healthplansforamericans.com Open in urlscan Pro
2a06:98c1:3120::3  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://trustedsubsidynow.com/ Page URL
2. https://healthplansforamericans.com/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response trustedsubsidynow.com/	33 KB 7 KB	576ms 490ms	Document text/html	2606:4700:3032::6815:5e92 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://trustedsubsidynow.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:5e92 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 6c0d564fc0e71894cf35effa393fba3c1b98fa23ae56daf7a1fb85dfb981d298 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control max-age=2678400 cf-cache-status MISS cf-ray 849405525c263d0b-CDG content-encoding br content-type text/html; charset=utf-8 date Mon, 22 Jan 2024 01:28:32 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zveYmUDijnzadU1E%2B6G5c67r4xvxVHfKOrkt7kX09VZxVA7H14ECoPH492TiaWc%2BPyAXmUV3r64miEfBwoi3TQeyeMsf6vy%2BMOg4xhcmYAPg%2BA3jabTPemtjGRlry%2BvMwLArqSB7HNdR34jvYNFN33pRuv8%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-powered-by Express
GET H2	200	style.css trustedsubsidynow.com/css/	15 KB 5 KB	410ms 406ms	Stylesheet text/css	2606:4700:3032::6815:5e92 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://trustedsubsidynow.com/css/style.css Requested by Host: trustedsubsidynow.com URL: https://trustedsubsidynow.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:5e92 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 1f61485459388667aa67b730453d0609c34816d64c5bbed1dafe058b645c4ecd Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:33 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by Express etag W/"3d0e-Sje+ZDMHKG5AEiXzJa/0Iu3cT9A" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P5MnoeQkCUn3SsfbMUsejegwK8mdKK6KM3bJdMGG%2Bj%2BCmDUk5tSFxjRaEQXMJSv0cArezs1U4CVp3ZjQAfK1li1vBtuFY7kGnIZut6dBGdrDBF1E6FWfdlhx3OS%2Fic8ZTmX4YSw0yy43np6%2BgtJWNWamC5I%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=2678400 cf-ray 849405558ecb3d0b-CDG alt-svc h3=":443"; ma=86400
GET H2	200	staff.jpg trustedsubsidynow.com/images/	22 KB 22 KB	377ms 375ms	Image image/jpeg	2606:4700:3032::6815:5e92 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://trustedsubsidynow.com/images/staff.jpg Requested by Host: trustedsubsidynow.com URL: https://trustedsubsidynow.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:5e92 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 9109818aa3e59aa5fd052a2e55ec5c824e1af22f07aacee86c9561b2f33f935d Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:33 GMT cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by Express etag W/"5641-rCTHx6YvHccfxDdjK1qerIWRgmo" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZR%2Fn4tH0LJ37VfAyeoZC3cngIHNd40VHqWRGoJayrHX7bYNkVOmDZR38CLP0aPT4OqYIqW%2B9ZPeDtRtJBXD14zih2A582yYUtK8E%2FPSUlrM81GQ2ADoVHzDJg7du5AZuqGQUH4PNbwiUoviR%2B%2FEM1oOnwLY%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control max-age=2678400 accept-ranges bytes cf-ray 849405558ecc3d0b-CDG alt-svc h3=":443"; ma=86400 content-length 22081
GET H2	200	profile.png trustedsubsidynow.com/images/	19 KB 19 KB	409ms 408ms	Image image/png	2606:4700:3032::6815:5e92 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://trustedsubsidynow.com/images/profile.png Requested by Host: trustedsubsidynow.com URL: https://trustedsubsidynow.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:5e92 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 028bf096de9208f1199b5f3c61b17f34cfe6284fd58018a1c9765d5f82d0fc36 Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:33 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by Express etag W/"4b5d-ubf+cR7rvAk2B68XiXycHMgv7ik" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DbHjnvk9wpz2Whn%2F7PmzMsPgXuPSzabRNjYBbzZDujlbUshgXI5c53NNvpuxwM9GdQmlI881h%2FGWYgp%2BS6g4I6sqq2sTVzs4erPpqumXaeEghLLt%2BWEsT054BSKZLDKKcyTaCLVL1YEaFOeUCFtV9a6ehV8%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=2678400 accept-ranges bytes cf-ray 849405558ecd3d0b-CDG alt-svc h3=":443"; ma=86400 content-length 19293
GET H2	200	rocket-loader.min.js Show response trustedsubsidynow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/	12 KB 4 KB	18ms 17ms	Script application/javascript	2606:4700:3032::6815:5e92 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://trustedsubsidynow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Requested by Host: trustedsubsidynow.com URL: https://trustedsubsidynow.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:5e92 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:32 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 05 Jan 2024 17:29:47 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"65983c8b-302c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3MxW1EY6WXN3GmGXN4GYvSxaA4I%2Bba6saU7GRyTIHO8HsFUNjDkuGj4syKoQgs%2BWDYKb3YsUZpxlD%2BMxB0bmefGceP7s6mvxvKwrMzJ4vybPjqSYU9cgsLLdLP72SF32wtCUWgvRt1AEq0M5wAxivMfMis0%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript x-frame-options DENY cache-control max-age=172800, public cf-ray 849405558ed33d0b-CDG expires Wed, 24 Jan 2024 01:28:32 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	52ms 8ms	Script text/javascript	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: trustedsubsidynow.com URL: https://trustedsubsidynow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Tue, 16 Jan 2024 14:44:55 GMT content-encoding gzip x-content-type-options nosniff age 470618 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 15 Jan 2025 14:44:55 GMT
GET H3	200	absf_v1.0_references.js trustedsubsidynow.com/js/	2 KB 1 KB	271ms 270ms	Script application/javascript	2606:4700:3032::6815:5e92 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://trustedsubsidynow.com/js/absf_v1.0_references.js Requested by Host: trustedsubsidynow.com URL: https://trustedsubsidynow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:5e92 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:33 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by Express etag W/"776-FxEveINLYVrOAyX6UTtUnYlEOtM" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SSWIluvmJGv7r5IdMdhlfOrjQMBXUb9hytiYEBUGYln5eU10NTdUHK1CjxMxAIly2%2BZAzH%2B5%2BP9tKfa8yDHDSMYHPGjgEN95ddseD%2BStDpI5tgX98URR6NpFd39OAsyA03i3oOdXAhRxZ%2F%2FjCZkzYmI7rew%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=2678400 cf-ray 8494055828d04d9e-FRA alt-svc h3=":443"; ma=86400
GET H2	200	Primary Request / Show response healthplansforamericans.com/	20 KB 5 KB	430ms 385ms	Document text/html	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://healthplansforamericans.com/ Requested by Host: trustedsubsidynow.com URL: https://trustedsubsidynow.com/js/absf_v1.0_references.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash e5aafce2b61f6bf0d7336a6bba4fc08eb6d44c6e92524d77793816b6412e3fdd Request headers Referer https://trustedsubsidynow.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control max-age=2678400 cf-cache-status MISS cf-ray 8494055a2c17b7b5-AMS content-encoding br content-type text/html; charset=utf-8 date Mon, 22 Jan 2024 01:28:33 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JSe4%2Bd6AmG4L0WStsMBrAtHyuEpz8i4kmbic2pS42eVkDeDwRq5rTEeGCmR62ruWIxKIOcCm2AZOSu9MAgb0lXia6Wa9HZeuigq8xxAxBlglJ%2Bff2Pv7VJqrb4Awq4JFMLfz8Y9ezWQxQrrzR0R%2F9LL4Kkvj9fH%2BKKQ%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-powered-by Express
GET H2	200	fbevents.js connect.facebook.net/en_US/	213 KB 57 KB	31ms 8ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: trustedsubsidynow.com URL: https://trustedsubsidynow.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers permissions-policy-report-only autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 22 Jan 2024 01:28:33 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 57023 x-xss-protection 0 reporting-endpoints pragma public x-fb-debug aKi9D3hE2/XY983ontF1UtytxkbysxxVc1VkYilW65vkNJ+YrmlkwlDmccpfBL7NTmRyK0/IzIjPOghz987fMQ== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET		a57816b4-6c59-f397-7853-7e14e45d3e1b.js create.lidstatic.com/campaign/	0 0
GET H2	200	982169116227192 connect.facebook.net/signals/config/	134 KB 35 KB	85ms 84ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/982169116227192?v=2.9.141&r=stable&domain=trustedsubsidynow.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers permissions-policy-report-only autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 22 Jan 2024 01:28:33 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints pragma public x-fb-debug hnv+5cTG9Lyyf9xpL/7xe8d5/pX/FQrwxyWv0kDwN/8q1O/Wq1DAR0iWyfyuHMYFKqoVQRxEZMLlSWZp/uHgMA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	254961090299261 connect.facebook.net/signals/config/	134 KB 35 KB	73ms 72ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/254961090299261?v=2.9.141&r=stable&domain=trustedsubsidynow.com Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers permissions-policy-report-only autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=() content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Mon, 22 Jan 2024 01:28:33 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints pragma public x-fb-debug 9FE/iNVvU5tciLIAmibRJ13bPH4H5jtiylaAqo7UOPKg0YCODkABrB5UV7gGggj0E0vO4b8lrReItS2/PhbYkg== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=() timing-allow-origin * priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	30ms 7ms	Image text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=982169116227192&ev=PageView&dl=https%3A%2F%2Ftrustedsubsidynow.com%2F&rl=&if=false&ts=1705886913939&sw=1600&sh=1200&v=2.9.141&r=stable&ec=0&o=4126&fbp=fb.1.1705886913840.1697170505&ler=empty&it=1705886913643&coo=false&cdl=&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 22 Jan 2024 01:28:33 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ www.facebook.com/tr/	0 31 B	30ms 8ms	Image text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=254961090299261&ev=PageView&dl=https%3A%2F%2Ftrustedsubsidynow.com%2F&rl=&if=false&ts=1705886913940&sw=1600&sh=1200&v=2.9.141&r=stable&ec=0&o=4126&fbp=fb.1.1705886913840.1697170505&ler=empty&it=1705886913643&coo=false&cdl=&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://trustedsubsidynow.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Mon, 22 Jan 2024 01:28:33 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	bootstrap.min.css healthplansforamericans.com/css/	158 KB 25 KB	432ms 425ms	Stylesheet text/css	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://healthplansforamericans.com/css/bootstrap.min.css Requested by Host: healthplansforamericans.com URL: https://healthplansforamericans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72 Request headers Referer https://healthplansforamericans.com/ Origin https://healthplansforamericans.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:34 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by Express etag W/"279d8-G+N7YjBsjAxndbtMk8XkxOE9l3U" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zmx4JyqsIuuO81RCplUIoFvBGYBz8SL6ZXuMsH%2BPceAeeTl04mIGWer%2FMkQ%2BJSOznvc1Ah1RcnYbp2oJ7pBnBo5kMANgJ47l1iDyXo%2Bdp5T%2BmC4t0Ahm9J5EGrlKwN2cc9HD%2Bw4VQJB4XdfIpcbXAuAtSpSLG8szY%2FQ%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=2678400 cf-ray 8494055cbd34b7b5-AMS alt-svc h3=":443"; ma=86400
GET H2	200	css fonts.googleapis.com/	9 KB 1 KB	25ms 16ms	Stylesheet text/css	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap Requested by Host: healthplansforamericans.com URL: https://healthplansforamericans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ac8bc924f3f8e41e2babc5338c71f942d91d34022a2fa9f52be2d005d9e71a79 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://healthplansforamericans.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Mon, 22 Jan 2024 01:28:34 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 22 Jan 2024 01:28:34 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 22 Jan 2024 01:28:34 GMT
GET H2	200	css2 fonts.googleapis.com/	23 KB 2 KB	25ms 17ms	Stylesheet text/css	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap Requested by Host: healthplansforamericans.com URL: https://healthplansforamericans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 8a99ee4f93312dac6ab696f053bd65b1513c541bfeb3cdf2cb8862df13c0c721 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://healthplansforamericans.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Mon, 22 Jan 2024 01:28:34 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 22 Jan 2024 01:28:34 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 22 Jan 2024 01:28:34 GMT
GET H2	200	logo.png healthplansforamericans.com/images/	114 KB 114 KB	550ms 544ms	Image image/png	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://healthplansforamericans.com/images/logo.png Requested by Host: healthplansforamericans.com URL: https://healthplansforamericans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash d1854f2659dc32e24936df4a715d520ba3b2d3da5b03a3fe84d5904446bbb20a Request headers accept-language de-DE,de;q=0.9 Referer https://healthplansforamericans.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:34 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by Express etag W/"1c760-KNQWKKlfM4e9HIFYB5aik573NbA" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yut8hQaG9IutMeDR25tkdkwwRq1QZMxR7oYLD4mJiu9fUKLQxR9yQ3PGhxtgL1AwrzDU8Ba6ARLG3k92C8LFNKbeV3wBV6YjsEln8%2BrpQXoPYjllCGXTMke%2BWKI0wHf73g9M61DNtFAg8Ikn%2FO%2F6EmjdBrou5HnWfdQ%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control max-age=2678400 accept-ranges bytes cf-ray 8494055cbd35b7b5-AMS alt-svc h3=":443"; ma=86400 content-length 116576
GET H2	200	image.jpg healthplansforamericans.com/images/	31 KB 31 KB	413ms 407ms	Image image/jpeg	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://healthplansforamericans.com/images/image.jpg Requested by Host: healthplansforamericans.com URL: https://healthplansforamericans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash f70a1c4355672de33b4f6af28f01121e969e9ac38365905c7ba6b4701a054792 Request headers accept-language de-DE,de;q=0.9 Referer https://healthplansforamericans.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:34 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by Express etag W/"7a46-zYQ/YRN1YIvI9yrQhgtF7UwkqkI" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4JVjac1s7E3VGNAheUhGnv0urDIYqks1vOo%2Fu8OamcBCXhOP04q0R9K84Tyqys0z01olH%2Bwa%2BYwjGZdMq007SppHiZ4R6eToy9Qw9x%2F5rNck%2BI6Da%2B0FzqB857rP5n5FTRyvZSwzVbbftoRNFEjKX8WZ5XoQ0An2fUE%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control max-age=2678400 accept-ranges bytes cf-ray 8494055cbd36b7b5-AMS alt-svc h3=":443"; ma=86400 content-length 31302
GET H2	200	rocket-loader.min.js Show response healthplansforamericans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/	12 KB 4 KB	16ms 13ms	Script application/javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://healthplansforamericans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Requested by Host: healthplansforamericans.com URL: https://healthplansforamericans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://healthplansforamericans.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:34 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 05 Jan 2024 17:29:47 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"65983c8b-302c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5NOD8vqSpKEwmufXDYmK3mXIX5DdjiPF7VKEqvBsc5fcTh1V1gVeLYnxAIdiojLbTqWWF79UFQn%2BzA%2BzMqd0wMRDJCkX1KBdcLXKwpNKD2aoYdeazQGO%2FwxRMP76R6ld01ocfGn06%2F10KHFNOVN5ULNiXt0%2FycAQTJQ%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript x-frame-options DENY cache-control max-age=172800, public cf-ray 8494055cbd3eb7b5-AMS expires Wed, 24 Jan 2024 01:28:34 GMT
GET H3	200	bootstrap.bundle.min.js Show response healthplansforamericans.com/js/	79 KB 24 KB	562ms 562ms	Script application/javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://healthplansforamericans.com/js/bootstrap.bundle.min.js Requested by Host: healthplansforamericans.com URL: https://healthplansforamericans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 9520018fa5d81f4e4dc9d06afb576f90cbbaba209cfcc6cb60e1464647f7890b Request headers Referer https://healthplansforamericans.com/ Origin https://healthplansforamericans.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 01:28:35 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by Express etag W/"13a24-kNFQNu9I/LM2oTW66BK0VmnxkEQ" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=blEgBTmY8%2BBwvAlWBoI3cIVm7YbAs9y%2BHCAxFUZa3PDQa%2BrNbNRihqa3bOyOvBkPwHCKiysYK4QFH%2BdDZSrB%2F1hf5vUglsagMiCIjrXDEAOFn0hNh6uSbqfBnURWF5ggk5kNTPoMPkdQTntUhzmDPYV5ZfDn%2FhOJG30%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=2678400 cf-ray 8494055f6f0437e9-FRA alt-svc h3=":443"; ma=86400
GET H2	200	CA3efe1122f0fc479bb67e286818ec6966 Show response b-js.ringba.com/	13 KB 13 KB	260ms 196ms	Script text/html	2600:9000:2490:a200:4:1957:6500:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://b-js.ringba.com/CA3efe1122f0fc479bb67e286818ec6966 Requested by Host: healthplansforamericans.com URL: https://healthplansforamericans.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2490:a200:4:1957:6500:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash fa5c959317c14a9a13cde4e8d0766334da1c2c34f24701af99f0959d193ae87a Request headers accept-language de-DE,de;q=0.9 Referer https://healthplansforamericans.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-runtime 0.0000 date Mon, 22 Jan 2024 01:28:33 GMT via 1.1 b26b931354407da013ac53d2c1c55034.cloudfront.net (CloudFront) server Microsoft-IIS/10.0 x-aspnet-version 4.0.30319 x-amz-cf-pop FRA56-P6 x-powered-by ASP.NET access-control-max-age 300 x-cache Miss from cloudfront content-type text/html; charset=utf-8 access-control-allow-origin * cache-control public content-length 13212 x-amz-cf-id gosTJF68EWazJVfgxzN-QXURRwndtrK11tvTQ6RbHdloT-13FcBIpw== expires Mon, 22 Jan 2024 01:33:34 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v40/	47 KB 47 KB	32ms 9ms	Font font/woff2	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,400;0,500;0,600;1,400&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://healthplansforamericans.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Wed, 17 Jan 2024 11:02:10 GMT x-content-type-options nosniff age 397584 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48236 x-xss-protection 0 last-modified Thu, 14 Dec 2023 02:08:40 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 16 Jan 2025 11:02:10 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 15 KB	40ms 18ms	Font font/woff2	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://healthplansforamericans.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Wed, 17 Jan 2024 02:13:53 GMT x-content-type-options nosniff age 429281 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 16 Jan 2025 02:13:53 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	30ms 7ms	Font font/woff2	2a00:1450:4001:82a::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,700|Roboto+Slab:400,700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://healthplansforamericans.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Wed, 17 Jan 2024 14:18:08 GMT x-content-type-options nosniff age 385826 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 16 Jan 2025 14:18:08 GMT
POST H/1.1	200 OK	gnbulk Show response display.ringba.com/v2/nis/	406 B 804 B	384ms 94ms	XHR application/json	54.157.163.131 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://display.ringba.com/v2/nis/gnbulk Requested by Host: b-js.ringba.com URL: https://b-js.ringba.com/CA3efe1122f0fc479bb67e286818ec6966 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.157.163.131 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-157-163-131.compute-1.amazonaws.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash ae7e04a1bbae5c37628d8398e436fe1bb4ef784df61a6b13a5d943243b33e9fc Request headers Referer https://healthplansforamericans.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Content-type text/plain Response headers Pragma no-cache Date Mon, 22 Jan 2024 01:28:34 GMT X-Runtime 0.0020 Server Microsoft-IIS/10.0 X-AspNet-Version 4.0.30319 X-Powered-By ASP.NET Access-Control-Max-Age 300 Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://healthplansforamericans.com Cache-Control no-cache Connection keep-alive Content-Length 406 Expires -1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

create.lidstatic.com

URL

https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __cfQR object| ringba_known_numbers object| _rgba object| ringba object| _rgba_tags number| uidEvent object| bootstrap function| survey1 function| survey2 function| survey3 function| result boolean| __cfRLUnblockHandlers

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.trustedsubsidynow.com/	1970-01-20 20:01:02	Name: _fbp Value: fb.1.1705886913840.1697170505

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
b-js.ringba.com
connect.facebook.net
create.lidstatic.com
display.ringba.com
fonts.googleapis.com
fonts.gstatic.com
healthplansforamericans.com
trustedsubsidynow.com
www.facebook.com
create.lidstatic.com
2600:9000:2490:a200:4:1957:6500:93a1
2606:4700:3032::6815:5e92
2a00:1450:4001:828::200a
2a00:1450:4001:82a::2003
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
2a06:98c1:3120::3
54.157.163.131
028bf096de9208f1199b5f3c61b17f34cfe6284fd58018a1c9765d5f82d0fc36
1f61485459388667aa67b730453d0609c34816d64c5bbed1dafe058b645c4ecd
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
6c0d564fc0e71894cf35effa393fba3c1b98fa23ae56daf7a1fb85dfb981d298
8a99ee4f93312dac6ab696f053bd65b1513c541bfeb3cdf2cb8862df13c0c721
9109818aa3e59aa5fd052a2e55ec5c824e1af22f07aacee86c9561b2f33f935d
9520018fa5d81f4e4dc9d06afb576f90cbbaba209cfcc6cb60e1464647f7890b
ac8bc924f3f8e41e2babc5338c71f942d91d34022a2fa9f52be2d005d9e71a79
ae7e04a1bbae5c37628d8398e436fe1bb4ef784df61a6b13a5d943243b33e9fc
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d1854f2659dc32e24936df4a715d520ba3b2d3da5b03a3fe84d5904446bbb20a
e5aafce2b61f6bf0d7336a6bba4fc08eb6d44c6e92524d77793816b6412e3fdd
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f70a1c4355672de33b4f6af28f01121e969e9ac38365905c7ba6b4701a054792
f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72
fa5c959317c14a9a13cde4e8d0766334da1c2c34f24701af99f0959d193ae87a
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e