/hosted/images/dragon/12312/ Frame A745 1 KB
2 KB 636ms
117ms Stylesheet
text/css 205.162.42.5
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hostedcontent.dragonforms.com/hosted/images/dragon/12312/272.css

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.162.42.5 Overland Park, United States, ASN53866 (QTS-AS, US),

Reverse DNS

cdn.omeda.com

Software

Apache /

Resource Hash

e73231bc4c1c41d0f09fa0b0134da4c37e65764dad4b71890e74244d7d29d331

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 15 Dec 2022 19:25:57 GMT
Server: Apache
ETag: W/"1473-1671132357512"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 217.gif
cdn.omeda.com/hosted/images/dragon/generic/ Frame A745 9 KB
9 KB 119ms
116ms Image
image/gif 205.162.42.5
QTS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.omeda.com/hosted/images/dragon/generic/217.gif

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.162.42.5 Overland Park, United States, ASN53866 (QTS-AS, US),

Reverse DNS

cdn.omeda.com

Software

Apache /

Resource Hash

056dd44aece96c67e45ba421d734f125e1497bbdb3b70194b7aadb8a68d10085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:38 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Aug 2016 18:47:04 GMT
Server: Apache
ETag: W/"8851-1472150824391"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 olyticsLinkAssistance.js Show response
sample.dragonforms.com/js/ Frame A745 4 KB
4 KB 118ms
118ms Script
application/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/js/olyticsLinkAssistance.js

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

2deb0d094a307e99fcaa3dfd02f9802de8e485134d85a2f1d2d77d453dc8b934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 25 Jul 2022 13:12:48 GMT
Server: Apache
ETag: W/"4025-1658754768000"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 embeddedomedaside.js Show response
sample.dragonforms.com/js/ Frame A745 904 B
1 KB 220ms
117ms Script
application/javascript 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/js/embeddedomedaside.js

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

22dc159d88c7312cbdd62f6e036cd4424f6eff270e6e6f062446275bfe515ded

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 01 Nov 2022 12:59:08 GMT
Server: Apache
ETag: W/"904-1667307548000"
Transfer-Encoding: chunked
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H2 200 17458-56928242cf92.json Show response
cdn.aimtell.io/config/ 192 B
318 B 632ms
632ms XHR
application/json 2606:4700:10::ac43:1ee1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aimtell.io/config/17458-56928242cf92.json
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/cdn.aimtell.com/trackpush/trackpush.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1ee1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c81a0fd4e783798145e9fd484d388f77de9213d039d6e218b5f876e801b48a85

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
content-encoding: gzip
via: 1.1 6c183700546a331def0de99cb43d1574.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
x-amz-cf-pop: HEL50-C2
x-cache: Miss from cloudfront
content-length: 152
last-modified: Fri, 05 Feb 2021 19:03:34 GMT
server: cloudflare
etag: "420588b327ce60ee7def0e763c42810d"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: ETag
cache-control: max-age=86400
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
cf-ray: 79d0fb70ab539b55-FRA
x-amz-cf-id: XMvQQqOxcdY5Ki38jLBInZyCzbTDCRIuN9j5kXeLWj-gMRoKxEJkEg==

GET
H2 200 /
www.facebook.com/tr/ 0
54 B 10ms
10ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=373302336383956&ev=Microdata&dl=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&rl=&if=false&ts=1676998238840&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023%22%2C%22meta%3Adescription%22%3A%22%20Simply%20put%2C%20there%E2%80%99s%20a%20lot%20riding%20on%20you%20benefits%20strategy%20and%20in%20today%27s%20environment%20your%20benefits%20strategy%20has%20never%20been%20more%20important.%20HBLC%20can%20help.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.96&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1676998237301.977002901&it=1676998237142&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 21 Feb 2023 16:50:38 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 main.js Show response
conversation.feathr.co/45ca9e2/ Frame 0370 610 KB
183 KB 30ms
29ms Script
application/javascript 2600:9000:211a:2000:19:d5e0:9640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://conversation.feathr.co/45ca9e2/main.js
Requested by: Host: conversation.feathr.co
URL: https://conversation.feathr.co/scout.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:2000:19:d5e0:9640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eee34cf6d317d2fd9391f07b9606de9d8a202c2d74fcef40d20dc4f1d21b5479

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-amz-version-id: PXoKW.2YNX04dHHRJP70g9XdmHaeXu32
content-encoding: gzip
via: 1.1 881b12332738e10f6e80298fbdcd7e8e.cloudfront.net (CloudFront)
date: Mon, 20 Feb 2023 21:05:09 GMT
last-modified: Tue, 11 Aug 2020 14:44:59 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-C2
age: 71130
etag: W/"b03cec7db26be7aef32aa8ab0c9bea62"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: yvzdlJze38X2de4y7SP6upibT1dWa5O1kgwnLSz9AoS14Xh1WwpNbw==

GET
H3 200 refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame 6660 600 B
624 B 21ms
21ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/refresh_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Thu, 16 Feb 2023 22:42:01 GMT
x-content-type-options: nosniff
age: 410917
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 23 Feb 2023 22:42:01 GMT

GET
H3 200 audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame 6660 530 B
554 B 21ms
20ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/audio_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Thu, 16 Feb 2023 22:56:53 GMT
x-content-type-options: nosniff
age: 410025
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 530
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 23 Feb 2023 22:56:53 GMT

GET
H3 200 info_2x.png
www.gstatic.com/recaptcha/api2/ Frame 6660 665 B
689 B 22ms
20ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/info_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/O4xzMiFqEvA4YhWjk5t8Xuas/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 15 Feb 2023 15:20:06 GMT
x-content-type-options: nosniff
age: 523832
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 665
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Wed, 22 Feb 2023 15:20:06 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 6660 15 KB
16 KB 60ms
14ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Thu, 16 Feb 2023 15:27:04 GMT
x-content-type-options: nosniff
age: 437014
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 16 Feb 2024 15:27:04 GMT

GET
H2 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 6660 15 KB
15 KB 74ms
29ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Sun, 19 Feb 2023 07:57:55 GMT
x-content-type-options: nosniff
age: 204763
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15340
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 19 Feb 2024 07:57:55 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 6660 15 KB
15 KB 63ms
18ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Wed, 15 Feb 2023 18:28:44 GMT
x-content-type-options: nosniff
age: 512514
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 Feb 2024 18:28:44 GMT

GET
H3 200 payload
www.google.com/recaptcha/enterprise/ Frame 6660 28 KB
28 KB 51ms
51ms Image
image/jpeg 2a00:1450:400d:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/recaptcha/enterprise/payload?p=06AFY_a8U3X2iL0J8u8V3Mfz6igbw2K0Pmb_YZPv1eAiWqN1b71WILowMPH8ykobDF-mxFkP5lfIKI-mRc6IO5z7ZQYcdJFsy4fYHYp7UIr67B4pEHO4xUWFxeWNeKyCgNOQ-67Zh1N1e3HcG1tazZzbwVzgSACChpN2a5r-1b15DecjjC9b9pLLZvdcOTSAwNm6UOGnltTyHDkPnyZyh1lGFimN-dJy2W8w&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Requested by

Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

91b7cfa043307269076c97781c8612e09316b998ff87dfc27ebc0057dddc61bd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=O4xzMiFqEvA4YhWjk5t8Xuas&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:38 GMT
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: private, max-age=30
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28878
x-xss-protection: 1; mode=block
expires: Tue, 21 Feb 2023 16:50:38 GMT

GET
H2 200 css
fonts.googleapis.com/ 664 B
765 B 65ms
25ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato

Requested by

Host: conversation.feathr.co
URL: https://conversation.feathr.co/45ca9e2/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5a9f9b8fdda3dc64dc104281767edc8ce0798cd76bfc307c17a7c7b4db115c86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Feb 2023 16:50:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Feb 2023 15:35:12 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Feb 2023 16:50:39 GMT

GET
H2 200 question Show response
polo.feathr.co/v1/accounts/579f8dd88e80274b4089ec04/ Frame 0370 18 B
349 B 122ms
121ms Fetch
application/json 54.204.247.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://polo.feathr.co/v1/accounts/579f8dd88e80274b4089ec04/question?f_id=63f4f65d78923c000869019e&loc_url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O

Requested by

Host: conversation.feathr.co
URL: https://conversation.feathr.co/45ca9e2/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.247.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-247-164.compute-1.amazonaws.com

Software

nginx/1.17.8 /

Resource Hash

c9ada4c300c7ae31a34c4b23ce68bb4a96a07db8b8e12d7e8adca1fdc1584cb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
strict-transport-security: max-age=15724800; includeSubDomains
server: nginx/1.17.8
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length: 18

GET
H2 200 4040.json Show response
cdn.aimtell.com/prompts/ 8 KB
3 KB 99ms
57ms XHR
application/json 2606:4700::6812:1e97
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aimtell.com/prompts/4040.json?cb=1676998239
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/cdn.aimtell.com/trackpush/trackpush.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1e97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a78fcefc852aff6de32c4d9b843e5f55311f9e92798033edac6c55edccf18e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
via: 1.1 57a9fd6199fd862b4428c6c309905a74.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
x-amz-cf-pop: MXP64-C3
age: 9565
x-cache: Hit from cloudfront
last-modified: Fri, 05 Feb 2021 19:03:11 GMT
server: cloudflare
etag: W/"7fd3c5630bc47014d24830846db2061f"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: ETag
vary: Origin
cf-ray: 79d0fb74e9dc35f4-FRA
x-amz-cf-id: uTfUd8fKw1jjxwOUv4mMRP0s3KoeI4xmULI-5nqmnvY3fTKdfxYVUA==

GET
H/1.1

200
OK

pixel.jpg
s3.amazonaws.com/cdn.aimtell.com/prompt/
Redirect Chain

https://analytics.aimtell.com/prompt-view?id_site=17458&prompt_type=3&prompt_id=4040
https://s3.amazonaws.com/cdn.aimtell.com/prompt/pixel.jpg

269 B
626 B

116ms
116ms

Image
image/jpeg

52.216.43.24
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cdn.aimtell.com/prompt/pixel.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: HTTP/1.1
Server: 52.216.43.24 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7a45b8766d855498d60f288238e213f35ca4257229d22cb3ca2f76e4e42f167e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:40 GMT
Last-Modified: Wed, 26 Sep 2018 23:30:38 GMT
Server: AmazonS3
x-amz-request-id: QGRMH5KQ7B6X27X8
ETag: "651cb11ef0b9b30cd2a184a109d6a83c"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 269
x-amz-id-2: z1CAnYIxGGn6wKpq3fZ57+qx7qHjbhHsxC1zwtXyyXQ/Zlp20ISIKPpMJ08RQc5lALYOPCr8nVQ=

Redirect headers

date: Tue, 21 Feb 2023 16:50:39 GMT
via: 1.1 76fb21fcb70866221c67558e2f776540.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
x-amzn-trace-id: Root=1-63f4f65f-5d1074e44a6c83e2415b9be0;Sampled=0
x-amzn-requestid: 642b93f1-efd1-4a05-9ce5-1c36a95930dd
x-cache: Miss from cloudfront
content-type: application/json
location: https://s3.amazonaws.com/cdn.aimtell.com/prompt/pixel.jpg
x-amz-apigw-id: Astu_GVNIAMFZFw=
content-length: 0
x-amz-cf-id: Udr41-cOh1OiBg8-tVCO9rcrrM9zZ-x64kwkvYZJ09VXLeOfLNAijg==

GET
H2 200 icon_17458_1571073648.jpg
cdn.aimtell.io/user/uploads/siteicons.aimtell.com/ 34 KB
34 KB 614ms
585ms Image
image/jpeg 2606:4700:10::ac43:1ee1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.aimtell.io/user/uploads/siteicons.aimtell.com/icon_17458_1571073648.jpg
Requested by: Host: www.benefitsconf.com
URL: https://www.benefitsconf.com/?utm_source=hre&utm_medium=email&utm_campaign=bn23_hre_022123&utm_content=banner&oly_enc_id=0917H4532089H7O
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1ee1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd639aba89845d31a57ad67d0cbfa6165a62f175dca399bbff55d4acd5b2e876

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:40 GMT
via: 1.1 86e0eb6c8f3eea90e0cc2d99e58af96e.cloudfront.net (CloudFront)
cf-cache-status: MISS
last-modified: Mon, 23 Dec 2019 22:09:53 GMT
server: cloudflare
x-amz-cf-pop: MXP64-C2
etag: "8e9b76d09c617ccb0084e712d87b0859"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 79d0fb758e44366e-FRA
content-length: 34487
x-amz-cf-id: Pz7hZHALmPuucDZIysLTlFligUgje9aakQMC4dtUExmWEHJQbB2D0w==

GET
H2 200 olytics.min.js Show response
olytics.omeda.com/olytics/js/v3/p/ Frame 6BBC 263 KB
72 KB 11ms
10ms Script
application/javascript 2600:9000:20eb:2200:1e:5cef:3780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:2200:1e:5cef:3780:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

3bb51322ad907cbce304cb075d28ffa672f3c649e8cc502315c4d4044df11f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 11:45:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 18303
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 12 Oct 2022 19:43:20 GMT
server: Apache
etag: W/"269579-1665603800000"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=21600
accept-ranges: bytes
x-amz-cf-id: QeBTY2r7lu6AIotBge6C_mas1sOtPJyxUM3IQIQODR3Hs3OsPd4l8Q==
expires: Thu, 16 Feb 2023 11:45:34 GMT

GET
H2 200 olytics.min.js Show response
olytics.omeda.com/olytics/js/v3/p/ Frame A745 263 KB
72 KB 15ms
10ms Script
application/javascript 2600:9000:20eb:2200:1e:5cef:3780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Requested by

Host: sample.dragonforms.com
URL: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:2200:1e:5cef:3780:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

3bb51322ad907cbce304cb075d28ffa672f3c649e8cc502315c4d4044df11f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 11:45:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
via: 1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
age: 18303
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 12 Oct 2022 19:43:20 GMT
server: Apache
etag: W/"269579-1665603800000"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=21600
accept-ranges: bytes
x-amz-cf-id: 9AzOfRT79jUZB1O4v9Se8htdJrc0pssNZDzMc91wmsxPaDdFc-MsdQ==
expires: Thu, 16 Feb 2023 11:45:34 GMT

HEAD
H2 200 adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 6BBC 0
0 126ms
125ms Fetch
text/javascript 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49380
x-xss-protection: 0
server: cafe
etag: 8093036920470464828
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 21 Feb 2023 16:50:39 GMT

HEAD
H2 200 adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame A745 0
0 204ms
203ms Fetch
text/javascript 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49383
x-xss-protection: 0
server: cafe
etag: 1735768029220363630
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 21 Feb 2023 16:50:39 GMT

GET
H/1.1 200 evaluateConditionalContent.do;jsessionid=1271A36B22C212A86F0955FD40E67FDB Show response
sample.dragonforms.com/ Frame 6BBC 196 B
487 B 127ms
126ms XHR
text/x-json 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sample.dragonforms.com/evaluateConditionalContent.do;jsessionid=1271A36B22C212A86F0955FD40E67FDB?opt32361=1&demo32351=&demo32352=&demo32353=&demo32354=&demo32355=&demo32356=&demo32357=&dragon_pagenumber=1&jsessionid=1271A36B22C212A86F0955FD40E67FDB&timestemp=1676998239771&omedasite=HBLCSignup_December2022

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-2.2.4.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

6debe819b1c972061dbabc633aae5b29675b25c2b44a87029f5207a38940af83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/x-json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 evaluateConditionalContent.do;jsessionid=1271A36B22C212A86F0955FD40E67FDB Show response
sample.dragonforms.com/ Frame 6BBC 196 B
487 B 121ms
120ms XHR
text/x-json 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-2.2.4.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

6debe819b1c972061dbabc633aae5b29675b25c2b44a87029f5207a38940af83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/x-json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

HEAD
H2 200 gpt.js
www.googletagservices.com/tag/js/ Frame 6BBC 0
0 65ms
65ms Fetch
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1489 / 283 of 1000 / last-modified: 1676981271"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 21 Feb 2023 16:50:39 GMT

GET
H/1.1 200 evaluateConditionalContent.do;jsessionid=1271A36B22C212A86F0955FD40E67FDB Show response
sample.dragonforms.com/ Frame A745 196 B
487 B 115ms
115ms XHR
text/x-json 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-2.2.4.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

6debe819b1c972061dbabc633aae5b29675b25c2b44a87029f5207a38940af83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/x-json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

GET
H/1.1 200 evaluateConditionalContent.do;jsessionid=1271A36B22C212A86F0955FD40E67FDB Show response
sample.dragonforms.com/ Frame A745 196 B
487 B 127ms
117ms XHR
text/x-json 204.180.130.190
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-2.2.4.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.190 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

6debe819b1c972061dbabc633aae5b29675b25c2b44a87029f5207a38940af83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://sample.dragonforms.com/loading.do?dragoniframe=true&omedasite=HBLCSignup_December2022
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Tue, 21 Feb 2023 16:50:42 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/x-json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

HEAD
H3 200 gpt.js
www.googletagservices.com/tag/js/ Frame A745 0
0 67ms
66ms Fetch
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sample.dragonforms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26514
x-xss-protection: 0
server: sffe
etag: "1489 / 886 of 1000 / last-modified: 1676981271"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 21 Feb 2023 16:50:39 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
895 B 176ms
139ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1878800189&v=1.1&a=4487427&rcu=https%3A%2F%2Fwww.benefitsconf.com%2F&pu=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&t=HRE%27S+Health+%26+Benefits+Leadership+Conference+2023&cts=1676998240197&vi=63400161ffe975683cd51267dbe7ce38&nc=true&u=101894535.63400161ffe975683cd51267dbe7ce38.1676998240192.1676998240192.1676998240192.1&b=101894535.1.1676998240193&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 47f55a70-3643-44ea-8d14-41bdc970f5a6
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HTIOCiD4cVJf0wPI%2FAHMTUciqyslVMMgPsJjMR2K5L6cz5R%2FexitVjKKBCMM1fcjsnDoNSDAZV1CRhocJjwjBiwZBHao2I%2ByET5767KZCM8UxJQqXVXiNkNZUDbCOTlQI8MvOKNY8eE94Ik5CVz8"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 79d0fb799fad9962-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
558 B 173ms
144ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=b7be973f-779b-4e48-a66f-eb18baeefdee&fci=3d35399d-e72a-4549-a159-581617319d40&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1878800189&v=1.1&a=4487427&rcu=https%3A%2F%2Fwww.benefitsconf.com%2F&pu=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&t=HRE%27S+Health+%26+Benefits+Leadership+Conference+2023&cts=1676998240210&vi=63400161ffe975683cd51267dbe7ce38&nc=true&u=101894535.63400161ffe975683cd51267dbe7ce38.1676998240192.1676998240192.1676998240192.1&b=101894535.1.1676998240193&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 4cd725fd-d193-4863-9c8d-24294dc4f4c1
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f7XP0duvpYD5sO7B3YdFVJUHY1qlbpZ3Q3hy16uYHCXibjIkOIRkpT945vMrdMQXcp0BhpeV2g%2FHY4icQcbLst1fWhhChR6qzkAllHRVjG61wIsVVeWEBcUz1xnBTM%2BI2H%2BqJWR%2FB6C5sc%2BVh374"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 79d0fb799fb09962-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
555 B 172ms
143ms Image
image/gif 2606:4700::6813:9b53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=17&fi=b7be973f-779b-4e48-a66f-eb18baeefdee&fci=3d35399d-e72a-4549-a159-581617319d40&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1878800189&v=1.1&a=4487427&rcu=https%3A%2F%2Fwww.benefitsconf.com%2F&pu=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&t=HRE%27S+Health+%26+Benefits+Leadership+Conference+2023&cts=1676998240212&vi=63400161ffe975683cd51267dbe7ce38&nc=true&u=101894535.63400161ffe975683cd51267dbe7ce38.1676998240192.1676998240192.1676998240192.1&b=101894535.1.1676998240193&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9b53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: 0825292d-bbbb-4655-b97f-464a1fa48502
p3p: CP="NOI CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 45
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Tk2S72h2nEL8Bk8HehnoGONlBZlSiZFH7gmdtP49mGI4YD4Gq4irGD%2F6ZFFNrlB59wNag4eHtKwCYUjhXg3uUHB4uoSzJEQ6SL%2BPt%2BP1inJlTyII6DKj7HnbzFoJwY%2B2%2BE1uvOBTMCzill13ta4"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 79d0fb799fb19962-FRA
x-robots-tag: none

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 220 B
1 KB 197ms
162ms XHR
application/json 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=4487427&utk=63400161ffe975683cd51267dbe7ce38&__hstc=101894535.63400161ffe975683cd51267dbe7ce38.1676998240192.1676998240192.1676998240192.1&__hssc=101894535.1.1676998240193&currentUrl=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b9c2a70c25715c5d368b7c96a5ddbd1f4968e671b7eaf5ccbccb8dc108b32ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id: b695738b-4c9a-4b35-ab22-7b77d73babae
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.benefitsconf.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cyPIcItcyewmPvZXuxr6yAnbE%2F0szcVTIBFv7CJxJfITCvEvz4HDB0NWrA5G9Aty6vSEgT8YviVhLleIPMJ%2Fwa0Cgxjg1faFI9YHC9aYkIAiKmiLwWb5hJ5ELdBqIyXIOZuSQUNYrxPXC77hdwU%2F"}],"group":"cf-nel","max_age":604800}
access-control-max-age: 180
access-control-allow-credentials: false
cache-control: max-age=0, no-cache, no-store
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
cf-ray: 79d0fb79ed64362a-FRA

POST
H/1.1 204 p Show response
cdp.omeda.com/olytics/segments/ Frame 6BBC 0
244 B 492ms
374ms XHR
text/plain 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdp.omeda.com/olytics/segments/p

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.159 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

my.omedastaging.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sample.dragonforms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Date: Tue, 21 Feb 2023 16:50:43 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

OPTIONS
H/1.1 200 p
cdp.omeda.com/olytics/segments/ Frame 0
0 114ms
113ms Preflight 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdp.omeda.com/olytics/segments/p
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.180.130.159 Lincolnshire, United States, ASN53866 (QTS-AS, US),
Reverse DNS: my.omedastaging.com
Software: Apache /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://sample.dragonforms.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-max-age,accept-language,origin,x-requested-with,access-control-request-headers,host,content-type,access-control-request-method,accept-encoding,accept,user-agent
Access-Control-Allow-Methods: HEAD,DELETE,POST,GET,OPTIONS,PUT
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Content-Length: 0
Date: Tue, 21 Feb 2023 16:50:41 GMT
Keep-Alive: timeout=5
Server: Apache
vary: access-control-request-method,Access-Control-Request-Headers

POST
H/1.1 204 p Show response
cdp.omeda.com/olytics/segments/ Frame A745 0
244 B 434ms
189ms XHR
text/plain 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdp.omeda.com/olytics/segments/p

Requested by

Host: olytics.omeda.com
URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

204.180.130.159 Lincolnshire, United States, ASN53866 (QTS-AS, US),

Reverse DNS

my.omedastaging.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sample.dragonforms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Date: Tue, 21 Feb 2023 16:50:42 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: *
Connection: keep-alive
Keep-Alive: timeout=5
X-XSS-Protection: 1; mode=block

OPTIONS
H/1.1 200 p
cdp.omeda.com/olytics/segments/ Frame 0
0 138ms
116ms Preflight 204.180.130.159
QTS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdp.omeda.com/olytics/segments/p
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 204.180.130.159 Lincolnshire, United States, ASN53866 (QTS-AS, US),
Reverse DNS: my.omedastaging.com
Software: Apache /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://sample.dragonforms.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-max-age,accept-language,origin,x-requested-with,access-control-request-headers,host,content-type,access-control-request-method,accept-encoding,accept,user-agent
Access-Control-Allow-Methods: HEAD,DELETE,POST,GET,OPTIONS,PUT
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 1800
Connection: keep-alive
Content-Length: 0
Date: Tue, 21 Feb 2023 16:50:41 GMT
Keep-Alive: timeout=5
Server: Apache
vary: access-control-request-method,Access-Control-Request-Headers

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 20ms
20ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-N5EDPXH1HG&gtm=45je32f0&_p=1258445836&cid=1929351510.1676998237&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1676998237&sct=1&seg=0&dl=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&dt=HRE%27S%20Health%20%26%20Benefits%20Leadership%20Conference%202023&en=scroll&epn.percent_scrolled=90&_et=12
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N5EDPXH1HG&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Feb 2023 16:50:42 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitsconf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 crumb
polo.feathr.co/v1/analytics/ 43 B
499 B 125ms
125ms Image
image/gif 54.204.247.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://polo.feathr.co/v1/analytics/crumb?cb=1676998242242&a_id=579f8dd88e80274b4089ec04&f_id=63f4f65d78923c000869019e&ses_id=63f4f65d0f4f25ca56b83155&flvr=page_view&loc_url=https%3A%2F%2Fwww.benefitsconf.com%2F%3Futm_source%3Dhre%26utm_medium%3Demail%26utm_campaign%3Dbn23_hre_022123%26utm_content%3Dbanner%26oly_enc_id%3D0917H4532089H7O&s_w=1600&s_h=1200&b_w=1600&b_h=1200&cust_params=e30=&utm_params=eyJ1dG1fc291cmNlIjoiaHJlIiwidXRtX21lZGl1bSI6ImVtYWlsIiwidXRtX2NhbXBhaWduIjoiYm4yM19ocmVfMDIyMTIzIiwidXRtX2NvbnRlbnQiOiJiYW5uZXIifQ==

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.204.247.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-204-247-164.compute-1.amazonaws.com

Software

nginx/1.17.8 /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.benefitsconf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 16:50:42 GMT
strict-transport-security: max-age=15724800; includeSubDomains
server: nginx/1.17.8
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0,no-cache,no-store
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
content-length: 43

Verdicts & Comments Add Verdict or Comment

262 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

32 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 14:09:10	Name: _GRECAPTCHA Value: 09AJBLKW2hftz0_j5ktQpWA66Y1uY4jAjx9kt1EKq9idcjVvaE21ZGhF-p0EADYKpCbzHrR_AsoT617blHbnLgKsg
.benefitsconf.com/	1970-01-20 11:59:34	Name: _gcl_au Value: 1.1.1743640015.1676998237
.benefitsconf.com/	1970-01-20 19:25:58	Name: _ga_N5EDPXH1HG Value: GS1.1.1676998237.1.0.1676998237.60.0.0
.benefitsconf.com/	1970-01-20 19:25:58	Name: _ga Value: GA1.2.1929351510.1676998237
.benefitsconf.com/	1970-01-20 09:51:24	Name: _gid Value: GA1.2.749355463.1676998237
.benefitsconf.com/	1970-01-20 09:49:58	Name: _gat_UA-34066983-7 Value: 1
.www.benefitsconf.com/	1970-01-20 09:50:01	Name: feathr_session_id Value: 63f4f65d0f4f25ca56b83155
.benefitsconf.com/	1970-01-20 11:59:34	Name: _fbp Value: fb.1.1676998237301.977002901
.prfct.co/	1970-01-20 19:25:58	Name: pa_uid Value: pa_roUVmyUA4loMJCicE
.feathr.co/	1970-01-20 18:35:34	Name: f_id Value: 63f4f65d78923c000869019e
.benefitsconf.com/	1970-01-20 18:35:34	Name: oly_enc_id Value: 0917H4532089H7O
.benefitsconf.com/	1970-01-20 18:35:34	Name: oly_anon_id Value: 43e1481f-364f-41e9-b486-09fa6ac9d87d
.benefitsconf.com/	1970-01-20 18:35:34	Name: oly_fire_id Value: 8010G3569790A2H
.prfct.co/	1970-01-20 19:25:58	Name: pa_twitter_ts Value: 1676998237785
.prfct.co/	1970-01-20 19:25:58	Name: pa_yahoo_ts Value: 1676998237846
.prfct.co/	1970-01-20 19:25:58	Name: pa_openx_ts Value: 1676998237848
.prfct.co/	1970-01-20 19:25:58	Name: pa_google_ts Value: 1676998237856
.prfct.co/	1970-01-20 19:25:58	Name: pa_rubicon_ts Value: 1676998237855
.adnxs.com/	1970-01-20 11:59:34	Name: uuid2 Value: 2578812666203313262
.adnxs.com/	1970-01-20 11:59:34	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2GVRp7<M8!]tbP6j2F-XstGt!@D^N$jG!=
.yahoo.com/	1970-01-20 18:35:55	Name: A3 Value: d=AQABBF329GMCEHLlmKeXV1-ekWbAUbYWahAFEgEBAQFH9mP-YwAAAAAA_eMAAA&S=AQAAAvE49HVdKVOs-YWevmKqhMY
sample.dragonforms.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 1271A36B22C212A86F0955FD40E67FDB
.analytics.yahoo.com/	1970-01-20 18:35:34	Name: IDSYNC Value: 18z4~2a4g
.doubleclick.net/	1970-01-20 19:11:34	Name: IDE Value: AHWqTUl9Z6ZYD4dXhqrFrZU9eKoM0xtfRFophYCKxd79dXXilr64_cLdkcz_067FIBg
.twitter.com/	1970-01-20 19:25:58	Name: personalization_id Value: "v1_9pnyJOJb/BO141PeHjF++A=="
www.benefitsconf.com/	1970-01-20 12:13:58	Name: _aimtellSubscriberID Value: a9052a40-9a67-0e76-fbde-23b12b4711e3
www.benefitsconf.com/	1970-01-20 14:09:10	Name: __hstc Value: 101894535.63400161ffe975683cd51267dbe7ce38.1676998240192.1676998240192.1676998240192.1
www.benefitsconf.com/	1970-01-20 14:09:10	Name: hubspotutk Value: 63400161ffe975683cd51267dbe7ce38
www.benefitsconf.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
www.benefitsconf.com/	1970-01-20 09:50:00	Name: __hssc Value: 101894535.1.1676998240193
.hubspot.com/	1970-01-20 09:50:00	Name: __cf_bm Value: xw.bwPkIPu9gFRy.9Gy5FIkiU8iu9wkgE5k7jb48vSM-1676998240-0-AYvyBhqvcw/r9sNruerwf6MwDnE+asFne81+fPAqU20+QNZWEpp6MMxgZWCShXeRD4IMwcDE7dbRGvuUPcpwHXg=
.dragonforms.com/	1970-01-20 09:50:05	Name: oly_anon_id Value: 1164044d-90ea-47bd-9e05-b5a705305406

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1 Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
analytics.aimtell.com
analytics.twitter.com
api.hubapi.com
cdn.aimtell.com
cdn.aimtell.io
cdn.feathr.co
cdn.omeda.com
cdp.omeda.com
cm.g.doubleclick.net
code.jquery.com
connect.facebook.net
conversation.feathr.co
cs.choozle.com
d1eoo1tco6rr5e.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hsforms.com
forms.hubspot.com
googleads.g.doubleclick.net
hostedcontent.dragonforms.com
i.snoball.it
insight.adsrvr.org
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hsforms.net
js.hsleadflows.net
komito.net
lrp-conference-tweets-cdn.lrp.com
lrp.omeclk.com
marco.feathr.co
match.adsrvr.org
media-cdn.lrp.com
nexus.ensighten.com
olytics.omeda.com
oqs.omeda.com
pagead2.googlesyndication.com
pbs.twimg.com
pixel-geo.prfct.co
pixel.rubiconproject.com
pixel.sitescout.com
polo.feathr.co
region1.analytics.google.com
s3.amazonaws.com
sample.dragonforms.com
secure.adnxs.com
signals.aimtell.com
stats.g.doubleclick.net
tag.perfectaudience.com
track.hubspot.com
up.pixel.ad
ups.analytics.yahoo.com
us-u.openx.net
www.benefitsconf.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.snaphost.com
x.dragonforms.com
104.244.42.195
13.227.219.86
13.32.110.88
142.250.180.226
151.101.66.217
178.79.227.76
18.156.0.31
18.220.241.194
18.66.123.144
18.66.15.8
185.89.210.90
2001:4860:4802:32::36
2001:4de0:ac18::1:a:1a
204.180.130.159
204.180.130.165
204.180.130.190
205.162.42.171
205.162.42.5
2600:9000:20eb:2200:1e:5cef:3780:93a1
2600:9000:211a:2000:19:d5e0:9640:93a1
2600:9000:2304:ae00:1f:1336:9b40:93a1
2600:9000:2304:be00:19:16e8:6c00:93a1
2606:4700:10::ac43:1ee1
2606:4700:3030::ac43:b641
2606:4700:3031::ac43:9f5c
2606:4700:4400::ac40:9a55
2606:4700::6810:5805
2606:4700::6810:5905
2606:4700::6811:46b0
2606:4700::6811:73b0
2606:4700::6811:ba49
2606:4700::6811:cccc
2606:4700::6811:d4cc
2606:4700::6811:e8cc
2606:4700::6812:1e97
2606:4700::6812:1f97
2606:4700::6813:9a53
2606:4700::6813:9b53
2a00:1450:4001:806::2003
2a00:1450:4001:808::200a
2a00:1450:4001:809::2003
2a00:1450:4001:80f::2003
2a00:1450:4001:828::2008
2a00:1450:4001:82f::200e
2a00:1450:400c:c00::9a
2a00:1450:400d:806::2013
2a00:1450:400d:807::2002
2a00:1450:400d:807::2004
2a00:1450:400d:807::200d
2a00:1450:400d:80c::2002
2a00:1450:400d:80d::2002
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:41::159
3.212.38.84
3.212.8.231
3.33.220.150
35.244.159.8
52.216.43.24
52.51.88.84
54.204.247.164
69.173.144.139
98.98.134.242
00fea3cb5f6e82dbf5f065152e88e91e54441b7ca0e66d26622abd50f46485bd
034d23d374bb4f4c64a5dcbc2a46d65b457a5f1b17bf6408649fce4053bbb667
056dd44aece96c67e45ba421d734f125e1497bbdb3b70194b7aadb8a68d10085
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
06fd2a61dce61487dc324f208fdf13c255b8b1d2c6969c27609bde27488f0fa3
0c2edd9c060959f3a4ce693a92b02aff014128f480c5448ea1d175bad387de89
0c7260fac65e4f7ac5cf524f8ca96efd419cbb5a9b18a3e06e44c448581e9093
0d932ae11206d9a743fe498f92698840424c976675581b4ebea9e10d4f9a0f3d
0e2f9a557b3441ebae77ecc26c6e3d39342098eaf6172f90251f92fb94fe2afa
0ea3ffab2197a506f50340ec177c79ce2c6ebc5d52d683d3b9147be4c3b7252f
11ec04e3948e25a0d78d2f77c04940b8e38a086624ec36fa4605a2a69b133e94
1293e3506982748302639480f0f48632d08373e924b66490fb81b80351ec0adc
14a5246760b47c071f0cc864d329b2d5785396992e89840d394c7c9ba3cd765a
152c2e4c0a662dd6ae6a1ca2cce86c993e9d74ca439cfc2f24d9dd8122c80f8a
1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75
22dc159d88c7312cbdd62f6e036cd4424f6eff270e6e6f062446275bfe515ded
22f03a715af554edf5134e43b7a065bc7824c89a8958324c633e99b243c2e18d
25b33a7a853f39e447b14be3e6662ccbb0fbce73620bf7778d194cb3fef1d3ab
266aff3fc7e6ecb0744c9298682c8367d834de8820bc2068b31319935b474394
29510ec67f3d99ddce408e445cb93ed5313f6cee1019ada79c2030b92398eca2
2a1b90e46ead192efc20b4e3e953a928a34c51fc15d5f9e4dfda4822043ff761
2a4bad82232cf44040fea652139262d374f7486fda6b57b0fb71506031e23b02
2da884cb570bb3fee3c04a1a34c97c269c4293576c38e93769db1a21b85e3a99
2dce87f13c6de8da14d945ca99efc71cfb9178bb8c6f76fe1a00b5ad529c9802
2deb0d094a307e99fcaa3dfd02f9802de8e485134d85a2f1d2d77d453dc8b934
309fde87f27e8c8978bc54746aa94680a719ae9117360b7e5bdf22a4360b9dc9
388e4ddc496764c9a082b55e69a08ec605eb7342496424a71641900fe74a30c3
394dce01889c9cb296e4a034a7e5b9aa0ad75ee76e5c46feb5fadde1a98fc16d
3bb51322ad907cbce304cb075d28ffa672f3c649e8cc502315c4d4044df11f7a
3cce063b8d8aa0c8eac285f21bd28ded1ebccb155d38bb056d36d5e93f7bd3e9
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
459e1227107ccdcd4673ad029766cc0580b9ce4f009aada727b34f79ff0e429d
47e2635ae2223f06b3d3269ec2fc9cb28626a3d2d9dcd8d467726677b36f7df1
4abf8351a6089c18d18736af30f4834064af88ee0f69f3628c71d30ded501eb8
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e3959637a13b1ff669c23109a2b48dab946977b7471687e74891c6cae784f1f
54b0375303af2aaf27f66ad711ae7fafe8450c9c13f0bee02ea57fbc3179d64a
552da695674e5ff5a53e685eac5440a231023675c5098e54c1516e73ec99f35a
552dc1f313637549ce29efbc8ae81958a805e171b3447967f68f29362ca3f4b0
559382b44a7cb0b397c474fe76532f50b622824e15440784425d1f4a42a991de
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
564c234dd0dafe8c491cbf815082fc3e2e9f567b89d5c25b1009b1aaf6621476
56e9751d017d12d694283b84dd62c4c85f3dace7036a8b67ce5d3dcf43965214
59332ddb4c5cefa0042a4d50f2bbd9e9434e858c747a7188aa8348905f55874f
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5a9f9b8fdda3dc64dc104281767edc8ce0798cd76bfc307c17a7c7b4db115c86
610e87dba4ec17fd6bf02c806a6efda5c3f696f0b8873d32d522e7d413470274
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
63009d0b82c390e3a912d34faed89930393f2a1c27474755f7be915617c31994
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
68330f6767efe4ea90f23cb4bb722810d19758395bc24f59c7c893c0d4ae69ce
690a73d63e9c4a96ce46d5753fb08c416ad9f30af239cf4a580a75317705ec35
693f67332d3b3d2e74b4803a895cc41e7822c7cc518e067804916c0fcd41d7e2
6a0bfa4680852481bf6f9de4382bb32fdd80988337a69f414f19791a9fdd882e
6ac3cfaae4ec74e7e74d180ef0154743b47feaf8b41f8ad2e71c884e854eab6c
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b27680030fe8b77e821e00c77eda750ec8caa8c03fd5b2c0b87158f0369326e
6b5b98f041b118d2d88fa5647ee05cd05cfebaddadfb1608da5b97f33b5c268c
6bd8a3d8dce116787274c58b9b0ed3d4284191a80cb1249d49c60ef96ade5d87
6debe819b1c972061dbabc633aae5b29675b25c2b44a87029f5207a38940af83
717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53
7462983fe13daa96e5880b250aac03f65144d07aa6695205b9fdefee9d9d0149
78057ff881c7ceb369c163fee7ab0d93ae4754f3a7503d5dbfd4a0b80e203a79
7a45b8766d855498d60f288238e213f35ca4257229d22cb3ca2f76e4e42f167e
7a78fcefc852aff6de32c4d9b843e5f55311f9e92798033edac6c55edccf18e3
7ea75c374d24a7fdfe32bfcbde6ce6f6a72a60ef575f6b173a2b18eb616b2d46
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8527f2e614209fdc43eeda9bc23e2401da9f7ae7903dc9a06b5d2634c4724f97
856e3ebee940abce3b43654f70d07b8ccdcd94e703f0acc679a3af14475c6bf3
864c41950c0f38f03a90ab5da0f650afa1088d0f7c201f49d28fb06b06a02552
867d36d854855408cd9a4409f7c5264928aebc1ff05b8d236e934ca78c4a5a48
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
89e0d5e92136af3c2f1d53d4bd524e308554a0ddf9e44a5bd89ab2e2bdbddd7a
8d0055e6d8cfd78504ea3bfeb93b24bafd670e051503e4f69c2bd26c72148a7a
8d546d353586e8d87a7069e85e13d684c2b1eaff4dc584d3adeaf5caf4341bd7
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e3abeb136da6e17be3cb1b00438b73e67d2b5c3c7724adf2f53e1f438bca9d8
8fed0359a978607741335672c13815cef49036c52f9d3c3173d365840a967ccb
91079c2ee02663f599e944ea27e1d58ae1c116be7f36d4fee438692646a4cfd0
91b7cfa043307269076c97781c8612e09316b998ff87dfc27ebc0057dddc61bd
93e034978a170455e49d3c605349b1f68e0b995c9b9c4e0aac38851ba3d38fde
952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8
960aec98eaab90479ff50f96fb18e031fc8f255c62ee2846f52aa8daf00052c5
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9a89eec5c1b5d924e6ddd19df46671850203320564438840f7eb786b9db04347
9b9c2a70c25715c5d368b7c96a5ddbd1f4968e671b7eaf5ccbccb8dc108b32ec
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a5e470d918babacc4ffc6001009227fc3b3d6303f5e2738aed7a02c2e23628f4
a60e0211e2734fcc57c9a1ce629c37243e3dcc9fa6d55810e358aec55dd82dfc
a75268aabd3efca2333dda30048a44d566fca0fa0c70f87249784d6c4dbaaa50
aa1071032620a94407dff14a685398807b78ff4a1b160e4306dfc6e3a4973b85
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ac8a10adb86d0c585d8c1cc92f2324a769092ef1d22bb6ec6a63b67dc461881f
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af16618be7ba8a002bf2025feb8e118fce2c600a9b11f26f6ef1adb6dc262bd4
b017b4f9fc315b4d2ee511bfd8e9031acb2baf1fa772bb5e04e90be3c759a826
b1eb5f27fd29dfe8c70362c031acd33b08d0eecd6779b27d641e3bd6a22b8527
b279fc53645ca027270ca5d8d20096b3ce3249d20e73ec121d1e0d73e8732d69
b5ad65df4bc15d1bcf9c808f304e03377b91b446d5645b80d7f4347496dbdf4d
b8bdac9a46a9aaabbab5baba1c8486810dab679ebb9f4120b9946a7aee3febb9
bbf923b4f029a2af65cfc2da7222670f6b4fd78c4b8888118fed5b11ee765960
be8fae77cf0adacc0ebc6022588745b2e490caf613b3a6b8dc64f4f145db06f1
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
c81a0fd4e783798145e9fd484d388f77de9213d039d6e218b5f876e801b48a85
c86e69b9f8bd413c9606bea919a815723749510a52a1d78acf674d6c1887526c
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
c9701ff96675266ed2a8c5c2086ca44d6a0338dc114fe66a58dbdea9f4182e71
c9ada4c300c7ae31a34c4b23ce68bb4a96a07db8b8e12d7e8adca1fdc1584cb5
cd639aba89845d31a57ad67d0cbfa6165a62f175dca399bbff55d4acd5b2e876
d0450eb893bf8d8eb93408cbe1a16a1d0ba2b6018a25dfdd4133168139d6f595
d34132b3fdfafe992af8fa6145900bad175f808cabb024b27095fc496cae7aa4
d42163676c92b69e2ee333240a22a1177407d468d203b2a36f9c33e0249194c9
d461e6ce7cd69b96985e81ab947d7f1f004288d09d2b64c19b0ab14ba9d9b6f6
d5cd1db1cde09b8c1436abaafe15c9c219d3ea69ab3987ab3e38ca61e92278c4
d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dca9b6afcb6c37d6a32456973fe5f2986a348a70d11774e102de6fc420992a19
df4934a90cf4f3765ed378f063a615d45a8059411f73601648d7784dc61a9a5b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e73231bc4c1c41d0f09fa0b0134da4c37e65764dad4b71890e74244d7d29d331
e7542b0152212d7b7e4a83b159e557375a6bc566a6c1a9bfc688ce899f6457d3
e79ddd6f7b2fbc9ecbec5855a9e8e76dafa2d27a0f7536a0b431d6b7feb3cf51
ea28e1928c43f3fdb0a9b057537612211b1a9687d16959c502263d06bbe81b73
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366
ee22fe31160b06703e1e38b7b8009a3cd8dbe67df9d0ae213d1d26624f3d8b76
ee41d2ee145923ab2f6b06766855f253ce915c9aba44026073c41006442ed093
eee34cf6d317d2fd9391f07b9606de9d8a202c2d74fcef40d20dc4f1d21b5479
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef53ca1ed9fc4233f8d49c44a602df622b9c933eb0d0fc954ed96d5436fec751
f084eb3b60be7c6309cc5ff62056f29deba6ae55270642089f04f035d9cb3738
f6045b760a2df824771f9f73618ceea27b06198b603f6af2949a088c4ce5a4aa
f6abf43ebb05d483cf3fca737307acad1eab1485b405b8171362384e35831716
f8588c7cfd1a594bed12674d24ced00d02436abec895da63ac50913a9e8fe708

www.benefitsconf.com Open in urlscan Pro 3.212.8.231 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

189 Requests

96 %HTTPS

60 %IPv6

47 Domains

66 Subdomains

61 IPs

6 Countries

4652 kBTransfer

20728 kBSize

32 Cookies

49 Outgoing links

Page URL History

Redirected requests

189 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.benefitsconf.com Open in urlscan Pro
3.212.8.231 Public Scan

Screenshot
Live screenshot

Full Image

189
Requests

96 %
HTTPS

60 %
IPv6

47
Domains

66
Subdomains

61
IPs

6
Countries

4652 kB
Transfer

20728 kB
Size

32
Cookies

189 HTTP transactions
11 data transactions