money.quickenloans.com Open in urlscan Pro
2606:4700::6812:b34  Public Scan

10 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 52

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/320492720/?random=812341684&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=800&u_h=600&url=https%3A%2F%2Fmoney.quickenloans.com%2F&label=xSwBCJum9PsCELCp6ZgB&hn=www.googleadservices.com&frm=0&tiba=QuickenLoans%20Money%20-%20QUESTIONS&gtm_ee=1&npa=1&pscdl=noapi&auid=1351108740.1712552297&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=COG9sQIIscGxAgiwwbECCLnBsQIIl8GxAgiYwbEC&pscrd=IhMI2p_kuuqxhQMVxl5BAh3OuwJZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6H2h0dHBzOi8vbW9uZXkucXVpY2tlbmxvYW5zLmNvbS8 HTTP 302
• https://www.google.com/pagead/1p-conversion/320492720/?random=812341684&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=800&u_h=600&url=https%3A%2F%2Fmoney.quickenloans.com%2F&label=xSwBCJum9PsCELCp6ZgB&hn=www.googleadservices.com&frm=0&tiba=QuickenLoans%20Money%20-%20QUESTIONS&gtm_ee=1&npa=1&pscdl=noapi&auid=1351108740.1712552297&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=COG9sQIIscGxAgiwwbECCLnBsQIIl8GxAgiYwbEC&pscrd=IhMI2p_kuuqxhQMVxl5BAh3OuwJZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6H2h0dHBzOi8vbW9uZXkucXVpY2tlbmxvYW5zLmNvbS8&is_vtc=1&cid=CAQSGwB7FLtqvfhh_FTAaOsZzdGE0oXPhSZfLPs1ng&random=377273218 HTTP 302
• https://www.google.de/pagead/1p-conversion/320492720/?random=812341684&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=800&u_h=600&url=https%3A%2F%2Fmoney.quickenloans.com%2F&label=xSwBCJum9PsCELCp6ZgB&hn=www.googleadservices.com&frm=0&tiba=QuickenLoans%20Money%20-%20QUESTIONS&gtm_ee=1&npa=1&pscdl=noapi&auid=1351108740.1712552297&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=COG9sQIIscGxAgiwwbECCLnBsQIIl8GxAgiYwbEC&pscrd=IhMI2p_kuuqxhQMVxl5BAh3OuwJZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6H2h0dHBzOi8vbW9uZXkucXVpY2tlbmxvYW5zLmNvbS8&is_vtc=1&cid=CAQSGwB7FLtqvfhh_FTAaOsZzdGE0oXPhSZfLPs1ng&random=377273218&ipr=y

63 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response money.quickenloans.com/	33 KB 10 KB	1200ms 1135ms	Document text/html	2606:4700::6812:b34 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:b34 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d0b95f11d230119102a921c38d7efea4e834ac6dee2bd1e830e12fbcd8fef853 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language de-DE,de;q=0.9 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers cache-control no-store cf-cache-status DYNAMIC cf-ray 870fae61892a30ea-FRA content-encoding gzip content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com content-type text/html; charset=utf-8 date Mon, 08 Apr 2024 04:58:15 GMT referrer-policy same-origin server cloudflare strict-transport-security max-age=15552000; includeSubDomains x-content-type-options nosniff x-dns-prefetch-control off x-download-options noopen x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H2	200	dcq8kbe.css use.typekit.net/	6 KB 1 KB	307ms 183ms	Stylesheet text/css	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/dcq8kbe.css Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 9afdd14bf99da6623d565f70abb79f9e9e865c0b632e53e96db05d9b7f1113b8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Mon, 08 Apr 2024 04:58:16 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 884
GET H2	200	main.a8a315127ec4d21f77b5.css static-lre.refinance.enhancedrefinow.com/	182 KB 29 KB	135ms 69ms	Stylesheet text/css	2606:4700::6812:569 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static-lre.refinance.enhancedrefinow.com/main.a8a315127ec4d21f77b5.css Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 961ca27274d763ccb9fbc880f94e6e81c490c12fad73ce55aef0a938b9e5420f Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:15 GMT via 1.1 85ca8c4198fb707d10ecc2a784a315be.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status REVALIDATED content-encoding gzip strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P7 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Miss from cloudfront x-xss-protection 1; mode=block last-modified Wed, 27 Mar 2024 14:38:36 GMT server cloudflare etag W/"66261baf7603e204ab337f6ce3a39952" vary Accept-Encoding x-frame-options SAMEORIGIN content-type text/css cache-control public, max-age=14400 cf-ray 870fae691ed4bbfd-FRA x-amz-cf-id Zn-UJvseCETZCv3Y5DCUk37zuRirGHQUfWg0VO02Mv0B2nDsE61hVw== expires Mon, 08 Apr 2024 08:58:15 GMT
GET H2	200	pixel-f394989841664ea8aaaf.js Show response cdn-refinance.enhancedrefinow.com/	144 KB 18 KB	1162ms 1088ms	Script application/javascript	2606:4700::6812:569 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn-refinance.enhancedrefinow.com/pixel-f394989841664ea8aaaf.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe4c7a43a9d5736a240da926a7c796811bd0adde361570249e23c14c13229d15 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:16 GMT strict-transport-security max-age=2592000 x-content-type-options nosniff cf-cache-status MISS content-encoding gzip content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-dns-prefetch-control off x-xss-protection 1; mode=block referrer-policy same-origin last-modified Tue, 02 Apr 2024 18:25:26 GMT server cloudflare etag W/"24010-18ea00f1580" x-download-options noopen vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 cache-control public, max-age=14400 cf-ray 870fae692d84bbb3-FRA expires Mon, 08 Apr 2024 08:58:16 GMT
GET H2	200	dacs.js Show response cs-cdn.deviceatlas.com/	21 KB 22 KB	406ms 42ms	Script application/javascript	52.58.191.183 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cs-cdn.deviceatlas.com/dacs.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 52.58.191.183 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-191-183.eu-central-1.compute.amazonaws.com Software nginx/1.17.9 / Resource Hash 145029bd46ef6268a3683431599d1cc5e9b0153c2c5bf840f931e78da99ee2a6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:16 GMT strict-transport-security max-age=31536000 last-modified Wed, 24 Jan 2024 11:56:56 GMT server nginx/1.17.9 accept-ch DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data etag "cfe6e4ceafbea9f6e6c1edad91770ce9" x-cache HIT content-type application/javascript cache-control no-cache accept-ranges bytes content-length 21896 expires Mon, 08 Apr 2024 04:58:15 GMT
GET H2	200	css2 fonts.googleapis.com/	5 KB 1 KB	80ms 30ms	Stylesheet text/css	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Montserrat:wght@400;500;700&display=swap Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2ceb044fbea6e5616887f79557f76fe8b1053593d01b862aa3d50f986d9ac272 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000 date Mon, 08 Apr 2024 04:58:15 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 08 Apr 2024 03:30:14 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 08 Apr 2024 04:58:15 GMT
GET H2	200	msd8xng.css use.typekit.net/	3 KB 904 B	533ms 410ms	Stylesheet text/css	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/msd8xng.css Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 3635c063f773018b9e6952a3fd5fa0952f92d3caf23d9988e2521e81597c6a6b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Mon, 08 Apr 2024 04:58:16 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 681
GET H2	200	ql_logo.svg content.quickencompare.com/qlpln/	4 KB 3 KB	139ms 33ms	Image image/svg+xml	2606:4700::6812:1c6d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://content.quickencompare.com/qlpln/ql_logo.svg Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a92ed9fc3a0e4248ece6c83014a40c1a07f7f4f05934d9449383e2c220b9dafe Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:15 GMT via 1.1 44057555dbfad2fc56417834ad0e2834.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT content-encoding gzip strict-transport-security max-age=2592000 x-amz-cf-pop LHR5-P7 age 765 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Fri, 29 Mar 2024 06:35:27 GMT server cloudflare etag W/"eea100e4a26adee86914e2dd622d33ae" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml cache-control public, max-age=14400 cf-ray 870fae695fd1a06d-FRA x-amz-cf-id i9-zHbfRrcQdkXivNIkmm0gkHpQI05YrbjmSbeStzupQAyhnZn6wUw== expires Mon, 08 Apr 2024 08:58:15 GMT
GET H2	200	dollar-money-icon-small.svg content.quickencompare.com/nmn/logo/	7 KB 5 KB	140ms 34ms	Image image/svg+xml	2606:4700::6812:1c6d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://content.quickencompare.com/nmn/logo/dollar-money-icon-small.svg Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a6f8d6721cb9284a4edfca184bc8ea84b0f07165435686528c19eda52923265 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:15 GMT via 1.1 57eb57a4c7d431365ab5b2e18c495bf4.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT content-encoding gzip strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P6 age 765 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Mon, 11 Mar 2024 13:46:58 GMT server cloudflare etag W/"3b280fb1b5f603b076383e1ca6ea531f" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml cache-control public, max-age=14400 cf-ray 870fae695fd4a06d-FRA x-amz-cf-id xnDqrtohPeImusKxZRQgFLifNCha8uLxRPAzHqwIEKM-c4NeOd-MfQ== expires Mon, 08 Apr 2024 08:58:15 GMT
GET H2	200	Testimonial_Stars_-_LMB_LRE_FNL_00015.png content.refinance.quickenloans.com/msql/	551 B 1 KB	110ms 36ms	Image image/png	2606:4700::6812:d2b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:16 GMT via 1.1 22ec86e3f4ec676e17ef8eea76eefba2.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P6 age 5681 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront content-length 551 x-xss-protection 1; mode=block last-modified Mon, 11 Mar 2024 13:46:57 GMT server cloudflare etag "90732fd581b4624530c995d70d3f17a8" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control public, max-age=14400 accept-ranges bytes cf-ray 870fae6a091139c1-FRA x-amz-cf-id -zbdD2oglWky8bxLRN5ebm95OFLYE4br3on1tIzmAJLPEJQMzm0nVA== expires Mon, 08 Apr 2024 08:58:16 GMT
GET H2	200	qc-financial-control.png content.quickencompare.com/nmn/logo/	12 KB 13 KB	34ms 33ms	Image image/png	2606:4700::6812:1c6d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://content.quickencompare.com/nmn/logo/qc-financial-control.png Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 442b0856c633c8a41e1566de5aea94873cfa27b85e74e2fb2df4c92b55ab5608 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:15 GMT via 1.1 a2eae5bb517678c9d6b43a2731b4462e.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P6 age 765 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront content-length 12630 x-xss-protection 1; mode=block last-modified Wed, 06 Mar 2024 19:12:07 GMT server cloudflare etag "d9164fb30114b13fdb91bd8011b5f71b" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control public, max-age=14400 accept-ranges bytes cf-ray 870fae699ffba06d-FRA x-amz-cf-id uBHDUL_dKONh8VSP2XEkMYtZyG7QTRDHhNYKhi2_fyZuiud6twHZzw== expires Mon, 08 Apr 2024 08:58:15 GMT
GET H2	200	main.a8a315127ec4d21f77b5.js Show response static-lre.refinance.enhancedrefinow.com/	743 KB 129 KB	68ms 68ms	Script application/javascript	2606:4700::6812:569 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static-lre.refinance.enhancedrefinow.com/main.a8a315127ec4d21f77b5.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 966446899ff9ab1047dfb49ecf7c6956dc2887ca58ae41af63912a023dc822f8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:16 GMT via 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status REVALIDATED content-encoding gzip strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P7 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Wed, 27 Mar 2024 14:38:36 GMT server cloudflare etag W/"8156832add5e8628cf2bb24929ccbd44" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript cache-control public, max-age=14400 cf-ray 870fae69cf48bbfd-FRA x-amz-cf-id USYN36BZnGaHbasrqNPajuKpywL7vC9Z1BjYL10ECYN7N_YwsLkzUA== expires Mon, 08 Apr 2024 08:58:16 GMT
GET H2	200	manifest.ad8904c83a912006e10f.js Show response static-lre.refinance.enhancedrefinow.com/	12 KB 5 KB	50ms 50ms	Script application/javascript	2606:4700::6812:569 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static-lre.refinance.enhancedrefinow.com/manifest.ad8904c83a912006e10f.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 96acf36eb8b5e5dca414bf96d3f8ea951a43b878ce970e8d7dd734e98ba8fd69 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:16 GMT via 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status REVALIDATED content-encoding gzip strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P7 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Wed, 27 Mar 2024 14:38:36 GMT server cloudflare etag W/"663602e058dc07911cf2893d64b5dda2" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript cache-control public, max-age=14400 cf-ray 870fae6a4f97bbfd-FRA x-amz-cf-id 0DYz4BrGwuaxaNA7OyHm_8IV4ij7Bl7YiK3KoF6ewUjJpypYHxpOTg== expires Mon, 08 Apr 2024 08:58:16 GMT
GET H2	200	vendor.65d32a6f3f96dc9a4904.js Show response static-lre.refinance.enhancedrefinow.com/	410 KB 129 KB	71ms 70ms	Script application/javascript	2606:4700::6812:569 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static-lre.refinance.enhancedrefinow.com/vendor.65d32a6f3f96dc9a4904.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:569 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cfa16554d9555d746e2f29ae6c897348ed2ab018c0f38116f524579c0c414ff8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:16 GMT content-encoding gzip via 1.1 2ca7ff1df9f3e8dc634c0ad867d837f2.cloudfront.net (CloudFront) cf-cache-status REVALIDATED x-content-type-options nosniff strict-transport-security max-age=2592000 x-amz-cf-pop CDG53-C1 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Tue, 05 Mar 2024 11:12:59 GMT server cloudflare etag W/"43a2b236fe13a03c0e0e9b645e426c79" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript cache-control public, max-age=14400 cf-ray 870fae6a6fb0bbfd-FRA x-amz-cf-id 4_u_sV3hJGwyglGJO75LD_xeCD2_DAiTmvriXpbovAPQBUmgtbl5IQ== expires Mon, 08 Apr 2024 08:58:16 GMT
GET H2	200	p.css p.typekit.net/	5 B 172 B	158ms 35ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=dcq8kbe&ht=tk&f=6844.6845.6846.6847.6848.6851.6852.6853&a=176595194&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/dcq8kbe.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://use.typekit.net/dcq8kbe.css accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:16 GMT last-modified Fri, 23 Jun 2023 17:09:47 GMT server nginx etag "6495d1db-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	5f0797b42693b80012279f39 Show response api.pushnami.com/scripts/v1/pushnami-adv/	298 B 504 B	89ms 25ms	Script application/javascript	13.32.99.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.pushnami.com/scripts/v1/pushnami-adv/5f0797b42693b80012279f39 Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.99.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-99-22.fra60.r.cloudfront.net Software / Resource Hash 57f3c4164467441afe6981ddfe7c0f9f1b10cb739f5cf49fd217c79f70c76210 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:56:23 GMT content-encoding gzip via 1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P3 age 114 vary accept-encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 cache-control no-cache x-amz-cf-id EWpuPKPbXIrhiJhxnJFGDdZkA4IOak3JhLPujX54AdaBAgmfgbhesg==
GET H2	200	datadog-rum-v3.js Show response www.datadoghq-browser-agent.com/	115 KB 37 KB	73ms 24ms	Script application/javascript	13.33.218.24 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.datadoghq-browser-agent.com/datadog-rum-v3.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.33.218.24 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-33-218-24.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:57:36 GMT content-encoding br via 1.1 3de687dde9ccf524586562826ee53358.cloudfront.net (CloudFront) last-modified Mon, 03 Jan 2022 16:36:14 GMT server AmazonS3 x-amz-cf-pop FRA60-P10 age 46 etag W/"647fda9a4d3d74344732d76cf1fff47c" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript cache-control max-age=14400, s-maxage=60 timing-allow-origin * x-amz-cf-id GD-db4bb6mOkLxY8xvqRlpzwQ3SDZ5TAoKukid5GHPxZNj7jFDQEsQ==
GET H2	200	p.css p.typekit.net/	5 B 172 B	35ms 34ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=msd8xng&ht=tk&f=37513.37518.37522&a=121980931&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/msd8xng.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://use.typekit.net/msd8xng.css accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:16 GMT last-modified Fri, 23 Jun 2023 17:09:47 GMT server nginx etag "6495d1db-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H2	200	BG-BLUE-ICON-WHITE.png content.quickencompare.com/qc/refi-images/	59 KB 59 KB	34ms 34ms	Image image/png	2606:4700::6812:1c6d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://content.quickencompare.com/qc/refi-images/BG-BLUE-ICON-WHITE.png Requested by Host: static-lre.refinance.enhancedrefinow.com URL: https://static-lre.refinance.enhancedrefinow.com/main.a8a315127ec4d21f77b5.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 78f6112cc353f90b0f71f3b1c2a5571b1b620290dd2048dc073eb91217c590e7 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://static-lre.refinance.enhancedrefinow.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT via 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P6 age 766 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront content-length 60242 x-xss-protection 1; mode=block last-modified Mon, 18 Mar 2024 10:36:25 GMT server cloudflare etag "0b525d003df460ee3ef27bb82defdb43" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control public, max-age=14400 accept-ranges bytes cf-ray 870fae706c20a06d-FRA x-amz-cf-id or9KZFML1zluz8K7Dv1hI9X36AQfGfPnigRfjY6VRQ3UvhyYInhp5g== expires Mon, 08 Apr 2024 08:58:17 GMT
GET H2	200	l use.typekit.net/af/cafa63/00000000000000000001709a/27/	24 KB 24 KB	143ms 40ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/dcq8kbe.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 5461e0722bbe365dfa0df4652c60a6ced5f83c840d03021c4abd04ae9f9c6980 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://use.typekit.net/dcq8kbe.css Origin https://money.quickenloans.com accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT server nginx etag "1500587fffa9a4bb64d06e988493ea23a02a484a" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24272
GET H2	200	l use.typekit.net/af/80c5d0/00000000000000000001709c/27/	24 KB 24 KB	143ms 40ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/80c5d0/00000000000000000001709c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/dcq8kbe.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash cc62200b7ffb4acffa5ced44e916789729b903e9a39bf86bb6175577500c9fc7 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://use.typekit.net/dcq8kbe.css Origin https://money.quickenloans.com accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT server nginx etag "9852112d8099a97564f64224e106ceeffff9e7c4" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24264
GET H2	200	l use.typekit.net/af/1b1b1e/00000000000000000001709e/27/	24 KB 24 KB	137ms 35ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/dcq8kbe.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 9bacad71ca24f6147c4b72a6c0f351b07ba93b70f992082b812681fb3b46d9b6 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://use.typekit.net/dcq8kbe.css Origin https://money.quickenloans.com accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT server nginx etag "f507d4945327bf77fa226b6fef0f1c6a6af3bf09" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 24180
GET H2	200	l use.typekit.net/af/d32e26/00000000000000000001709b/27/	24 KB 25 KB	174ms 71ms	Font application/font-woff2	2a02:26f0:3500:16::215:1490 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/d32e26/00000000000000000001709b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/dcq8kbe.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 6069bebbfc9a535fa8bf81fa81ce8741f6cef9e5fefd807aa1710a365cfed798 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://use.typekit.net/dcq8kbe.css Origin https://money.quickenloans.com accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT server nginx etag "9689d00c5dfd98cdda07ad0f85b16f1599038e27" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 25016
POST H2	200	visitor Show response money.quickenloans.com/	205 B 327 B	234ms 234ms	XHR application/json	2606:4700::6812:b34 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://money.quickenloans.com/visitor Requested by Host: static-lre.refinance.enhancedrefinow.com URL: https://static-lre.refinance.enhancedrefinow.com/vendor.65d32a6f3f96dc9a4904.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:b34 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 39c143a01ee9cf892da332f5060cbab2ca67e3adde1dd7728e248f1d2d6e6209 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-Type application/json Accept application/json, text/plain, */* Referer https://money.quickenloans.com/ sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip cf-cache-status DYNAMIC x-content-type-options nosniff content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-dns-prefetch-control off x-xss-protection 1; mode=block referrer-policy same-origin server cloudflare etag W/"cd-01rJj4/GKLo83GAzGyRv/os3zrQ" x-download-options noopen x-frame-options SAMEORIGIN content-type application/json; charset=utf-8 cache-control no-store cf-ray 870fae70cb5530ea-FRA
GET H2	200	dollar-money-icon-small.svg content.quickencompare.com/nmn/logo/	7 KB 5 KB	32ms 32ms	Image image/svg+xml	2606:4700::6812:1c6d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://content.quickencompare.com/nmn/logo/dollar-money-icon-small.svg Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a6f8d6721cb9284a4edfca184bc8ea84b0f07165435686528c19eda52923265 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT via 1.1 57eb57a4c7d431365ab5b2e18c495bf4.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT content-encoding gzip strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P6 age 767 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Mon, 11 Mar 2024 13:46:58 GMT server cloudflare etag W/"3b280fb1b5f603b076383e1ca6ea531f" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/svg+xml cache-control public, max-age=14400 cf-ray 870fae70cc67a06d-FRA x-amz-cf-id xnDqrtohPeImusKxZRQgFLifNCha8uLxRPAzHqwIEKM-c4NeOd-MfQ== expires Mon, 08 Apr 2024 08:58:17 GMT
GET H2	200	Testimonial_Stars_-_LMB_LRE_FNL_00015.png content.refinance.quickenloans.com/msql/	551 B 669 B	34ms 34ms	Image image/png	2606:4700::6812:d2b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://content.refinance.quickenloans.com/msql/Testimonial_Stars_-_LMB_LRE_FNL_00015.png Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6812:d2b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT via 1.1 22ec86e3f4ec676e17ef8eea76eefba2.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P6 age 5682 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront content-length 551 x-xss-protection 1; mode=block last-modified Mon, 11 Mar 2024 13:46:57 GMT server cloudflare etag "90732fd581b4624530c995d70d3f17a8" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control public, max-age=14400 accept-ranges bytes cf-ray 870fae70cdef39c1-FRA x-amz-cf-id -zbdD2oglWky8bxLRN5ebm95OFLYE4br3on1tIzmAJLPEJQMzm0nVA== expires Mon, 08 Apr 2024 08:58:17 GMT
GET H2	200	qc-financial-control.png content.quickencompare.com/nmn/logo/	12 KB 12 KB	33ms 33ms	Image image/png	2606:4700::6812:1c6d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://content.quickencompare.com/nmn/logo/qc-financial-control.png Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 442b0856c633c8a41e1566de5aea94873cfa27b85e74e2fb2df4c92b55ab5608 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT via 1.1 a2eae5bb517678c9d6b43a2731b4462e.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P6 age 767 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront content-length 12630 x-xss-protection 1; mode=block last-modified Wed, 06 Mar 2024 19:12:07 GMT server cloudflare etag "d9164fb30114b13fdb91bd8011b5f71b" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control public, max-age=14400 accept-ranges bytes cf-ray 870fae70cc68a06d-FRA x-amz-cf-id uBHDUL_dKONh8VSP2XEkMYtZyG7QTRDHhNYKhi2_fyZuiud6twHZzw== expires Mon, 08 Apr 2024 08:58:17 GMT
GET H2	200	/ Show response money.quickenloans.com/app-configuration/	4 B 90 B	694ms 694ms	XHR text/html	2606:4700::6812:b34 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://money.quickenloans.com/app-configuration/?path=/lendingLeadGen/fraud/anura/enabled Requested by Host: static-lre.refinance.enhancedrefinow.com URL: https://static-lre.refinance.enhancedrefinow.com/vendor.65d32a6f3f96dc9a4904.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:b34 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Accept application/json, text/plain, */* Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT strict-transport-security max-age=15552000; includeSubDomains referrer-policy same-origin cf-cache-status DYNAMIC content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com server cloudflare x-download-options noopen x-dns-prefetch-control off x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 cache-control no-store cf-ray 870fae70db5a30ea-FRA x-xss-protection 1; mode=block
GET BLOB	200 OK	45424c53-fe06-405e-b2ea-29aa2821f547 https://money.quickenloans.com/	26 KB 0		Other text/plain
General Check archive.org Show headers Download Go to Full URL blob:https://money.quickenloans.com/45424c53-fe06-405e-b2ea-29aa2821f547 Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b99c919f168349275b903d0a29253e0de9a945945650d811ee2ee0214b9387be Request headers accept-language de-DE,de;q=0.9 Referer https://money.quickenloans.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Length 26149 Content-Type
GET H2	200	js Show response www.googletagmanager.com/gtag/	220 KB 79 KB	158ms 103ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-319191520 Requested by Host: cdn-refinance.enhancedrefinow.com URL: https://cdn-refinance.enhancedrefinow.com/pixel-f394989841664ea8aaaf.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash c5b207c2c555dfc84c1e8c1e22ab39bca18fdaa446ce843934c814a30d920ead Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80503 x-xss-protection 0 last-modified Mon, 08 Apr 2024 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 08 Apr 2024 04:58:17 GMT
GET H2	200	everflow.js Show response www.lmbahsj2.com/scripts/sdk/	60 KB 19 KB	229ms 129ms	Script text/javascript	35.201.76.131 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.lmbahsj2.com/scripts/sdk/everflow.js Requested by Host: cdn-refinance.enhancedrefinow.com URL: https://cdn-refinance.enhancedrefinow.com/pixel-f394989841664ea8aaaf.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.201.76.131 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 131.76.201.35.bc.googleusercontent.com Software nginx / Resource Hash 2afe4bc78895ed6cf48217fe9e4f6288790b0b0c40d9e102da654e3373f16f9e Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding gzip via 1.1 google accept-ch Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model server nginx vary Origin content-type text/javascript cache-control max-age=14400 x-eflow-request-id 229f3435-6889-4dd7-b1a6-9bb3e1b54732 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	ytc.js Show response s.yimg.com/wi/ Frame EF35	18 KB 7 KB	103ms 31ms	Script application/javascript	2a00:1288:80:807::1 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/ytc.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers ats-carp-promotion 1, 1 date Mon, 08 Apr 2024 04:01:18 GMT x-amz-version-id xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW content-encoding gzip strict-transport-security max-age=31536000 x-content-type-options nosniff x-amz-request-id F1PCYRWXTVZ1DCP6 age 3420 x-amz-server-side-encryption AES256 content-length 6262 x-amz-id-2 GZ37l4g0cz3XoGHRcmw6Zwk3BounPtTBncbImmbkZgEXH0VbgSbHRyG/VOGNP/nmFYLjo08Onr0GXR+HGdnHOokhcWHV1YV5 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-amz-expiration expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle" last-modified Mon, 26 Jun 2023 09:26:35 GMT server ATS etag "5c6ed25dce803fd84288922b8928409e-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin, Accept-Encoding content-type application/javascript cache-control public,max-age=3600 accept-ranges bytes
GET H2	200	js Show response www.googletagmanager.com/gtag/	245 KB 85 KB	92ms 38ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-11411986938 Requested by Host: cdn-refinance.enhancedrefinow.com URL: https://cdn-refinance.enhancedrefinow.com/pixel-f394989841664ea8aaaf.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d8c59d69df258ace575b084d308fa2a992e2dcd1bd3ae51e8770d31d216e3738 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 87016 x-xss-protection 0 last-modified Mon, 08 Apr 2024 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 08 Apr 2024 04:58:17 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	220 KB 79 KB	175ms 121ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-320492720 Requested by Host: cdn-refinance.enhancedrefinow.com URL: https://cdn-refinance.enhancedrefinow.com/pixel-f394989841664ea8aaaf.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 2c78646714bab0eeeaed44bfc0579517cca362c7baf79e90cf53df4c26c15d97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80633 x-xss-protection 0 last-modified Mon, 08 Apr 2024 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 08 Apr 2024 04:58:17 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	82ms 24ms	Script application/javascript	146.75.116.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding gzip last-modified Fri, 22 Mar 2024 21:07:24 GMT x-amz-server-side-encryption AES256 etag "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15412 x-served-by cache-iad-kiad7000168-IAD, cache-fra-eddf8230072-FRA
GET H2	200	js Show response www.googletagmanager.com/gtag/	219 KB 79 KB	123ms 71ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10865694633 Requested by Host: cdn-refinance.enhancedrefinow.com URL: https://cdn-refinance.enhancedrefinow.com/pixel-f394989841664ea8aaaf.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e00962964562f996592f013489104c12be81cc0aa12fc5b488262ad0b6adb1c3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80416 x-xss-protection 0 last-modified Mon, 08 Apr 2024 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 08 Apr 2024 04:58:17 GMT
GET H2	200	tfa.js Show response cdn.taboola.com/libtrc/unip/1522456/ Frame EF35	69 KB 22 KB	180ms 127ms	Script application/javascript	151.101.129.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/unip/1522456/tfa.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.44 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 90d4a074f92ad1bef91efb9dee839eab4d6a0c0781cc4b8f6ad8062dbd4cc365 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-amz-version-id n9gZ49gnxpx6MtsKxnTNstoV1jL77fQY content-encoding gzip via 1.1 varnish date Mon, 08 Apr 2024 04:58:17 GMT x-amz-request-id XC4QE7TV6V5S99X8 age 0 x-amz-server-side-encryption AES256 x-cache HIT x-amz-replication-status COMPLETED content-length 21525 x-amz-id-2 xzWA3Rlld7ji6QKgOZ2hX6ukaXUlzz/eo58FK89TwJHe2tuhl6vzF92mXMMAz2a4q70XLl/afG4= x-served-by cache-fra-etou8220098-FRA last-modified Sun, 07 Apr 2024 11:52:52 GMT server AmazonS3 x-timer S1712552297.266750,VS0,VE105 etag "dbd820e999e2be58a8986726185cd54f" vary Accept-Encoding content-type application/javascript; charset=utf-8 abp 86 access-control-allow-origin * cache-control private,max-age=14401 accept-ranges bytes x-cache-hits 0
GET H2	200	analytics Show response ads.revjet.com/ Frame EF35	19 KB 8 KB	96ms 28ms	Script application/javascript	167.235.11.39 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://ads.revjet.com/analytics?acu=6680 Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 167.235.11.39 Bühl, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.39.11.235.167.clients.your-server.de Software nginx / Resource Hash 2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding gzip last-modified Wed, 20 Dec 2023 16:46:28 GMT server nginx etag W/"65831a64-4c14" content-type application/javascript access-control-allow-origin * cache-control max-age=600 expires Mon, 08 Apr 2024 05:08:17 GMT
GET H3	200	conversion.js Show response www.googleadservices.com/pagead/	53 KB 19 KB	96ms 40ms	Script text/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion.js Requested by Host: cdn-refinance.enhancedrefinow.com URL: https://cdn-refinance.enhancedrefinow.com/pixel-f394989841664ea8aaaf.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash 70460176e16d049816b8002e29ba47d89ef08e85156faa46321b4547f9590e35 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 19902 x-xss-protection 0 server cafe etag 5258802830793930016 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Mon, 08 Apr 2024 04:58:17 GMT
GET H2	200	bat.js Show response bat.bing.com/	45 KB 13 KB	134ms 53ms	Script application/javascript	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Mon, 08 Apr 2024 04:58:17 GMT last-modified Thu, 29 Feb 2024 19:58:06 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 018BD6ACD79E4712B6570493556B2CE5 Ref B: FRAEDGE1519 Ref C: 2024-04-08T04:58:17Z etag "01b4e9c496bda1:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 13261
GET H/1.1	200	44325 Show response a44325.actonservice.com/cdnr/forpci43/acton/bn/tracker/	5 KB 5 KB	606ms 183ms	Script application/javascript	207.189.124.43 ASN-FLEXENTIAL
General Check archive.org Show headers Download Go to Full URL https://a44325.actonservice.com/cdnr/forpci43/acton/bn/tracker/44325 Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 207.189.124.43 Beaverton, United States, ASN13649 (ASN-FLEXENTIAL, US), Reverse DNS forpci43.actonsoftware.com Software / Resource Hash 850f63abfbf73584c621d4c4dd463feaec791ae90bfb3b2760fca72e856f7e08 Security Headers Name Value Strict-Transport-Security max-age=16070400 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Content-Type application/javascript;charset=utf-8 Date Mon, 08 Apr 2024 04:58:17 GMT X-Cnection close Strict-Transport-Security max-age=16070400 Content-Length 4850 P3P CP="Act-On does not have a P3P policy. Learn why here: https://act-on.com/p3p-policy/"
GET H2	200	favicon.ico content.quickencompare.com/qlpln/	15 KB 8 KB	33ms 33ms	Other image/vnd.microsoft.icon	2606:4700::6812:1c6d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://content.quickencompare.com/qlpln/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:1c6d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb8d89a2f12e25a59b766cc7e4c1b54f5c79d710a0fd36e2670ca479f982883d Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT via 1.1 c3fc8d1fb362a6655af993732c376dc4.cloudfront.net (CloudFront) x-content-type-options nosniff cf-cache-status HIT content-encoding gzip strict-transport-security max-age=2592000 x-amz-cf-pop FRA56-P6 age 765 x-amz-server-side-encryption AES256 content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Mon, 11 Mar 2024 13:46:59 GMT server cloudflare etag W/"0be220b17dcbe52bb4a1c4af89b0a2b5" vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/vnd.microsoft.icon cache-control public, max-age=14400 cf-ray 870fae719ce1a06d-FRA x-amz-cf-id l5FDUzrjB95bDG3q4ztPsqud312yjiqWN4vNK81BNHWBPw3De6EtTA== expires Mon, 08 Apr 2024 08:58:17 GMT
GET H2	200	adsct t.co/1/i/	43 B 377 B	190ms 126ms	Image image/gif	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=5c55abf9-0eb2-4e86-b8ec-c2230b653da6&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=ce596817-c8df-4070-8067-ceb393afae6d&tw_document_href=https%3A%2F%2Fmoney.quickenloans.com%2F&tw_iframe_status=0&txn_id=odmun&type=javascript&version=2.3.30 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-response-time 104 date Mon, 08 Apr 2024 04:58:16 GMT strict-transport-security max-age=0 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 7c54b7a8a70f9adb cache-control no-cache, no-store, max-age=0 perf 7469935968 x-connection-hash 3554209ca6ac7cd649646643c8e9813154660b55e4c871c9e1e8fef4f0d651aa content-length 43
GET H2	200	adsct analytics.twitter.com/1/i/	43 B 726 B	193ms 138ms	Image image/gif	104.244.42.195 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=5c55abf9-0eb2-4e86-b8ec-c2230b653da6&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=ce596817-c8df-4070-8067-ceb393afae6d&tw_document_href=https%3A%2F%2Fmoney.quickenloans.com%2F&tw_iframe_status=0&txn_id=odmun&type=javascript&version=2.3.30 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-response-time 116 date Mon, 08 Apr 2024 04:58:16 GMT strict-transport-security max-age=631138519 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 35d3e3cb1d013afa cache-control no-cache, no-store, max-age=0 perf 7469935968 x-connection-hash b6d2d395019ee47c00e4faa94ba0071b9e201219f583225ff45693350c7f057b content-length 43
GET H2	200	pd3521 Show response pix.revjet.com/track/ Frame EF35	46 B 223 B	147ms 43ms	Script text/javascript	135.181.177.143 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://pix.revjet.com/track/pd3521?__noscript=false&__cbf=revjet.callbacks.cb1712552297301&location=https%3A%2F%2Fmoney.quickenloans.com%2F&referrer=https%3A%2F%2Fmoney.quickenloans.com%2F&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=&typeOfLoan=&loanRefiPurpose= Requested by Host: ads.revjet.com URL: https://ads.revjet.com/analytics?acu=6680 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 135.181.177.143 Helsinki, Finland, ASN24940 (HETZNER-AS, DE), Reverse DNS static.143.177.181.135.clients.your-server.de Software / Resource Hash 397764895ca0261ad1381c72ca6234b18ed1eae8d26e461757562a74b2b0a2b9 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-length 46 content-type text/javascript
GET H2	200	10194306.json Show response s.yimg.com/wi/config/ Frame EF35	46 B 678 B	212ms 152ms	XHR application/json	2a00:1288:80:807::1 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wi/config/10194306.json Requested by Host: s.yimg.com URL: https://s.yimg.com/wi/ytc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash e8a12726ee07f3a17f43d5715b0f1c49c2548baf3ce450d2880701034c75700b Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:18 GMT x-amz-version-id MgPX3Ubd5R7ldVWLza4pXQms3V80CcgI x-content-type-options nosniff strict-transport-security max-age=31536000 x-amz-request-id E8R3MMS2CJFGDJ82 age 0 x-amz-server-side-encryption AES256 content-length 46 x-amz-id-2 WyBfUm97IPXo+ElY9DPTwO0jc8gkOjy0p4oWiL60RR2XIUVtnkXfxMZB2hn4uS2RGrgSzFIcn0o= x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-amz-expiration expiry-date="Wed, 14 May 2025 00:00:00 GMT", rule-id="oath-standard-lifecycle" last-modified Mon, 08 Apr 2024 03:34:22 GMT server ATS etag "87d7a3e6ca5844729c849e28a1fdffda" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method access-control-allow-methods GET content-type application/json access-control-allow-origin * accept-ranges bytes
POST H2	200	track Show response money.quickenloans.com/	246 B 312 B	209ms 209ms	XHR application/json	2606:4700::6812:b34 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://money.quickenloans.com/track Requested by Host: www.datadoghq-browser-agent.com URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:b34 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e4e6af5521d9f67611233fb8e3097336191ef0c1f04a088cd6eeaf0566794042 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-Type application/json Accept application/json, text/plain, */* Referer https://money.quickenloans.com/ sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip cf-cache-status DYNAMIC x-content-type-options nosniff content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com x-dns-prefetch-control off x-xss-protection 1; mode=block referrer-policy same-origin server cloudflare etag W/"f6-p7KwPluPDiZwT8IWeOIQxtXoFiQ" x-download-options noopen x-frame-options SAMEORIGIN content-type application/json; charset=utf-8 cache-control no-store cf-ray 870fae724c1330ea-FRA
GET H2	200	destination Show response www.googletagmanager.com/gtag/	220 KB 79 KB	36ms 35ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-320492720&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-11411986938 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 79c7aa787f01fdd45b752c249dc92b59bd54214589ae9487ccdaaa633f38e4e1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 80659 x-xss-protection 0 last-modified Mon, 08 Apr 2024 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 08 Apr 2024 04:58:17 GMT
GET H3	200	/ Show response www.googleadservices.com/pagead/conversion/320492720/	3 KB 2 KB	38ms 38ms	Script text/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion/320492720/?random=1712552297414&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=800&u_h=600&url=https%3A%2F%2Fmoney.quickenloans.com%2F&label=xSwBCJum9PsCELCp6ZgB&hn=www.googleadservices.com&frm=0&tiba=QuickenLoans%20Money%20-%20QUESTIONS&gtm_ee=1&npa=1&pscdl=noapi&auid=1351108740.1712552297&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-320492720 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash 18856442017eb1027052d7e1ba402c91076ef37cf3f334e505f47b078e3b83de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Mon, 08 Apr 2024 04:58:17 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1561 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	json Show response trc.taboola.com/1522456/trc/3/ Frame EF35	3 KB 2 KB	52ms 44ms	Script application/javascript	151.101.129.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://trc.taboola.com/1522456/trc/3/json?tim=1712552297432&data=%7B%22id%22%3A8%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1712552297429%2C%22cv%22%3A%2220240407-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fmoney.quickenloans.com%2F%3F%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dcoredigital-quickenloans-qcmoney-sc%3Aabp%3D1%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1712552297432%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fmoney.quickenloans.com%2F%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/unip/1522456/tfa.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.44 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 2ee8cc988551cd230f6f82a9053dc02d3c4c9c9ae8d90a61020cd7a8bf219755 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-vcl-time-ms 23 date Mon, 08 Apr 2024 04:58:17 GMT content-encoding gzip via 1.1 varnish cpu 0.14925 x-fastly-to-nlb-rtt 7359 x-cache MISS p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" x-service-version v1 x-served-by cache-fra-etou8220098-FRA x-log-content-encoding gzip server nginx x-timer S1712552297.453205,VS0,VE23 vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-allow-credentials true accept-ranges bytes x-cache-hits 0
POST H2	200	pub6a529f19365581f6a44df4d3740084c6 rum-http-intake.logs.datadoghq.com/v1/input/	0 0	518ms 267ms	Ping application/json	2600:1f18:24e6:b900:517e:4cf5:d52b:ed1 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rum-http-intake.logs.datadoghq.com/v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-K37ZAV3H4&batch_time=1712552297435 Requested by Host: www.datadoghq-browser-agent.com URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:24e6:b900:517e:4cf5:d52b:ed1 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-platform "Win32" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers
GET H2	204	146000783.js Show response bat.bing.com/p/action/	0 118 B	116ms 116ms	Script text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/146000783.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Mon, 08 Apr 2024 04:58:17 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 01F6DA8BD3594EBD9CBF50BA547891B2 Ref B: FRAEDGE1519 Ref C: 2024-04-08T04:58:17Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 286 B	46ms 46ms	Image text/plain	2620:1ec:c11::237 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=146000783&Ver=2&mid=ce291742-3e32-4df0-9f7d-45accd671720&sid=9cfc7240f56411ee92f2999a03df5ccd&vid=9cfc8380f56411ee8da65f4bc359808c&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=800&sh=600&sc=24&tl=QuickenLoans%20Money%20-%20QUESTIONS&p=https%3A%2F%2Fmoney.quickenloans.com%2F&r=&lt=2630&evt=pageLoad&sv=1&rn=119690 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Mon, 08 Apr 2024 04:58:17 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 4CE78B3B2FEA4EC2B41E2E23DC92E1BE Ref B: FRAEDGE1519 Ref C: 2024-04-08T04:58:17Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.google.de/pagead/1p-conversion/320492720/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/320492720/?random=812341684&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&... https://www.google.com/pagead/1p-conversion/320492720/?random=812341684&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=800&u_h=600&url=h... https://www.google.de/pagead/1p-conversion/320492720/?random=812341684&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=800&u_h=600&url=ht...	42 B 64 B	89ms 40ms	Image image/gif	142.250.186.35 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-conversion/320492720/?random=812341684&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=800&u_h=600&url=https%3A%2F%2Fmoney.quickenloans.com%2F&label=xSwBCJum9PsCELCp6ZgB&hn=www.googleadservices.com&frm=0&tiba=QuickenLoans%20Money%20-%20QUESTIONS&gtm_ee=1&npa=1&pscdl=noapi&auid=1351108740.1712552297&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=COG9sQIIscGxAgiwwbECCLnBsQIIl8GxAgiYwbEC&pscrd=IhMI2p_kuuqxhQMVxl5BAh3OuwJZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6H2h0dHBzOi8vbW9uZXkucXVpY2tlbmxvYW5zLmNvbS8&is_vtc=1&cid=CAQSGwB7FLtqvfhh_FTAaOsZzdGE0oXPhSZfLPs1ng&random=377273218&ipr=y Protocol H3 Server 142.250.186.35 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://money.quickenloans.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers pragma no-cache date Mon, 08 Apr 2024 04:58:17 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 08 Apr 2024 04:58:17 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" location https://www.google.de/pagead/1p-conversion/320492720/?random=812341684&cv=11&fst=1712552297414&bg=ffffff&guid=ON&async=1&gtm=45be4430za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&u_w=800&u_h=600&url=https%3A%2F%2Fmoney.quickenloans.com%2F&label=xSwBCJum9PsCELCp6ZgB&hn=www.googleadservices.com&frm=0&tiba=QuickenLoans%20Money%20-%20QUESTIONS&gtm_ee=1&npa=1&pscdl=noapi&auid=1351108740.1712552297&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.105%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.105&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=SA&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=COG9sQIIscGxAgiwwbECCLnBsQIIl8GxAgiYwbEC&pscrd=IhMI2p_kuuqxhQMVxl5BAh3OuwJZMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAs6H2h0dHBzOi8vbW9uZXkucXVpY2tlbmxvYW5zLmNvbS8&is_vtc=1&cid=CAQSGwB7FLtqvfhh_FTAaOsZzdGE0oXPhSZfLPs1ng&random=377273218&ipr=y content-type image/gif cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	sp.pl sp.analytics.yahoo.com/ Frame EF35	43 B 631 B	153ms 49ms	Image image/gif	212.82.100.181 YAHOO-IRD
General Check archive.org Show headers Download Go to Show image Full URL https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Mon%2C%2008%20Apr%202024%2004%3A58%3A17%20GMT&n=-2d&.yp=10194306&f=https%3A%2F%2Fmoney.quickenloans.com%2F&e=https%3A%2F%2Fmoney.quickenloans.com%2F&enc=UTF-8&yv=1.15.1&isIframe=1 Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB), Reverse DNS spdc.pbp.vip.ir2.yahoo.com Software ATS / Resource Hash 0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39 Security Headers Name Value Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Mon, 08 Apr 2024 04:58:17 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin server ATS content-security-policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-frame-options DENY content-type image/gif cache-control no-cache, private, must-revalidate accept-ranges bytes content-length 43 expires Mon, 08 Apr 2024 04:58:17 GMT
GET H2	200	sp.pl sp.analytics.yahoo.com/ Frame EF35	43 B 245 B	153ms 50ms	Image image/gif	212.82.100.181 YAHOO-IRD
General Check archive.org Show headers Download Go to Show image Full URL https://sp.analytics.yahoo.com/sp.pl?a=10000&.yp=10194306&f=https%3A%2F%2Fmoney.quickenloans.com%2F&e=https%3A%2F%2Fmoney.quickenloans.com%2F&enc=UTF-8&yv=1.15.1&isIframe=1&et=custom&ec=pg1 Requested by Host: money.quickenloans.com URL: https://money.quickenloans.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB), Reverse DNS spdc.pbp.vip.ir2.yahoo.com Software ATS / Resource Hash 0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39 Security Headers Name Value Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Mon, 08 Apr 2024 04:58:17 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin server ATS content-security-policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-frame-options DENY content-type image/gif cache-control no-cache, private, must-revalidate accept-ranges bytes content-length 43 expires Mon, 08 Apr 2024 04:58:17 GMT
GET H2	200	JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 fonts.gstatic.com/s/montserrat/v26/	32 KB 33 KB	81ms 22ms	Font font/woff2	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://fonts.googleapis.com/ Origin https://money.quickenloans.com accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 02 Apr 2024 06:41:12 GMT x-content-type-options nosniff age 512225 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33092 x-xss-protection 0 last-modified Wed, 13 Sep 2023 22:51:58 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 02 Apr 2025 06:41:12 GMT
GET H2	200	/ Show response money.quickenloans.com/app-configuration/	98 B 156 B	214ms 214ms	XHR text/html	2606:4700::6812:b34 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://money.quickenloans.com/app-configuration/?path=/lendingLeadGen/fraud/anura/skipSourceIds Requested by Host: www.datadoghq-browser-agent.com URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:4700::6812:b34 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7b4b35ac6aeb38a952f96382aa50acf3a8ff60dc0e3f8f04864641d3b0baae6d Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Accept application/json, text/plain, */* Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 08 Apr 2024 04:58:17 GMT strict-transport-security max-age=15552000; includeSubDomains referrer-policy same-origin cf-cache-status DYNAMIC content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com server cloudflare x-download-options noopen x-dns-prefetch-control off x-frame-options SAMEORIGIN content-type text/html; charset=utf-8 cache-control no-store cf-ray 870fae753db130ea-FRA x-xss-protection 1; mode=block
GET H/1.1	200	44325 a44325.actonservice.com/acton/bn/	43 B 535 B	183ms 183ms	Image image/gif	207.189.124.43 ASN-FLEXENTIAL
General Check archive.org Show headers Download Go to Show image Full URL https://a44325.actonservice.com/acton/bn/44325?target=https%3A%2F%2Fmoney.quickenloans.com%2F&ref=&v=2&ts=1712552297203&nc=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 207.189.124.43 Beaverton, United States, ASN13649 (ASN-FLEXENTIAL, US), Reverse DNS forpci43.actonsoftware.com Software / Resource Hash 2188414d64d2930eb54f4731b6eb9a931358ba625d1cd7535a889409218609d2 Security Headers Name Value Strict-Transport-Security max-age=16070400 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Content-Type image/gif Date Mon, 08 Apr 2024 04:58:17 GMT X-Cnection close Strict-Transport-Security max-age=16070400 Content-Length 43 Vary Accept-Encoding P3P CP="Act-On does not have a P3P policy. Learn why here: https://act-on.com/p3p-policy/"
GET H2	200	request.js Show response script.anura.io/	57 KB 21 KB	195ms 104ms	Script application/javascript	18.133.44.8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.anura.io/request.js?instance=3439535758&exid=89c3cfbe-ff8b-5365-96f2-b10fcf2d60dc&source=null&campaign=undefined&492708312506 Requested by Host: static-lre.refinance.enhancedrefinow.com URL: https://static-lre.refinance.enhancedrefinow.com/main.a8a315127ec4d21f77b5.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.133.44.8 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-133-44-8.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 153158d1d4d7e39dc501eb4d0cd64725e9d7c48bc1835feefbef8a35f6a627a8 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Mon, 08 Apr 2024 04:58:18 GMT content-encoding gzip x-content-type-options nosniff server nginx vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0 expires Sun, 28 Dec 1980 18:57:00 EST
GET H2	200	showads.js Show response ads.anura.io/	0 351 B	76ms 21ms	XHR application/javascript	18.66.147.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.anura.io/showads.js?219275539888 Requested by Host: www.datadoghq-browser-agent.com URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-44.fra60.r.cloudfront.net Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Sun, 07 Apr 2024 12:34:05 GMT content-encoding gzip via 1.1 9c920cc684a38b53bc9c7a44ba794874.cloudfront.net (CloudFront) server nginx x-amz-cf-pop FRA60-P4 age 59053 vary Accept-Encoding x-cache Hit from cloudfront access-control-allow-methods GET access-control-allow-origin * content-type application/javascript; charset=utf-8 x-amz-cf-id MCGufE6EaSAlnz_sMc5BnfjA2pAqGd8o8aGfA-J372ZRnErj8MMpmg==
POST H2	200	response.json Show response script.anura.io/	146 B 483 B	162ms 88ms	XHR application/json	18.133.44.8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.anura.io/response.json Requested by Host: www.datadoghq-browser-agent.com URL: https://www.datadoghq-browser-agent.com/datadog-rum-v3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.133.44.8 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-133-44-8.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 19b3be4f7e3967d7dff99f30ce717d60763337903591bfe3bc5a8c867ab50499 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-platform "Win32" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers pragma no-cache date Mon, 08 Apr 2024 04:58:18 GMT content-encoding gzip x-content-type-options nosniff server nginx vary Accept-Encoding access-control-allow-methods POST content-type application/json; charset=utf-8 access-control-allow-origin * cache-control private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0 expires Sun, 28 Dec 1980 18:57:00 EST
GET H2	204	unip Show response trc-events.taboola.com/1522456/log/3/ Frame EF35	0 252 B	136ms 31ms	XHR text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Full URL https://trc-events.taboola.com/1522456/log/3/unip?en=pre_d_eng_tb&tos=1551&scd=0&ssd=1&est=1712552297430&ver=36&isls=true&src=i&invt=1500&msa=0&rv=1&tim=1712552298982&vi=1712552297429&ri=f2ad20badf6f6b9b0f2619d1c42671d2&ref=null&cv=20240407-9-RELEASE&item-url=https%3A%2F%2Fmoney.quickenloans.com%2F Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/unip/1522456/tfa.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://money.quickenloans.com/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers access-control-allow-origin https://money.quickenloans.com pragma no-cache date Mon, 08 Apr 2024 04:58:19 GMT cache-control no-cache access-control-allow-credentials true server nginx p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"